Display of data used for system performance analysis

Method, system, and computer program product for displaying data used to analyze system performance are provided. The method, system, and computer program product provides for determining an alert was triggered in a system at a point in time, identifying an alert type associated with the alert that was triggered in the system at the point in time, and displaying data concerning the system based on the alert type identified, the data displayed comprising a subset of a plurality of types of data available concerning the system, the subset being selected based on the alert type identified.

FIELD OF THE INVENTION

The present invention relates generally to displaying data used to analyze system performance.

BACKGROUND OF THE INVENTION

In large software runtime environments, such as, server environments, it is often difficult to diagnose problems in a system because any number of seemingly unrelated factors may interact and result in performance issues or system failure. Information useful in diagnosing system problems, such as logs, performance measurements, and so forth, may also be scattered in a variety of places. Additionally, less experienced users may not know which types of information are relevant for a particular system problem. Diagnosing system problems is further complicated by the fact that information necessary for diagnosis may need to be viewed using multiple viewers that are unlikely to be synchronized. Hence, a big picture view of what was happening in the system when a particular problem occurred will not be available.

SUMMARY OF THE INVENTION

Method, system, and computer program product for displaying data used to analyze system performance are provided. The method, system, and computer program product provides for determining an alert was triggered in a system at a point in time, identifying an alert type associated with the alert that was triggered in the system at the point in time, and displaying data concerning the system based on the alert type identified, the data displayed comprising a subset of a plurality of types of data available concerning the system, the subset being selected based on the alert type identified.

The display of data concerning the system comprises displaying data concerning the system based on the alert type identified for a window of time in one implementation. Each type of data displayed may also be time synchronized. In response to a piece of the data displayed concerning the system being highlighted, details regarding the piece of data that is highlighted may be displayed.

In one implementation, the plurality of types of data available concerning the system includes information relating to processor(s), information relating to transaction(s), information relating to page(s), information relating to cache(s), information relating to log(s), information relating to command(s), information relating to throughput, and information relating to input(s)/output(s).

The subset of the plurality of types of data available concerning the system that is displayed may change depending on the alert type identified. In one implementation, the point in time is displayed on a timeline and selection of the point in time is made by moving a slider on the timeline to the point in time. Changing a time scale of the timeline can be used to enlarge or shrink a time window of the timeline.

DETAILED DESCRIPTION

The present invention generally relates to displaying data used to analyze system performance. The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. The present invention is not intended to be limited to the implementations shown, but is to be accorded the widest scope consistent with the principles and features described herein.

When problems occur in large software runtime environments, such as server environments, it is often difficult to diagnose the problems. The difficulty arises from the fact that any number of seemingly unrelated factors may interact and result in system failure, performance issue, or the like. Diagnosing system problems in large software runtime environments is also difficult because information useful in diagnosing the system problems may be stored in a variety of places. In addition, knowing which types of information are relevant for a particular problem in a system typically requires a deep understanding of the relationships and workings of the system.

Problems in a system sometimes result from timing, sequencing, and/or interactions between components of the system. Thus, it may be necessary to view and interpret numerous types of information concerning the system around the time a problem occurred in order to diagnose the problem. However, a big picture of what was happening in the system when the problem occurred may not be available because multiple viewers may need to be used to view the information relevant to the problem, the information displayed in the viewers may not be synchronized, and the viewers may only display information for a specific point in time.

Depicted inFIG. 1is a process100for displaying data used to analyze system performance according to an implementation of the invention. At102, an alert is determined to have been triggered in a system at a point in time. The system may be configured such that one or more alerts are triggered in the system when one or more conditions are satisfied. For example, an alert may be triggered when an event exceeds a threshold (e.g., a response to a request takes longer than 30 seconds), when an error is generated, when a warning is generated, or the like.

At104, an alert type associated with the alert that was triggered in the system at the point in time is identified. The alert type associated with the alert may be based on, for instance, a type of event associated with the alert, the type of condition associated with the alert, and so forth. At106, data concerning the system is displayed based on the alert type identified.

The data displayed includes a subset of a plurality of types of data available concerning the system, where the subset is selected based on the alert type identified. The plurality of types of data may include, for instance, information relating to processor(s), information relating to transaction(s), information relating to page(s), information relating to cache(s), information relating to log(s), information relating to command(s), information relating to throughput, and information relating to input(s)/output(s), and so forth. Hence, as an example, information relating to log(s) may not be displayed for an alert type because log type of data may not be useful in analyzing that type of alert.

