Abstract:
A bottleneck detector may analyze individual workloads processed by an application by logging times when the workload may be processed at different checkpoints in the application. For each checkpoint, a curve fitting algorithm may be applied, and the fitted curves may be compared between different checkpoints to identify bottlenecks or other poorly performing sections of the application. A real time implementation of a detection system may compare newly captured data points against historical curves to detect a shift in the curve, which may indicate a bottleneck. In some cases, the fitted curves from neighboring checkpoints may be compared to identify sections of the application that may be a bottleneck. An automated system may apply one set of checkpoints in an application, identify an area for further investigation, and apply a second set of checkpoints in the identified area. Such a system may recursively search for bottlenecks in an executing application.

Description:
BACKGROUND 
       [0001]    Computer applications often have bottlenecks that may limit the throughput or efficiency of an application. Often, bottlenecks may not be fully appreciated when the application code is being written and may only be noticeable when the code may be executed under load. 
         [0002]    The bottlenecks may be an artifact of the application design, poor programming technique, or may be the result of outside constraints on an application. When a bottleneck may be identified, a programmer may be able to investigate the bottleneck and rewrite or otherwise improve the code to increase application performance. 
       SUMMARY 
       [0003]    A bottleneck detector may analyze individual workloads processed by an application by logging times when the workload may be processed at different checkpoints in the application. For each checkpoint, a curve fitting algorithm may be applied, and the fitted curves may be compared between different checkpoints to identify bottlenecks or other poorly performing sections of the application. A real time implementation of a detection system may compare newly captured data points against historical curves to detect a shift in the curve, which may indicate a bottleneck. In some cases, the fitted curves from neighboring checkpoints may be compared to identify sections of the application that may be a bottleneck. An automated system may apply one set of checkpoints in an application, identify an area for further investigation, and apply a second set of checkpoints in the identified area. Such a system may recursively search for bottlenecks in an executing application. 
         [0004]    An application programming interface may receive workload identifiers and checkpoint identifiers from which bottleneck detection may be performed. Workloads may be tracked through various checkpoints in an application and timestamps collected at each checkpoint. From these data, bottlenecks may be identified in real time or by analyzing the data in a subsequent analysis. The workloads may be processed by multiple devices which may comprise a large application. In some cases, the workloads may be processed by different devices in sequence or in a serial fashion, while in other cases workloads may be processed in parallel by different devices. The application programming interface may be part of a bottleneck detection service which may be sold on a pay-per-use model, a subscription model, or some other payment scheme. 
         [0005]    A bottleneck detector may use an iterative method to identify a bottleneck with specificity. An automated checkpoint inserter may place checkpoints in an application. When a bottleneck is detected in an area of an application, the first set of checkpoints may be removed and a new set of checkpoints may be placed in the area of the bottleneck. The process may iterate until a bottleneck may be identified with enough specificity to aid a developer or administrator of an application. In some cases, the process may identify a specific function or line of code where a bottleneck occurs. 
         [0006]    This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0007]    In the drawings, 
           [0008]      FIG. 1  is a diagram illustration of an embodiment showing a method for performing bottleneck analysis. 
           [0009]      FIG. 2  is a diagram illustration of an embodiment showing a network environment with devices to perform bottleneck analysis. 
           [0010]      FIG. 3A  is a diagram illustration of an example embodiment showing a backlog as a function of load for various checkpoints. 
           [0011]      FIG. 3B  is a diagram illustration of an example embodiment showing a backlog as a function of time for various checkpoints. 
           [0012]      FIG. 3C  is a diagram illustration of an example embodiment showing raw data of workloads passing various checkpoints. 
           [0013]      FIG. 4  is a flowchart illustration of an embodiment showing a method for collecting data. 
           [0014]      FIG. 5  is a flowchart illustration of an embodiment showing a method for analyzing data in real time. 
           [0015]      FIG. 6  is a flowchart illustration of an embodiment showing a method for automated bottleneck detection. 
           [0016]      FIG. 7  is a flowchart illustration of an embodiment showing a method for iterating to pinpoint a bottleneck. 
       
    
    
     DETAILED DESCRIPTION 
       [0017]    Bottleneck Detection Using Timestamps 
         [0018]    Bottlenecks in executing programs may be identified by analyzing the timestamps taken as workloads pass certain checkpoints. A bottleneck may be identified when the time to execute a workload between two checkpoints increases at a greater rate than the load increases. 
         [0019]    A bottleneck detector may capture timestamps as workloads pass checkpoints within an application, then analyze the timestamps to identify bottlenecks. The workloads may be any type of memory object, message, process, thread, or other application element that may be operated upon through a sequence of operations. Throughout the course of the workload, various checkpoints may be placed to track the progress of the workload. For each workload, a sequence of timestamps may be collected for each of the checkpoints that the workload may pass. 
