Method and system for monitoring and analyzing quality of service in a storage system

Methods and systems for monitoring quality of service (QOS) data for a plurality of storage volumes from a storage operating system of a storage system are provided. A performance manager collects the QOS data from the storage operating system and the QOS data includes a response time in which each of the plurality of storage volumes respond to an input/output (I/O) request. An expected range for future QOS data is generated based on the collected QOS data. The QOS data is monitored for each storage volume for determining whether a current QOS data for each storage volume is within the expected range.

TECHNICAL FIELD

The present disclosure relates to monitoring and analyzing quality of service (QOS) performance in a storage system.

BACKGROUND

Various forms of storage systems are used today. These forms include direct attached storage (DAS) network attached storage (NAS) systems, storage area networks (SANs), and others. Network storage systems are commonly used for a variety of purposes, such as providing multiple clients with access to shared data, backing up data and others.

A storage system typically includes at least a computing system executing a storage operating system for storing and retrieving data on behalf of one or more client computing systems (may just be referred to as “client” or “clients”). The storage operating system stores and manages shared data containers in a set of mass storage devices.

Quality of Service (QOS) is used in a storage environment to provide certain throughput in processing input/output (I/O) requests, a response time goal within, which I/O requests are processed and a number of I/O requests processed within a given time (for example, in a second (IOPS). Throughput means an amount of data transferred within a given time in response to the I/O requests, for example, in megabytes per second (Mb/s). Different QOS levels may be provided to different clients depending on client service levels.

To process an I/O request to read and/or write data, various resources are used within a storage system, for example, network resources, processors, storage devices and others. The different resources perform various functions in processing the I/O requests.

As storage systems continue to expand in size and operating speeds, it is desirable to efficiently monitor resource usage within the storage system and analyze QOS data so that any incidents based on not meeting QOS target goals can be identified and handled appropriately. Continuous efforts are being made to efficiently monitor and analyze QOS data.

DETAILED DESCRIPTION

As a preliminary note, the terms “component”, “module”, “system,” and the like as used herein are intended to refer to a computer-related entity, either software-executing general purpose processor, hardware, firmware and a combination thereof. For example, a component may be, but is not limited to being, a process running on a hardware processor, a hardware based processor, an object, an executable, a thread of execution, a program, and/or a computer.

Computer executable components can be stored, for example, at non-transitory, computer readable media including, but not limited to, an ASIC (application specific integrated circuit), CD (compact disc), DVD (digital video disk), ROM (read only memory), floppy disk, hard disk, EEPROM (electrically erasable programmable read only memory), memory stick or any other storage device, in accordance with the claimed subject matter.

In one aspect, a performance manager module is provided that interfaces with a storage operating system to collect quality of service (QOS) data. QOS provides a certain throughput (i.e. data transfer within a given time interval), latency and/or a number of input/output operations that can be processed within a time interval, for example, in a second (referred to as IOPS). Latency means a delay in completing the processing of an I/O request and may be measured using different metrics for example, an response time in processing I/O requests.

The storage system uses various resources to process I/O requests for writing and reading data to and from storage devices. The storage system maintains various counters and data measurement objects (QOS data) for providing QOS to clients. The QOS data may include throughput data, a number of LOPS in a measurement period, and an average response time within the measurement period, a service time per visit to a resource, a wait time per visit to the resource and a number of visits at the resource used for processing I/O requests.

The performance manager uses historical QOS data obtained from the storage system to predict an expected range (or threshold value) for future QOS data. Future actual QOS data is compared with the expected range to detect abnormal behavior. The abnormal behavior may be declared as an incident.

The incident is analyzed by the performance manager to identify a victim storage volume (or logical unit number (LUN) (described below), a resource that may be in usage contention among different storage volumes and a bully that may be overusing the resource in contention. A remediation plan maybe proposed to a client based on the incident analysis performed by the performance manager.

System100:FIG. 1shows an example of a system100, where the adaptive aspects disclosed herein may be implemented. System100includes a performance manager121that interfaces with a storage operating system107of a storage system108for receiving QOS data. The performance manager121obtains the QOS data and stores it at a local data structure125. In one aspect, performance manager121analyzes the QOS data for detecting incidents and identifying resources and storage volumes affected by an incident. Details regarding the various operations performed by the performance manager121are provided below.

In one aspect, storage system108has access to a set of mass storage devices114A-114N (may be referred to as storage devices114or simply as storage device114) within at least one storage subsystem112. The storage devices114may include writable storage device media such as magnetic disks, video tape, optical, DVD, magnetic tape, non-volatile memory devices for example, solid state drives (SSDs) including self-encrypting drives, flash memory devices and any other similar media adapted to store information. The storage devices114may be organized as one or more groups of Redundant Array of Independent (or Inexpensive) Disks (RAID). The aspects disclosed are not limited to any particular storage device type or storage device configuration.

In one aspect, the storage system108provides a set of logical storage volumes (may be interchangeably referred to as volume or storage volume) for providing physical storage space to clients116A-116N (or virtual machines (VMs)105A-105N). A storage volume is a logical storage object and typically includes a file system in a NAS environment or a logical unit number (LUN) in a SAN environment. The aspects described herein are not limited to any specific format in which physical storage is presented as logical storage (volume, LUNs and others)

Each storage volume may be configured to store data files (or data containers or data objects), scripts, word processing documents, executable programs, and any other type of structured or unstructured data. From the perspective of one of the client systems, each storage volume can appear to be a single drive. However, each storage volume can represent storage space in at one storage device, an aggregate of some or all of the storage space in multiple storage devices, a RAID group, or any other suitable set of storage space.

A storage volume is identified by a unique identifier (Volume-ID) and is allocated certain storage space during a configuration process. When the storage volume is created, a QOS policy may be associated with the storage volume such that requests associated with the storage volume can be managed appropriately. The QOS policy may be a part of a QOS policy group (referred to as “Policy_Group”) that is used to manage QOS for several different storage volumes as a single unit. The QOS policy information may be stored at a QOS data structure111maintained by a QOS module109. QOS at the storage system level may be implemented by the QOS module109. QOS module109maintains various QOS data types that are monitored and analyzed by the performance manager121, as described below in detail.

The storage operating system107organizes physical storage space at storage devices114as one or more “aggregate”, where each aggregate is a logical grouping of physical storage identified by a unique identifier and a location. The aggregate includes a certain amount of storage space that can be expanded. Within each aggregate, one or more storage volumes are created whose size can be varied. A qtree, sub-volume unit may also be created within the storage volumes. For QOS management, each aggregate and the storage devices within the aggregates are considered as resources that are used by storage volumes.