In one implementation, the display of data concerning the system involves displaying data concerning the system for a window of time. Users may be allowed to configure the window of time by shrinking or enlarging a time span for the window of time (e.g., 5 minute span, 1 hour span, 12 hour span, etc.) and changing a time period for the window of time (e.g., 1pm-2pm, 9am-10am, and so forth).

The window of time may be defined such that a beginning of the window of time is a first predetermined period of time before the point in time and an ending of the window of time is a second predetermined period of time after the point in time. The first predetermined period of time and the second predetermined period of time may be the same. Additionally, the first and second predetermined periods of time may each be user configurable.

Each type of data displayed is time synchronized in one implementation. If a piece of data displayed is highlighted, then details regarding the piece of data highlighted may be displayed as well. For example, if the display of system data includes names of queries submitted and one of the query names is highlighted (e.g., using a pointing device and selecting the query name), then the code for the highlighted query may also be displayed so that the query can be analyzed for errors.

By selecting types of data to display based on type of alert to be analyzed, users no longer need to have extensive experience with a system to analyze problems in the system. In addition, by displaying the selected types of data together, synchronizing the different types of data, and displaying data for a period of time rather than a single point in time, analysis of system performance is simplified as users will be able to get an overview of what was happening in the system around the time a problem occurred.

FIG. 2illustrates a system200according to an implementation of the invention. System200includes a display202, a storage204, and a browser206in display202. Display202may be, for instance, a liquid crystal display (LCD), a cathode ray tube (CRT) display, or the like. Storage204may be, for instance, a hard disk, memory, or the like. Storage204stores a plurality of types of data concerning system200.

Browser206may be an application executing on a processor (not shown) in system200. Browser206may be a stand-alone application or integrated into a larger application (e.g., database application). System200may include other components (not shown), such as a processor, additional storage, and so forth.

In one implementation, browser206determines that an alert was set off in system200at a point in time, identifies an alert type associated with the alert that was set off in system200at the point in time, and displays data concerning system200based on the alert type identified. The data displayed by browser206comprises a subset of the plurality of types of data concerning system200stored in storage204. The subset is selected based on the alert type identified.

Shown inFIGS. 3A-3Bare sample screenshots300aand300bfor browser206in system200according to various implementations of the invention. In screenshot300a, a first point in time302has been selected. As shown inFIGS. 3A-3B, the first point in time302is displayed on a timeline304and selected by moving a slider306to the first point in time302. A time period of timeline304can be changed by clicking on arrows308a-308b.

A second point in time310is also displayed on timeline304. InFIGS. 3A-3B, minutes has been selected as a time scale312for timeline304. In one implementation, changing time scale312of timeline304changes a time span of timeline304(e.g., 1 hour). For example, changing time scale312to seconds can shrink the time span of timeline304(e.g., to 5 minutes) while changing time scale312to hours can enlarge the time span of timeline304(e.g., to 12 hours). The time span of timeline304for each value selected for time scale310may be user configurable.

In sample screenshots300a-300b, an alert314was triggered at the first point in time302. Based on an alert type associated with alert314, a subset of the plurality of types of data available concerning system200is displayed by browser206. InFIG. 3A, the types of data displayed for the alert type associated with alert314include memory usage, cache usage, number of transactions, CPU (Central Processing Unit) usage, input/output usage, and event logs.

As seen inFIG. 3A, the data displayed for certain types of data includes data over a period of time and not just the first point in time302selected. In addition, the various types of data displayed are time synchronized. Furthermore, details relating to one of the event log entries are shown inFIG. 3Abecause the one event log entry is highlighted.

In sample screenshot300b, the second point in time310has been selected by moving slider306. An alert316was triggered at the second point in time310. A different subset of the plurality of types of data available concerning system200is displayed by browser206because the alert type associated with alert316is different from the alert type associated with alert314.

Similar to the types of data displayed in screenshot300a, the types of data displayed n screenshot300bare time synchronized. In addition, the data displayed for the various types of data includes data over a period of time.

The way in which various types of data are displayed in browser206may be configurable. For example, log type data may be displayed on the left side of browser206rather than on the right side. In addition, users may be allowed to select specific types of alerts to display on timeline304.