         [0020]    In a lightly loaded application, each workload may typically be executed in approximately the same elapsed time. As the load increases to the point where a bottleneck may occur, workloads may take an increasing amount of time at a bottleneck. 
         [0021]    In a simple analogy, workloads may be visualized as cars travelling on a multilane highway. When there is very little traffic, each car may pass mile posts at approximately the same time from the previous mile post. If there was a bottleneck in the highway, due to construction or an accident, the number of lanes may constrict, forcing the cars to slow down through the bottleneck. In such a case, the time from one mile post to another for each car that may pass through the bottleneck may increase. This effect may be measured and detected as a bottleneck. 
         [0022]    The timestamps may be taken at various locations within an application. In some cases, an application may be decorated with function calls that may transmit a workload identifier and capture a timestamp for each checkpoint. The function calls may be placed throughout an application to track a workload&#39;s progress through the application. In such an embodiment, the executable code for an application may be changed to include the checkpoint function calls. Such embodiments may make such changes in source code, intermediate code, binary code, or other phases of an application. 
         [0023]    In some embodiments, an instrumented execution environment may identify checkpoints and set events at each checkpoint to capture timestamp data. In such embodiments, the checkpoints may be created and managed without changing the executable code of an application. Such embodiments may have an identification system for creating and setting the checkpoints, as well as a detection and collection system that may detect the checkpoint and collect related data. 
         [0024]    The application may operate on a single device or across multiple devices. In a single device embodiment, the application may execute on a single hardware platform, which may have multiple processors and various memory and peripheral components. In a single device embodiment, the device may have a clock from which timestamps may be taken. 
         [0025]    In a multiple device application, the application may consist of similar or different software components that may operate on different devices. For example, some applications may operate in a computer cluster, where each device may execute a similar instance of an application to the other devices. In another example, several devices may process workloads in series, where one device may process a workload which may be passed to another device for additional processing. In such embodiments, a synchronized clock may be used to coordinate timestamps that may be gathered from multiple devices. 
         [0026]    A bottleneck detection system may use various time series techniques for capturing, analyzing, and displaying bottleneck information in real time or near-real time. With each data collection event, a set of statistical parameters may be gathered and summed, which may enable other statistical analyses to be performed. The statistical parameters may be lightweight enough to be calculated and updated with minimal computer processing overhead, and a separate analysis routine may analyze the data for bottlenecks in an offline or near-real time basis. 
         [0027]    Application Programming Interface for Bottleneck Detection 
         [0028]    An application programming interface may receive workload identifiers and checkpoint identifiers from applications being analyzed for bottlenecks. The application programming interface may receive and store timestamped data. In some embodiments, the application programming interface may analyze and display the data in real time or near-real time. In other embodiments, a detailed analysis may be performed on historical data. 
         [0029]    The application programming interface may operate in several different architectures. In one architecture, a programmer may add function calls within an application, where the function calls may communicate with an application programming interface locally or over a network connection. In another architecture, an execution environment may have alerts or other monitoring functions that may transmit information to the application programming interface when each checkpoint is reached. In some such architectures, the execution environment may be an integrated development environment with code editors, compilers, debugging tools, and other components. 
         [0030]    The application programming interface may operate as a programmatic gateway to accept data in real time, and an accompanying analysis and rendering engines may identify bottlenecks and may generate visualizations of the data. In some cases, the analysis engines may identify bottlenecks automatically and generate an alert or other report. In other cases, the analysis engine may generate graphs or other visualizations that may be displayed as data are received or using a secondary analysis. 
         [0031]    The application programming interface may be one component of a paid service for application developers. The service may be a subscription based service, pay-per-use service, or have some other payment mechanism. 
         [0032]    Automatic Bottleneck Detection with Automated Checkpoint Selection 
         [0033]    An automated bottleneck detection system may use a recursive mechanism to isolate and identify a bottleneck in an application. A first set of checkpoints may be used to identify a portion of an application that contains a bottleneck, then a second set of checkpoints may be deployed within the identified portion. From analysis of the second set of checkpoints, the location of a bottleneck may be refined. Such a process may iterate until a bottleneck is defined with a high degree of specificity. 
         [0034]    An automated bottleneck detection system may include an automated mechanism for identifying and placing checkpoints in an application. In some embodiments, such a mechanism may insert function calls or otherwise decorate an application in source code, intermediate code, binary code, or some other form. In some cases, an automated bottleneck detection system may attempt to identify natural breaks or other elements in an application into which to insert checkpoints. In some cases, an automated mechanism for inserting checkpoints may place checkpoints at locations that may not be natural breaks. 
         [0035]    In some cases, an automated bottleneck detection system may use a set of predefined checkpoint function calls that may be inserted automatically or inserted by a programmer. In such embodiments, the automated bottleneck detection system may turn on a first subset of checkpoint function calls, identify the general area of a bottleneck, then turn on a second subset of checkpoint function calls that are nearer to the bottleneck to home in on the bottleneck location. 