The storage system108may be used to store and manage information at storage devices114based on an I/O request. The request may be based on file-based access protocols, for example, the Common Internet File System (CIFS) protocol or Network File System (NFS) protocol, over the Transmission Control Protocol/Internet Protocol (TCP/IP). Alternatively, the request may use block-based access protocols, for example, the Small Computer Systems Interface (SCSI) protocol encapsulated over TCP (iSCSI) and SCSI encapsulated over Fibre Channel (FCP).

In a typical mode of operation, a client (or a VM) transmits one or more I/O request, such as a CFS or NFS read or write request, over a connection system110to the storage system108. Storage operating system107receives the request, issues one or more I/O commands to storage devices114to read or write the data on behalf of the client system, and issues a CIFS or NFS response containing the requested data over the network110to the respective client system.

System100may also include a virtual machine environment where a physical resource is time-shared among a plurality of independently operating processor executable VMs. Each VM may function as a self-contained platform, running its own operating system (OS) and computer executable, application software. The computer executable instructions running in a VM may be collectively referred to herein as “guest software.” In addition, resources available within the VM may be referred to herein as “guest resources.”

The guest software expects to operate as if it were running on a dedicated computer rather than in a VM. That is, the guest software expects to control various events and have access to hardware resources on a physical computing system (may also be referred to as a host platform or host system) which maybe referred to herein as “host hardware resources”. The host hardware resource may include one or more processors, resources resident on the processors (e.g., control registers, caches and others), memory (instructions residing in memory, e.g., descriptor tables), and other resources (e.g., input/output devices, host attached storage, network attached storage or other like storage) that reside in a physical machine or are coupled to the host system.

In one aspect, system100may include a plurality of computing systems102A-102N (may also be referred to individually as host platform/system102or simply as server102) communicably coupled to the storage system108executing via the connection system110such as a local area network (LAN), wide area network (WAN), the Internet or any other interconnect type. As described herein, the term “communicably coupled” may refer to a direct connection, a network connection, a wireless connection or other connections to enable communication between devices.

Host system102includes a processor executable virtual machine environment having a plurality of VMs105A-105N that may be presented to client computing devices/systems116A-116N. VMs105A-105N execute a plurality of guest OS104A-104N (may also be referred to as guest OS104) that share hardware resources120. As described above, hardware resources120may include processors, memory, I/O devices, storage or any other hardware resource.

In one aspect, host system102interfaces with a virtual machine monitor (VMM)106, for example, a processor executed Hyper-V layer provided by Microsoft Corporation of Redmond, Wash., a hypervisor layer provided by VMWare Inc., or any other type. VMM106presents and manages the plurality of guest OS104A-104N executed by the host system102. The VMM106may include or interface with a virtualization layer (VIL)123that provides one or more virtualized hardware resource to each OS104A-104N.

In one aspect, VMM106is executed by host system102with VMs105A-105N. In another aspect, VMM106may be executed by an independent stand-alone computing system, often referred to as a hypervisor server or VMM server and VMs105A-105N are presented at one or more computing systems.

It is noteworthy that different vendors provide different virtualization environments, for example, VMware Corporation, Microsoft Corporation and others. The generic virtualization environment described above with respect toFIG. 1may be customized to implement the aspects of the present disclosure. Furthermore, VMM106(or VIL123) may execute other modules, for example, a storage driver, network interface and others, the details of which are not germane to the aspects described herein and hence have not been described in detail.

System100may also include a management console118that executes a processor executable management application117for managing and configuring various elements of system100. Application117may be used to manage and configure VMs and clients as well as configure resources that are used by VMs/clients, according to one aspect. It is noteworthy that although a single management console118is shown inFIG. 1, system100may include other management consoles performing certain functions, for example, managing storage systems, managing network connections and other functions described below.

In one aspect, application117may be used to present storage space that is managed by storage system108to clients'116A-116N (or VMs). The clients may be grouped into different service levels, where a client with a higher service level may be provided with more storage space than a client with a lower service level. A client at a higher level may also be provided with a certain QOS vis-à-vis a client at a lower level.

Although storage system108is shown as a stand-alone system, i.e. a non-cluster based system, in another aspect, storage system108may have a distributed architecture; for example, a cluster based system ofFIG. 2A. Before describing the various aspects of the performance manager121, the following provides a description of a cluster based storage system.

Clustered Storage System:FIG. 2Ashows a cluster based storage environment200having a plurality of nodes for managing storage devices, according to one aspect. Storage environment200may include a plurality of client systems204.1-204.N (similar to clients116A-116N,FIG. 1), a clustered storage system202, performance manager121, management console118and at least a network206communicably connecting the client systems204.1-204.N and the clustered storage system202.

The clustered storage system202includes a plurality of nodes208.1-208.3, a cluster switching fabric210, and a plurality of mass storage devices212.1-212.3(may be referred to as212and similar to storage device114).

Each of the plurality of nodes208.1-208.3is configured to include an N-module, a D-module, and an M-Module, each of which can be implemented as a processor executable module. Specifically, node208.1includes an N-module214.1, a D-module216.1, and an M-Module218.1, node208.2includes an N-module214.2, a D-module216.2, and an M-Module218.2, and node208.3includes an N-module214.3, a D-module216.3, and an M-Module218.3.

The N-modules214.1-214.3include functionality that enable the respective nodes208.1-208.3to connect to one or more of the client systems204.1-204.N over the computer network206, while the D-modules216.1-216.3connect to one or more of the storage devices212.1-212.3. Accordingly, each of the plurality of nodes208.1-208.3in the clustered storage server arrangement provides the functionality of a storage server.

Each node may execute or interface with a QOS module, shown as109.1-109.3that is similar to the QOS module109. The QOS module109may be executed for each node or a single QOS module may be used for the entire cluster. The aspects disclosed herein are not limited to the number of instances of QOS module109that may be used in a cluster. Details regarding QOS module109are provided below.

A switched virtualization layer including a plurality of virtual interfaces (VIFs)201is provided to interface between the respective N-modules214.1-214.3and the client systems204.1-204.N, allowing storage212.1-212.3associated with the nodes208.1-208.3to be presented to the client systems204.1-204.N as a single shared storage pool.

The clustered storage system202can be organized into any suitable number of virtual servers (also referred to as “vservers” or storage virtual machines), in which each vserver represents a single storage system namespace with separate network access. Each vserver has a client domain and a security domain that are separate from the client and security domains of other vservers. Moreover, each vserver is associated with one or more VIFs and can span one or more physical nodes, each of which can hold one or more VIFs and storage associated with one or more vservers. Client systems can access the data on a vserver from any node of the clustered system, through the VIFs associated with that vserver. It is noteworthy that the aspects described herein are not limited to the use of vservers.