Further, although it is not shown inFIGS. 3A-3B, color can be used to draw a user's attention to certain thresholds for errors or warnings. As an example, the color red can be used to show excess CPU usage or excess I/O in screenshot300a.

A timeline based browser allows users to scroll through an integrated view of events, variable statuses/values, actions, and so forth taking place in a system. The information displayed is synchronized in time, which may be accomplished using timestamps. Users are able to move through time before and after an alert by moving a slider on a timeline to view system performance measures, action logs, commands issued, and so forth. How various system resources impact each other can also be analyzed using the browser by observing interactions over time. This is useful in setting system values to optimize performance.

To give an example as to how a browser, such as browser206illustrated inFIG. 2, can be used, assume throughput of a database system has slowed down or halted, which triggered an alert and/or error message. An operator can diagnose the problem by using the browser to inspect performance measures and action logs leading up to the alert. The operator may discover that a database statement was submitted right before the alert and upon further investigation, determine that the database statement caused the throughput of the database system to slow down.

FIG. 4depicts a process400for displaying data used to analyze system performance according to an implementation of the invention. At402, selection of a first point in time is received. A determination is made at404as to whether any alert was triggered in a system at the first point in time. If no alert was triggered in the system at the first point in time, then data concerning the system for the first point in time is displayed at406. The data displayed includes a default subset of a plurality of types of data available concerning the system. The default subset may be the same as a subset that was displayed for another point in time previously selected.

However, if a first alert was triggered at the first point in time, then a first alert type associated with the first alert triggered at the first point in time is identified at408. Data concerning the system is displayed at410based on the first alert type identified. The data displayed based on the first alert type includes a first subset of the plurality of types of data available concerning the system. The first subset is selected based on the first alert type identified.

A selection of a second point in time is received at412. At414, a determination is made as to whether any alert was triggered in the system at the second point in time. If no alert was triggered in the system at the second point in time, then data concerning the system for the second point in time is displayed at416. The data displayed includes the default subset of the plurality of types of data available concerning the system.

On the other hand, if a second alert was triggered at the second point in time, then a second alert type associated with the second alert triggered at the second point in time is identified at418. Data concerning the system is displayed at420based on the second alert type identified. The data displayed based on the second alert type includes a second subset of the plurality of types of data available concerning the system. The second subset is selected based on the second alert type identified.

The second subset differs from the first subset when the second alert type differs from the first alert type. Hence, each alert type can be associated with a unique subset of the plurality of types of data available concerning the system. The subset for each alert type may be predefined. In addition, the subset for each alert type may be user configurable.

The invention can take the form of an entirely hardware implementation, an entirely software implementation, or an implementation containing both hardware and software elements. In one aspect, the invention is implemented in software, which includes, but is not limited to, application software, firmware, resident software, microcode, etc.

FIG. 5depicts a data processing system500suitable for storing and/or executing program code. Data processing system500includes a processor502coupled to memory elements504a-bthrough a system bus506. In other implementations, data processing system500may include more than one processor and each processor may be coupled directly or indirectly to one or more memory elements through a system bus.

Memory elements504a-bcan include local memory employed during actual execution of the program code, bulk storage, and cache memories that provide temporary storage of at least some program code in order to reduce the number of times the code must be retrieved from bulk storage during execution. As shown, input/output or I/O devices508a-b(including, but not limited to, keyboards, displays, pointing devices, etc.) are coupled to data processing system500. I/O devices508a-bmay be coupled to data processing system500directly or indirectly through intervening I/O controllers (not shown).

In the implementation, a network adapter510is coupled to data processing system500to enable data processing system500to become coupled to other data processing systems or remote printers or storage devices through communication link512. Communication link512can be a private or public network. Modems, cable modems, and Ethernet cards are just a few of the currently available types of network adapters.

While various implementations for displaying data used to analyze system performance have been described, the technical scope of the present invention is not limited thereto. For example, the present invention is described in terms of particular systems having certain components and particular methods having certain steps in a certain order. One of ordinary skill in the art, however, will readily recognize that the methods described herein can, for instance, include additional steps and/or be in a different order, and that the systems described herein can, for instance, include additional or substitute components. Hence, various modifications or improvements can be added to the above implementations and those modifications or improvements fall within the technical scope of the present invention.