         [0036]    Throughout this specification and claims, the terms “profiler”, “tracer”, and “instrumentation” are used interchangeably. These terms refer to any mechanism that may collect data when an application is executed. In a classic definition, “instrumentation” may refer to stubs, hooks, or other data collection mechanisms that may be inserted into executable code and thereby change the executable code, whereas “profiler” or “tracer” may classically refer to data collection mechanisms that may not change the executable code. The use of any of these terms and their derivatives may implicate or imply the other. For example, data collection using a “tracer” may be performed using non-contact data collection in the classic sense of a “tracer” as well as data collection using the classic definition of “instrumentation” where the executable code may be changed. Similarly, data collected through “instrumentation” may include data collection using non-contact data collection mechanisms. 
         [0037]    Further, data collected through “profiling”, “tracing”, and “instrumentation” may include any type of data that may be collected, including performance related data such as processing times, throughput, performance counters, and the like. The collected data may include function names, parameters passed, memory object names and contents, messages passed, message contents, registry settings, register contents, error flags, interrupts, or any other parameter or other collectable data regarding an application being traced. 
         [0038]    Throughout this specification and claims, the term “execution environment” may be used to refer to any type of supporting software used to execute an application. An example of an execution environment is an operating system. In some illustrations, an “execution environment” may be shown separately from an operating system. This may be to illustrate a virtual machine, such as a process virtual machine, that provides various support functions for an application. In other embodiments, a virtual machine may be a system virtual machine that may include its own internal operating system and may simulate an entire computer system. Throughout this specification and claims, the term “execution environment” includes operating systems and other systems that may or may not have readily identifiable “virtual machines” or other supporting software. 
         [0039]    Throughout this specification, like reference numbers signify the same elements throughout the description of the figures. 
         [0040]    In the specification and claims, references to “a processor” include multiple processors. In some cases, a process that may be performed by “a processor” may be actually performed by multiple processors on the same device or on different devices. For the purposes of this specification and claims, any reference to “a processor” shall include multiple processors which may be on the same device or different devices, unless expressly specified otherwise. 
         [0041]    When elements are referred to as being “connected” or “coupled,” the elements can be directly connected or coupled together or one or more intervening elements may also be present. In contrast, when elements are referred to as being “directly connected” or “directly coupled,” there are no intervening elements present. 
         [0042]    The subject matter may be embodied as devices, systems, methods, and/or computer program products. Accordingly, some or all of the subject matter may be embodied in hardware and/or in software (including firmware, resident software, micro-code, state machines, gate arrays, etc.) Furthermore, the subject matter may take the form of a computer program product on a computer-usable or computer-readable storage medium having computer-usable or computer-readable program code embodied in the medium for use by or in connection with an instruction execution system. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. 
         [0043]    The computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. 
         [0044]    Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by an instruction execution system. Note that the computer-usable or computer-readable medium could be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, of otherwise processed in a suitable manner, if necessary, and then stored in a computer memory. 
         [0045]    When the subject matter is embodied in the general context of computer-executable instructions, the embodiment may comprise program modules, executed by one or more systems, computers, or other devices. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Typically, the functionality of the program modules may be combined or distributed as desired in various embodiments. 
         [0046]      FIG. 1  is a diagram of an embodiment  100  showing a bottleneck detection mechanism in its operational parts. Embodiment  100  is merely one example of a bottleneck detection system that may be performed on an application. 
         [0047]    A set of workloads  102  may be executed by an application in an execution environment  104 . The workloads may be any units of work that may be traced, tracked, or otherwise monitored on a series of checkpoints. As each workload  102  is executed, the various checkpoints  106 ,  108 ,  110 , and  112  may capture a respective set of timestamps  114 ,  116 ,  118 , and  120 . The timestamps may include load factors and other data. 
         [0048]    A data collector  122  may gather and transmit the data to an analyzer  124 , which may generate a graph  126  or provide other output. In some cases, the analyzer  124  may produce output in real time, while in other cases, the analyzer  124  may process the various data elements after collection has completed. 
         [0049]    The bottleneck detection of embodiment  100  may identify bottlenecks by measuring the difference in timestamps between various checkpoints for each workload. A bottleneck may be identified when the time difference between two checkpoints grows for each successive workload. In such a condition, the downstream process may be processing fewer workloads than may be coming in, causing the bottleneck. 
         [0050]    The workloads may be any unit of work that may be tracked through an application. In some cases, the unit of work may be captured in a data item that may be passed from one portion of executable code to another. In other cases, the unit of work may be a process, transaction, thread, or other executable or data element that may undergo transformations or changes by several portions of an application. 