Each of the nodes208.1-208.3is defined as a computing system to provide application services to one or more of the client systems204.1-204.N. The nodes208.1-208.3are interconnected by the switching fabric210, which, for example, may be embodied as a Gigabit Ethernet switch or any other type of switching/connecting device.

AlthoughFIG. 2Adepicts an equal number (i.e.,3) of the N-modules214.1-214.3, the D-modules216.1-216.3, and the M-Modules218.1-218.3, any other suitable number of N-modules, D-modules, and M-Modules may be provided. There may also be different numbers of N-modules, D-modules, and/or M-Modules within the clustered storage system202. For example, in alternative aspects, the clustered storage system202may include a plurality of N-modules and a plurality of D-modules interconnected in a configuration that does not reflect a one-to-one correspondence between the N-modules and D-modules.

Each client system204.1-204.N may request the services of one of the respective nodes208.1,208.2,208.3, and that node may return the results of the services requested by the client system by exchanging packets over the computer network206, which may be wire-based, optical fiber, wireless, or any other suitable combination thereof.

Performance manager121interfaces with the various nodes and obtains QOS data for QOS data structure125. Details regarding the various modules of performance manager are now described with respect toFIG. 2B.

Performance Manager121:FIG. 2Bshows a block diagram of system200A with details regarding performance manager121and a collection module211, according to one aspect. Performance manager121uses the concept of workloads for tracking QOS data for incident detection and analysis. At a high level, workloads are defined based on incoming I/O requests and use resources within storage system202for processing I/O requests. A workload may include a plurality of streams, where each stream includes one or more requests issued by clients. A stream may include requests from one or more clients. An example, of the workload model used by performance manager121is shown inFIG. 2Fand described below in detail.

Performance manager121collects a certain minimal amount of data (for example, QOS data for 3 hours or 30 data samples) of workload activity. After collecting the minimal QOS data, performance manager121generates an expected range (or threshold values) for future QOS data.

The expected range is a range of measured performance activity (or QOS data) of a workload over a period of time. For example, a given twenty-four hour period may be split into multiple time intervals. The expected range may be generated for each time interval. The expected range sets a baseline for what may be perceived to be typical activity for the workload. The upper boundary of the expected range establishes a dynamic performance threshold that changes over time. For example, during 9.00 AM and 5.00 PM most employees of a business check their email between 9.00 AM-10.30 AM. The increased demand on email servers means an increase in the workload activity at the storage managed by the storage operating system. The demand on the storage may decrease during lunch time. The performance manager121tracks this activity to determine the expected range or expected QOS data behavior for future activity.

Performance manager121uses the expected range to represent and monitor I/O response time and operations for a storage volume in a cluster. The performance manager121tracks QOS data and in some cases identifies abnormal activity as incidents. An incident indicates that workload performance is outside a desirable level due to resource contention from other workloads i.e. workloads with higher usage of cluster resources may be causing the response time to increase. Incidents are considered as events that indicate I/O performance issues at a storage volume caused by resource contention.

Performance manager121compares historical QOS data with current QOS data to identify a victim workload whose performance may have decreased. Victim workloads may be identified based on response time deviation from an expected response time, as described below. After identifying the victim, the performance manager121identifies the resource that may be in contention as well as the workloads (or volumes) that may be overusing the resources (i.e. bully workloads). Workloads are ranked to determine which bullies have the highest change in usage of the resource and which victims are most impacted. Based on the identification of victim and bully workloads, a remediation plan may be recommended to correct the problems associated with the incident.

Referring now toFIG. 2B, System200A shows two clusters202A and202B, both similar to cluster202described above. Each cluster includes the QOS module109for implementing QOS policies that are established for different clients/applications.

Cluster1202A may be accessible to clients204.1and204.2, while cluster2202B is accessible to clients204.3/204.4. Both clusters have access to storage subsystems207and storage devices212.1/212.N.

Clusters202A and202B communicate with a collection module211. The collection module211may be a standalone computing device or integrated with performance manager121. The aspects described herein are not limited to any particular configuration of collection module211and performance manager121.

Collection module211includes one or more acquisition modules219for collecting QOS data from the clusters. The data is pre-processed by the pre-processing module215and stored as pre-processed QOS data217at a storage device (not shown). Pre-processing module215formats the collected QOS data for the performance manager121. Pre-processed QOS data217is provided to a collection module interface231of the performance manager121. QOS data received from collection module211is stored as QOS data structure125by performance manager121at a storage device (not shown).

Performance manager121includes a plurality of modules, for example, a forecasting module223, a detection module225and an incident analysis module227that use the QOS data125for detecting incidents and reporting the incidents to a client system205via a GUI229. Performance manager121also recommends a corrective action plan to client205. Client205may access the analysis results and recommendations using GUI229. Before describing the various processes involving performance manager121and its components, the following describes using the performance manager121in a cloud based computing environment.

Cloud Computing Environment:FIG. 2Cshows one or more storage system (or controllers)224A/224B analogous to storage system108/202in a cloud computing environment240, according to one or more aspects. In one or more aspects, cloud computing environment240may be a computing environment configured to enable network access (e.g., on-demand) to a shared pool of configurable computing resources (e.g., networks, storage, host servers, applications, services). In one or more aspects, a storage system may be a hardware resource configured to host one or more vservers in cloud computing environment240.

Storage system224A and storage system224B may be deployed by a cloud manager220and/or a cloud administrator configured to provision the host systems, storage associated with one or more client devices (e.g., client1232, client2234) and/or services requested by the one or more client devices. As an example, storage system224A may be configured to be associated with vserver1226A and vserver3226C. Storage system224B may be configured to be associated with vserver2226B, vserver4226D and vserver5226E.

In one or more aspects, cloud manager220may enable one or more client devices to self-provision computing resources thereof. As an example, cloud manager220may manage cloud portion(s) (e.g., cloud1252, cloud2254) associated with client1232and client2234. Client1232and/or client2234may log into a console associated with cloud manager220to access cloud1252and/or cloud2254(and the VMs228A-228E therein) through a public network230(e.g., Internet). The client devices and/or VMs associated therewith provided in cloud computing environment240may be analogous to the clients ofFIGS. 1/2A.

In order to address storage requirements/requests associated with client1232and client2234, cloud manager220may be configured to appropriately provision vserver1226A, vserver2226B, vserver3226C, vserver4226D and vserver5226E and allocate to client1232and client2234. The aforementioned vservers may be virtualized entities utilized by client1232and client2234to meet storage requirements thereof. Multi-tenancy may allow for a storage system to have multiple vservers associated therewith. A portion of the cloud (e.g., cloud1252) including vserver1226A, vserver2226B and VMs (e.g. VM228A, VM228B) associated therewith may be associated with client1232and a portion of the cloud (e.g., cloud2254) including vserver3226C, vserver4226D and vserver5226E and VMs (e.g., VM228C, VM228D, VM228E) associated therewith may be associated with client2234. In one or more aspects, VMs may reside on storage exposed by vserver(s).

The aforementioned cloud portions may be logical subsets of the cloud and may include VMs implemented with operating systems (e.g., Linux, Microsoft®'s Windows®). “Cloud” as used herein may refer to the large pool of configurable computing resources (e.g., virtualized computing resources) that may be subjected to a pay-per-use model, in which client(s) may enter into service agreement(s) with service provider(s). The portion of the “cloud,” therefore, may refer to the pool of resources associated with a particular client. It is noteworthy that client1232and/or client2234may be entities (e.g., corporations, departments and others), and that there may be a number of computing devices associated with each of client1232and/or client2234.

Cloud1252and/or cloud2254may span across several geographic regions. In one or more aspects, the aforementioned cloud portions may span multiple countries under differing jurisdictional guidelines. For example, a jurisdictional guideline may deem that a vserver needs to be launched on hardware (e.g., storage system) located in the same jurisdiction as the corresponding client(s).

In one or more aspects, administrators of cloud computing environment240may possess the authority to launch one or more vservers on any of storage system224A and storage system224B, irrespective of the location(s) thereof. Further, in one or more aspects, the aforementioned one or more vservers may be associated with one or more versions of storage operating system107. For example, an administrator may modify the version of the storage operating system and/or configuration settings on storage system224A and/or storage system224B.

In one aspect, cloud computing environment240includes the performance manager121and the collection module211that have been described above. The various processes executed by the performance manager121and the collection module211are described below.

Before describing the various processes executed by the performance manager121, the following describes how QOS requests are handled at the cluster level with respect toFIG. 2D. The N-Module214of a cluster includes a network interface214A for receiving requests from clients. N-Module214executes a NFS module214C for handling NFS requests, a CIFS module214D for handling CIFS requests, a SCSI module for handling iSCSI requests and an others module214F for handling “other” requests. A node interface214G is used to communicate with QOS module109, D-Module216and/or another N-Module214. QOS management interface214B is used to provide QOS data from the cluster to collection module211for pre-processing, as described below.

QOS module109includes a QOS controller109A, a QOS request classifier109B and QOS policy data structure (or Policy_Group)111. The QOS policy data structure111stores policy level details for implementing QOS for clients and storage volumes. The policy determines what latency and throughput rate is permitted for a client as well as for specific storage volumes. The policy determines how I/O requests are processed for different volumes and clients.

The D-Module216executes a file system216A (a part of storage operating system107described below) and includes a storage layer216B to interface with storage device212. NVRAM216C of the D-Module216may be used as cache for responding to I/O requests.

A request arrives at N-Module214from a client or from an internal process directly to file system216A. Internal process in this context may include a de-duplication module, a replication engine module or any other entity that needs to perform a read and/or write operation at the storage device212. The request is sent to the QOS request classifier109B to associate the request with a particular workload. The classifier109B evaluates a request's attributes and looks for matches within QOS policy data structure111. The request is assigned to a particular workload, when there is a match. If there is no match, then a default workload may be assigned.

Once the request is classified for a workload, then the request processing can be controlled. QOS controller109A determines if a rate limit (i.e. a throughput rate) for the request has been reached. If yes, then the request is queued for later processing. If not, then the request is sent to file system216A for further processing with a completion deadline. The completion deadline is tagged with a message for the request.

File system216A determines how queued requests should be processed based on completion deadlines. The last stage of QOS control for processing the request occurs at the physical storage device level. This could be based on latency with respect to storage device212or for NVRAM216C that may be used for any logged operation.

Performance Model:FIG. 2Eshows an example of a queuing network used by the performance manager121for detecting incidents and performing incident analysis, according to one aspect. A user workload enters the queuing network from one end (i.e. at233) and leaves at the other end.

Various resources are used to process I/O requests. As an example, there are may be two types of resources, a service center and a delay center resource. The service center is a resource category that can be represented by a queue with a wait time and a service time (for example, a processor that processes a request out of a queue). The delay center may be a logical representation for a control point where a request stalls waiting for a certain event to occur and hence the delay center represents the delay in request processing. The delay center may be represented by a queue that does not include service time and instead only represents wait time. The distinction between the two resource types is that for a service center, the QOS data includes a number of visits, wait time per visit and service time per visit for incident detection and analysis. For the delay center, only the number of visits and the wait time per visit at the delay center are used, as described below in detail.

Performance manager121uses different flow types for incident detection and analysis. A flow type is a logical view for modeling request processing from a particular viewpoint. The flow types include two categories, latency and utilization. A latency flow type is used for analyzing how long operations take at the service and delay centers. The latency flow type is used to identify a victim workload whose latency has increased beyond a certain level. A typical latency flow may involve writing data to a storage device based on a client request and there is latency involved in writing the data at the storage device. The utilization flow type is used to understand resource consumption of workloads and may be used to identify resource contention and a bully workload as described below in detail.

Referring now toFIG. 2E, delay center network235is a resource queue that is used to track wait time due to external networks. Storage operating system107often makes calls to external entities to wait on something before a request can proceed. Delay center235tracks this wait time.

N-Module CPU237is another resource queue where I/O requests wait for protocol processing by an N-Module processor. A separate queue for each node may be maintained.

A storage aggregate (or aggregate)239is a resource that may include more than one storage device for reading and writing information. Disk-I/O241queue may be used to track utilization of storage devices212. A D-Module CPU245represents a processor that is used to read and write data. The D-Module CPU245is a service center and a queue is used to track the wait time for any writes to storage devices by a D-Module processor.

Nodes within a cluster communicate with each other. These may cause delays in processing I/O requests. The cluster interconnect delay center247is used to track the wait time for transfers using the cluster interconnect system. As an example, a single queue maybe used to track delays due to cluster interconnects.

There may also be delay centers due to certain internal processes of storage operating system107and various queues may be used to track those delays. For example, a queue may be used to track the wait for I/O requests that may be blocked for file system reasons. Another queue (Delay_Center_Susp_CP) may be used to represent the wait time for Consistency Point (CP) related to the file system216A. During a CP, write requests are written in bulk at storage devices and this will typically cause other write requests to be blocked so that certain buffers are cleared.

Without limiting the various aspects of the present disclosure, Table I below provides an example of the various service and delay centers that may be used by performance manager121to track workload performance using different resources. Some of these resources are shown inFIG. 2E. Table I also identifies the resource type (i.e. utilization and/or latency type).

TABLE IResource NameResource DescriptionTypeCPU_N_Module (234, FIG. 2E)This resource identifies a queue where I/OUtilization,requests wait for file protocol processingLatencyat an N-Module 214. As an example, theremay be one queue for each node.CPU_D_Module (245, FIG. 2E)This resource identifies a queue where I/OUtilization,requests wait for scheduling for beinglatencywritten to a storage device by the D-Module 216. As an example, there may beone queue for each node.DISK_HDD_<Aggr_name> (241, FIG.This resource represents non-solid stateUtilization2E)physical storage devices in an aggregate,for example, hard drives, tapes andothers. This provides an average viewacross all storage devices within anaggregate. As an example, there may beone queue for each aggregate to track thisresource.DISK_SSD_<aggr_name> (Similar toThis resource is similar to 241, andUtilization241, FIG. 2E)represents physical solid state storagedevices (SSDs) in an aggregate. Thisprovides an average view across allstorage devices within the aggregate. Asan example, there may be one queue foreach aggregate to track this resource.DELAY_CENTER_WAFL_SUSP_DISKIOThis is a queue to represent the wait timeLatencyfor blocked disk I/O related file systemsuspensions.DELAY_CENTER__WAFL_SUSP_CPThis is a queue to represent wait time forLatencyConsistency Point (CP) related suspensionsby the file system. A CP will cause writerequests to a block so that buffers can becleared.DELAY_CENTER_NETWORK (235, FIG.This is a queue that represents anLatency2E)external network wait time. At times,storage operating system 107 calls out anexternal entry to wait on somethingoutside of the storage operating system tocomplete before the request can continueand this queue is used to track that waittime. There may be one delay center foran entire cluster.DELAY_CENTER_CLUSTER_INTERCONNECTThis queue is used to represents the waitLatency(247, FIG. 2E)time for transfers over a clusterinterconnect. As an example, there may beone queue per cluster.

Workload Model:FIG. 2Fshows an example, of the workload model used by performance manager121, according to one aspect. As an example, a workload may include a plurality of streams251A-251N. Each stream may have a plurality of requests253A-253N. The requests may be generated by any entity, for example, an external entity255, like a client system and/or an internal entity257, for example, a replication engine that replicates storage volumes at one or more storage location.

A request may have a plurality of attributes, for example, a source, a path, a destination and I/O properties. The source identifies the source from where a request originates, for example, an internal process, a host or client address, a user application and others.

The path defines the entry path into the storage system. For example, a path may be a logical interface (LIF) or a protocol, such as NFS, CIFS, iSCSI and Fibre Channel protocol.

A destination is the target of a request, for example, storage volumes, LUNs, data containers and others.

I/O properties include operation type (i.e. read/write/other), request size and any other property.

In one aspect, streams may be grouped together based on client needs. For example, if a group of clients make up a department on two different subnets, then two different streams with the “source” restrictions can be defined and grouped within the same workload. Furthermore, requests that fall into a workload are tracked together by performance121for efficiency. Any requests that don't match a user or system defined workload may be assigned to a default workload.

In one aspect, workload streams may be defined based on the I/O attributes. The attributes may be defined by clients. Based on the stream definition, performance manager121tracks workloads, as described below.

Referring back toFIG. 2F, a workload uses one or more resources for processing I/O requests shown as271A-271N as part of a resource object259. The resources include service centers and delay centers that have been described above with respect toFIG. 2Eand Table I. For each resource, a queue is maintained for tracking different statistics (or QOS data)261. For example, a response time263, and a number of visits265, a service time (for service centers)267and a wait time269are tracked. The term QOS data as used throughout this specification includes one or more of263,265,267and269according to one aspect.

Without limiting the various aspects of the present disclosure, Table II below provides an example of a non-exhaustive listing of the various objects that are used by the performance manager121for incident detection and analysis, where each object may have multiple instances:

TABLE IIObjectInstancePurposeDescriptionWorkload<workload_name>Represents an external workloadThroughput, Averageapplied to a volume. The objectresponse timemay be used to measure workloadperformance against servicelevels.Resource<resource_name>Provide hierarchical utilizationUtilizationof resources and may be aservice or delay center.Resource_detail<resource_name>.Breakdowns resource usage byUtilization<workload_name>workload from a resourceperspective.Workload_detail<workload_name>.Breakdowns workload responseNumber of visits,<service_center_name>time by resource.service time pervisit and wait timeper visit

Performance manager121also uses a plurality of counter objects for incident detection and analysis. Without limiting the adaptive aspects, an example of the various counter objects are shown and described in Table III below:

TABLE IIIWorkload Object CountersDescriptionOpsA number of workload's operations that are completed during ameasurement interval, for example, a second.Read_opsA number of workload read operations that are completed duringthe measurement interval.Write_opsA number of workload write operations that are completedduring the measurement interval.Total_dataTotal data read and written per second by a workload.Read_dataThe data read per second by a workload.Write_dataThe data written per second by a workload.LatencyThe average response time for I/O requests that were initiatedby a workload.Read_latencyThe average response time for read requests that wereinitiated by a workload.Write_latencyThe average response time for write requests that wereinitiated by a workload.Latency_histA histogram of response times for requests that were initiatedby a workload.Read_latency_histA histogram of response times for read requests that wereinitiated by a workload.Write_latency_histA histogram of response times for write requests that wereinitiated by a workload.WidA workload ID.ClassifiedRequests that were classified as part of a workload.Read_IO_typeThe percentage of reads served from various components (forexample, buffer cache, ext_cache or disk).ConcurrencyAverage number of concurrent requests for a workload.Interarrival_time_sum_squaresSum of the squares of the Inter-arrival time for requests of aworkload.Policy_group_nameThe name of a policy-group of a workload.Policy_group_uuidThe UUID (unique indetifier) of the policy-group of aworkload.Data_object_typeThe data object type on which a workload is defined, forexample, one of vserver, volume, LUN, file or node.Data_object_nameThe name of the lowest-level data object, which is part of aninstance name as discussed above. When data_object_type is afile, this will be the name of the file relative to itsvolume.Data_object_uuidThe UUID of a vserver, volume or LUN on which this data objectis defined.Data_object_file_handleThe file handle of the file on which this data object isdefined; or empty if data_object_type is not a file.

Without limiting the various aspects of the present disclosure, Table IV below provides an example of the details associated with the object counters that are monitored by the performance manager121for detecting incidents, according to one aspect:

TABLE IVWorkloadDetailObject CounterDescriptionVisitsA number of visits to a physical resource per second; thisvalue is grouped by a service center.Service_TimeA workload's average service time per visit to the servicecenter.Wait_TimeA workload's average wait time per visit to the servicecenter.

When a workload is responding slowly, a user may want to analyze the workload to determine the root cause of any issues and then perform corrective action to solve the issues. Performance manager121using QOS data collected from the different clusters and using the workload performance model detects such issues as incidents and then provides remedial actions.

Performance manager121uses collected QOS data to predict dynamic threshold values for workloads. Using the dynamic threshold values and statically defined threshold values, detection module225detects one or more incidents. The incident analysis module227then determines which resource may be in contention for a victim workload and identifies any bully workloads that may have caused the incident.

The detection and analysis may be a part of a multi-phase process, for example, Phase 0-Phase 3. Phase 0 shown inFIG. 3Ais used to collect base-line data to provide an expected range for QOS data behavior. Phase 1 shown inFIG. 4is used to detect a victim workload, while Phase 2 shown inFIG. 5is used to detect the resource that is in contention. Phase 3 shown inFIG. 6Ais used to detect the bully workload.

The various phases are based on QOS data that is collected periodically by performance manager121. In one aspect, an average response time for a workload, number of visits to a service center, response time at a service or delay center per operation, average service time at a service or a delay center and average wait time at a service center or a delay center per operation (individually or jointly referred to as QOS data) or a number of operations performed by a workload are used to detect and analyze an incident.

Process Flow (Phase 0):FIG. 3Ashows a process300for Phase 0 to establish a baseline and an expected range for QOS data for different workloads, according to one aspect. The process begins in block B302when performance manager121, collection module211and the various storage clusters are all operational.

In block5304, performance module121obtains QOS data from collection module211. The QOS data regarding one or more clusters is initially collected by the QOS module109based on the configuration of the service centers and delay centers that are involved in processing I/O requests for each workload. The QOS data includes response time, service time per visit, wait time per visit, the number of visits within a duration (for example, a second) and a number of operations performed by a workload. These terms have been described above in detail. The QOS data is pre-processed by the collection module211and then provided to performance module121.

In block5306, the forecasting module223determines if the amount of collected QOS data meets a minimal quantity for predicting an expected range. For example, the forecasting module223may be configured to use at least three days of data for executing a forecasting operation to provide the expected range. If the amount of data does not meet the minimum requirement, then in block B308, the forecasting module223takes a mean of the collected QOS data that may be available and the standard deviation to provide an expected range. The process then moves to block B318.

If the minimum amount of QOS data is available, then in block B310, the QOS data for one or more workload is retrieved by the forecasting module223. The QOS data may be stored at a storage location that is accessible directly or indirectly by forecasting module223.

In block B312, forecasting module223determines coefficients for predicting an expected range. In one aspect, a linear prediction mathematical model may be used to provide the expected range using coefficients for the collected QOS data125. An example of the linear prediction mathematical model is provided below:

Minimize mean square error

Take derivative wrt dj:

In the above description, angle brackets indicate statistical averages. The gamma function stands for autocorrelation. A certain amount of QOS data (for example, 15 days' of data) may be used to calibrate the linear prediction model. The data is used to solve for the coefficients (d) in the above equations. The coefficients are used to predict the future expected range for future QOS data values, for example, for the next 24 hours.

Along with the prediction as described below in detail, the process provides threshold values for normal behavior. To compute the threshold band, coefficients are applied to data for certain number of days, for example, 15 days of collected data. The process computes the absolute value of the difference between predicted and actual values. The coefficients may be applied one day at a time. The threshold values at a given point are produced from a weighted average of the difference values taken at points with the same phase as the given point with respect to the 24 hour period. So, for example, if the given point is at 1:00 AM, then the absolute value of the differences at 1:00 AM for 14 days is averaged. For a 15 day cycle, the first day is excluded since it is used to predict the second day, but has no matching prediction data. A weighting scheme may be used to give more importance to recent data points. For example, the weighting scheme may be as follows:

9/(N*N))*(i*i)+1 to the ith element in the sum, where N is the length of the period (N=288 points for 24 hours' worth of 5 minute intervals). Hence the weight goes approximately from 1 to 10 as the data index goes from zero to N−1.

It is noteworthy that the linear prediction mathematical model described above is one technique to predict future behavior. Other mathematical techniques, for example, Kalman filter (linear quadratic estimation), may be used to provide the expected range and the threshold values.

In block3314, the performance manager121uses the coefficient and historical QOS data to predict the expected range for future QOS data for each workload. The expected range provided a dynamic threshold band (also referred to as the guard band) that can be used to detect abnormal QOS data. The threshold values can be adjusted as more data becomes available over a period of time. The historical QOS data is stored at a storage device in block B316and the process moves to block B318that is described below with respect toFIG. 4.

FIG. 3Bprovides a graphical illustration322of an expected range for response time for a workload. InFIG. 3B, the response time measured in milliseconds per I/O operation is provided on the Y axis, while the time is provided in the X-axis. Actual response time is shown as326while the gray region324provides the expected range based on historically collected QOS data. The expected range324ofFIG. 3Bis used as a tool by detection module225for detecting abnormalities, as described below in detail.

Process Flow (Phase 1):FIG. 4shows process400for Phase 1 for detecting a victim workload (or storage volume), according to one aspect. A workload is considered to be a victim if it crosses a set of predefined static thresholds and its response time to process a request reaches a dynamic threshold value. The static threshold may be programmed for each storage volume using a management application. The dynamic threshold is based on the guard bands that have been described above with respect toFIGS. 3A and 3B. In one aspect, thresholds for a particular time may be generated on a daily basis to determine if a workload is a victim.

Process400begins in block B402every time a new set of QOS data is collected and when the performance manager121has collected a minimal amount of QOS data for providing an expected range in Phase 0, as described above.

In block B404, the detection module225retrieves QOS data for a current time for a workload. The data may be obtained from the storage operating system107in real time.

In block B406, the current QOS data is compared with the dynamic threshold values that are determined for the current time based on historical QOS data. This allows the detection module225to determine if the current QOS data for the workload is acceptable when compared with historical expected behavior depicted by the expected range.

In block B408, one or more workload is identified as a victim, when both the dynamic threshold and the static threshold values are reached (i.e. violated). In another aspect, a workload may be declared as a victim when either the dynamic or the static threshold value is reached. Based on the threshold violations, a list of victim workloads is compiled in block B410for further analysis when one or more resources that are associated with the victim workloads are analyzed. This is described below with respect to process500ofFIG. 5.

Process Flow (Phase 2): Process500begins in block B502after Phase 1 has identified one or more victim workloads. Process500is for analyzing utilization of the various resources that are used by the victim workload. An example of the various resources is provided inFIG. 2Eand Table I described above. This allows incident analysis module227to identify resource contention between different workloads and then execute Phase 3 for identifying the bully workloads that may be significantly overusing resources.

Process500begins in block B502, after at least one victim workload (or storage volume) has been identified. In block B504, incident analysis module227retrieves the QOS data associated with the resources used by each victim identified by process400. The resources may include delay center network235, N-Module CPU237, Disk center I/O, D-module CPU245, Cluster Interconnect Delay Center247and any other cluster resource. The various aspects described herein are not limited to any particular resource or any data type associated with any particular resource.

In block B506, the dynamic threshold values (or the expected range) for the QOS data associated with each resource are determined based on collected historical QOS data.

In block B508, incident analysis module227computes the deviation of a current response time of each affected resource from the dynamic threshold values. The highest deviation is used to quantify the impact of each resource in block B510. The resources are ranked based on the deviation i.e. the impact of each resource. In block3512, the highest ranking resource is identified as the one having the most impact on the victim workload. The identified resource is considered to be in contention. It is noteworthy that more than one resource may be in contention. After the resource is identified, the process moves to block B514, to Phase 3, when a bully workload is detected.

Table V below shows an example of different calculations that are performed during process500(i.e. in blocks B508, B510and B512) for determining the resources that may be in contention:

TABLE VPhaseNameDescriptionCalculation2Normalized workload response time at a resourceAs each resource has different usage based on the nature of visits and operation types; the workload response time at a resource is normalized to per operation so that it can be compared with other resources.(WTWT+STWT)*VWTOPSWWT is the workload wait time at a resource, ST is the workload service time as resource, V is the workload visit rate at the resource, OPS is the workload Operations (OPS)2% response time deviationThis value provides the deviation of a measured response time from an expected response time based on the expected range generated by the performance module 121.RTmeasured-RTexpectedRTbound-RTexpected*100RT is response time, and Rtbound is the upper bound when the measured RT >= expected2ResourceThis is a combination of% RT deviation * RTimpactdeviation and absolute valuewhere RT is the normalizedfor the response time toworkload response time at acapture the magnitude ofresourcedeviation such that a resourcewhere a workload that hashigher and more abnormalresponse time is more likely tobe the performance bottleneckfor a workload.

Process Flow (Phase 3): The process for detecting the bully workload is now described with respect toFIG. 6A. Process600is executed to find the workloads (storage volumes) that are causing resource contention. The workloads of all contending resources are examined, and the historical data for workloads are analyzed to determine if the behavior is abnormal. Based on the analysis, workloads are identified as a bully, insignificant or a secondary victim. A bully workload is one that has a high visit rate at the resource and/or a high service time at the resource and/or a higher utilization which is a product of visits per second and the service time per visit. An insignificant workload is one that does not meet a set of pre-defined static threshold values and does not perform a significant amount of work at the resource and hence can be ignored. A secondary victim is a workload that has an abnormally low visit rate and/or a high wait time at the resource. This is different from the Phase 1 victim that detects a workload that suffers from abnormally high overall response time.

Process600begins in block B602, when after Phase 2, one or more resources have been identified as being in contention. In block B604, QOS data for each workload associated with the resource in contention is obtained by the incident analysis module227. The QOS data includes, response time, number of visits by other workloads, service time (when applicable) and wait time. The historical QOS data for the resource is also obtained in block B606. The predictive behavior i.e. the expected range for each workload is generated by the incident analysis module227in block B608. As described above, the expected range provides the upper and lower threshold values for each QOS data value for the workload. Each QOS data type value is compared to the dynamic threshold value in block B610.

In block B612, a bully workload may be identified by the incident analysis module227. As mentioned above, this determination is made, when a workload has an abnormally high visit rate, high abnormal service time and/or high utilization with respect to an expected range. The secondary victim and insignificant workload may also be identified in block B612. Thereafter, in block B614, the incident analysis module227presents a remediation plan to the client. An example of the remediation plan is provided below. Thereafter, the process ends.

In one aspect, an incident may be caused by an external network entity, for example, an authentication server may not be responding in a timely manner to authenticate requests. This delays I/O processing. If an external factor is involved, then the phase 3 analysis described above may be skipped by the performance manager121.

Remediation Plan:FIG. 6Bshows an example of a remediation plan, according to one aspect. InFIG. 6B, the Delay_Center_network is the service center that may be a resource in contention. The service center is shown in column616. Column616mentions the number of visits for each workload, the service time is shown in Column620, while the response time is shown in Column622. The workload analysis is detailed in Column624. The recommendations for alleviating each situation are described in Column626and are self explanatory.

Similar remediation plans are shown inFIGS. 6C-6H. For example,FIG. 6Dshows example recommendations involving the CPU-NBlade.FIG. 6Einvolves the Policy_Group service center, whileFIG. 6Eshows recommendations for the Cluster_Interconnect.FIG. 6Fshows recommendations for the CPU_DBlade, whileFIG. 6Gshows recommendations for the Aggregate.FIG. 6Hshows recommendations for the Disk HDD. The various service centers inFIG. 6C-6Hhave been described above.

In one aspect, performance manager121provides efficient methods and systems for collecting QOS data, monitoring QOS data, dynamically predicting expected behavior of the QOS (i.e. the expected range) and using the historical data to identify incidents that a client may want to address. The performance121also analyzes each incident and provides useful recommendations to clients such that clients can reach their storage related goals and objectives.

Storage System Node:FIG. 7is a block diagram of a node208.1that is illustratively embodied as a storage system comprising of a plurality of processors702A and702B, a memory704, a network adapter710, a cluster access adapter712, a storage adapter716and local storage717interconnected by a system bus708. Node208.1may be used to provide QOS information to performance manager121described above.

Processors702A-702B may be, or may include, one or more programmable general-purpose or special-purpose microprocessors, digital signal processors (DSPs), programmable controllers, application specific integrated circuits (ASICs), programmable logic devices (PLDs), or the like, or a combination of such hardware devices. The local storage713comprises one or more storage devices utilized by the node to locally store configuration information for example, in a configuration data structure714. The configuration information may include information regarding storage volumes and the QOS associated with each storage volume.

The cluster access adapter712comprises a plurality of ports adapted to couple node208.1to other nodes of cluster202. In the illustrative aspect, Ethernet may be used as the clustering protocol and interconnect media, although it will be apparent to those skilled in the art that other types of protocols and interconnects may be utilized within the cluster architecture described herein. In alternate aspects where the N-modules and D-modules are implemented on separate storage systems or computers, the cluster access adapter712is utilized by the N/D-module for communicating with other N/D-modules in the cluster202.

Each node208.1is illustratively embodied as a dual processor storage system executing a storage operating system706(similar to107,FIG. 1) that preferably implements a high-level module, such as a file system, to logically organize the information as a hierarchical structure of named directories and files at storage212.1. However, it will be apparent to those of ordinary skill in the art that the node208.1may alternatively comprise a single or more than two processor systems. Illustratively, one processor702A executes the functions of the N-module on the node, while the other processor702B executes the functions of the D-module.

The memory704illustratively comprises storage locations that are addressable by the processors and adapters for storing programmable instructions and data structures. The processor and adapters may, in turn, comprise processing elements and/or logic circuitry configured to execute the programmable instructions and manipulate the data structures. It will be apparent to those skilled in the art that other processing and memory means, including various computer readable media, may be used for storing and executing program instructions pertaining to the disclosure described herein.

The storage operating system706portions of which is typically resident in memory and executed by the processing elements, functionally organizes the node208.1by, inter alia, invoking storage operation in support of the storage service implemented by the node.

The network adapter710comprises a plurality of ports adapted to couple the node208.1to one or more clients204.1/204.N over point-to-point links, wide area networks, virtual private networks implemented over a public network (Internet) or a shared local area network. The network adapter710thus may comprise the mechanical, electrical and signaling circuitry needed to connect the node to the network. Each client204.1/204.N may communicate with the node over network206(FIG. 2A) by exchanging discrete frames or packets of data according to pre-defined protocols, such as TCP/IP.

The storage adapter716cooperates with the storage operating system706executing on the node208.1to access information requested by the clients. The information may be stored on any type of attached array of writable storage device media such as video tape, optical, DVD, magnetic tape, bubble memory, electronic random access memory, micro-electro mechanical and any other similar media adapted to store information, including data and parity information. However, as illustratively described herein, the information is preferably stored at storage device212.1. The storage adapter716comprises a plurality of ports having input/output (I/O) interface circuitry that couples to the storage devices over an I/O interconnect arrangement, such as a conventional high-performance, Fibre Channel link topology.

Operating System:FIG. 8illustrates a generic example of storage operating system706(or107,FIG. 1) executed by node208.1, according to one aspect of the present disclosure. The storage operating system706interfaces with the QOS module109and the performance manager121such that proper bandwidth and QOS policies are implemented at the storage volume level.

In one example, storage operating system706may include several modules, or “layers” executed by one or both of N-Module214and0-Module216. These layers include a file system manager800that keeps track of a directory structure (hierarchy) of the data stored in storage devices and manages read/write operation, i.e. executes read/write operation on storage in response to client204.1/204.N requests.

Storage operating system706may also include a protocol layer802and an associated network access layer806, to allow node208.1to communicate over a network with other systems, such as clients204.1/204.N. Protocol layer802may implement one or more of various higher-level network protocols, such as NFS, CIFS, Hypertext Transfer Protocol (HTTP), TCP/IP and others.

Network access layer806may include one or more drivers, which implement one or more lower-level protocols to communicate over the network, such as Ethernet. Interactions between clients' and mass storage devices212.1-212.3(or114) are illustrated schematically as a path, which illustrates the flow of data through storage operating system706.

The storage operating system706may also include a storage access layer804and an associated storage driver layer808to allow D-module216to communicate with a storage device. The storage access layer804may implement a higher-level storage protocol, such as RAID (redundant array of inexpensive disks), while the storage driver layer808may implement a lower-level storage device access protocol, such as Fibre Channel or SCSI. The storage driver layer808may maintain various data structures (not shown) for storing information regarding storage volume, aggregate and various storage devices.

As used herein, the term “storage operating system” generally refers to the computer-executable code operable on a computer to perform a storage function that manages data access and may, in the case of a node208.1, implement data access semantics of a general purpose operating system. The storage operating system can also be implemented as a microkernel, an application program operating over a general-purpose operating system, such as UNIX® or Windows XP®, or as a general-purpose operating system with configurable functionality, which is configured for storage applications as described herein.

Processing System:FIG. 9is a high-level block diagram showing an example of the architecture of a processing system900that may be used according to one aspect. The processing system900can represent performance manager121, host system102, management console118, clients116,204, or storage system108. Note that certain standard and well-known components which are not germane to the present aspects are not shown inFIG. 9.

The processing system900includes one or more processor(s)902and memory904, coupled to a bus system905. The bus system905shown inFIG. 9is an abstraction that represents any one or more separate physical buses and/or point-to-point connections, connected by appropriate bridges, adapters and/or controllers. The bus system905, therefore, may include, for example, a system bus, a Peripheral Component Interconnect (PCI) bus, a HyperTransport or industry standard architecture (ISA) bus, a small computer system interface (SCSI) bus, a universal serial bus (USB), or an Institute of Electrical and Electronics Engineers (IEEE) standard 1394 bus (sometimes referred to as “Firewire”).

The processor(s)902are the central processing units (CPUs) of the processing system900and, thus, control its overall operation. In certain aspects, the processors902accomplish this by executing software stored in memory904. A processor902may be, or may include, one or more programmable general-purpose or special-purpose microprocessors, digital signal processors (DSPs), programmable controllers, application specific integrated circuits (ASICs), programmable logic devices (PLDs), or the like, or a combination of such devices.

Memory904represents any form of random access memory (RAM), read-only memory (ROM), flash memory, or the like, or a combination of such devices. Memory904includes the main memory of the processing system900. Instructions906implement the process steps described above may reside in and executed by processors902from memory904. For example, instructions906may be used to implement the forecasting module223, detection module225and incident analysis module227, according to one aspect.

Also connected to the processors902through the bus system905are one or more internal mass storage devices910, and a network adapter912. Internal mass storage devices910may be, or may include any conventional medium for storing large volumes of data in a non-volatile manner, such as one or more magnetic or optical based disks. The network adapter912provides the processing system900with the ability to communicate with remote devices (e.g., storage servers) over a network and may be, for example, an Ethernet adapter, a Fibre Channel adapter, or the like.

The processing system900also includes one or more input/output (I/O) devices908coupled to the bus system905. The I/O devices908may include, for example, a display device, a keyboard, a mouse, etc.

Thus, a method and apparatus for collecting, monitoring and analyzing QOS data have been described. Note that references throughout this specification to “one aspect” or “an aspect” mean that a particular feature, structure or characteristic described in connection with the aspect is included in at least one aspect of the present disclosure. Therefore, it is emphasized and should be appreciated that two or more references to “an aspect” or “one aspect” or “an alternative aspect” in various portions of this specification are not necessarily all referring to the same aspect. Furthermore, the particular features, structures or characteristics being referred to may be combined as suitable in one or more aspects of the disclosure, as will be recognized by those of ordinary skill in the art.

While the present disclosure is described above with respect to what is currently considered its preferred aspects, it is to be understood that the disclosure is not limited to that described above. To the contrary, the disclosure is intended to cover various modifications and equivalent arrangements within the spirit and scope of the appended claims.