         [0051]    In some embodiments, the workloads may be passed from one device to another. For example, a high performance computing environment may use message passing to transmit workloads from one device to another. Other systems, such as computer cluster arrangements, may use multiple devices to handle workloads in parallel or in series. 
         [0052]    The workloads may or may not be independent of each other. In some embodiments, the workloads may be clearly delineated and independent. Other embodiments may have workloads that may interact with each other or are not fully independent. In many cases, a more reliable bottleneck detection may occur with independent workloads. 
         [0053]    At each checkpoint, a timestamp and workload identifier may be captured. In many embodiments, a load factor and other data may also be gathered. The timestamp may be a ‘wall clock’ time that may reflect the actual time a checkpoint may have been encountered. Such a timestamp may be useful in cases where a workload may be processed by multiple devices. 
         [0054]    In some embodiments, the timestamp may be an elapsed time from some designated start time. For example, some embodiments may start a clock when a workload encounters a first checkpoint, then collect elapsed time from the first checkpoint for each subsequent checkpoint. Other embodiments may determine elapsed time from the preceding checkpoint. 
         [0055]    With each checkpoint and timestamp, a workload identifier may be captured. The workload identifier may be a mechanism to link subsequent checkpoint timestamps to each other. In some cases, a workload identifier may have a natural and meaningful name. In other cases, an arbitrary name may be assigned to workloads, one example of which may be to assign consecutive numbers as workload identifiers. 
         [0056]    A load factor may be collected with the timestamp. The load factor may be any indicator for the ‘busy-ness’ or amount of work attempting to be processed by a system. In some embodiments, the load factor may be collected by a different data collection mechanism and matched to the data collected from the checkpoints by the timestamps or other mechanism. For example, a load factor may be a network traffic metric gathered from a network interface, a processor use metric collected from a hardware counter or other monitoring system. 
         [0057]    The load factor may be implied in some embodiments. For example, a load factor may be inferred from the number of workload items being processed at a given time, or by the rate at which work items may be received by the system. 
         [0058]    The analyzer  124  may organize the data by checkpoint and may create a time series representing the time lag between a baseline time and the checkpoint timestamp for each workload. Such a time series may be analyzed to determine when the values grow. In a non-bottleneck steady state, such a time series would be expected to be a flat, straight line. When a bottleneck occurs, the values in such a time series would be expected to grow. 
         [0059]    The growth in the time series values may be linear or non-linear, depending on the application. Some embodiments may monitor the checkpoint data in real time and, using time series analyses, may evaluate the data stream to determine when the data stream has deviated from an expected constant value. 
         [0060]    In many embodiments, such an analysis may take into consideration the variance of the data. Some data sets may contain more noise than others, and the correlation coefficient or other metrics of noise may be different for each application. In general, the larger the variance in the data, the greater a deviation may be present before a bottleneck may be identified. 
         [0061]      FIG. 2  is a diagram of an embodiment  200  showing components that may perform bottleneck detection. Embodiment  200  contains a device  202  that may be a single device in which bottleneck detection may occur, as well as several devices that may perform bottleneck detection on a larger scale, including monitoring applications that execute over multiple devices. 
         [0062]    A single device architecture may gather tracer data containing timestamps gathered at various checkpoints, analyze the data, and graphically display the data or perform bottleneck detection. 
         [0063]    A multiple device architecture may divide different components of the data gathering, analysis, and management functions over different devices. The multiple device architecture may be one way to deliver an application programming interface that may detect bottlenecks from tracer data. 
         [0064]    The diagram of  FIG. 2  illustrates functional components of a system. In some cases, the component may be a hardware component, a software component, or a combination of hardware and software. Some of the components may be application level software, while other components may be execution environment level components. In some cases, the connection of one component to another may be a close connection where two or more components are operating on a single hardware platform. In other cases, the connections may be made over network connections spanning long distances. Each embodiment may use different hardware, software, and interconnection architectures to achieve the functions described. 
         [0065]    Embodiment  200  illustrates a device  202  that may have a hardware platform  204  and various software components. The device  202  as illustrated represents a conventional computing device, although other embodiments may have different configurations, architectures, or components. 
         [0066]    In many embodiments, the device  202  may be a server computer. In some embodiments, the device  202  may still also be a desktop computer, laptop computer, netbook computer, tablet or slate computer, wireless handset, cellular telephone, game console or any other type of computing device. 
         [0067]    The hardware platform  204  may include a processor  208 , random access memory  210 , and nonvolatile storage  212 . The hardware platform  204  may also include a user interface  214  and network interface  216 . 
         [0068]    The random access memory  210  may be storage that contains data objects and executable code that can be quickly accessed by the processors  208 . In many embodiments, the random access memory  210  may have a high-speed bus connecting the memory  210  to the processors  208 . 
         [0069]    The nonvolatile storage  212  may be storage that persists after the device  202  is shut down. The nonvolatile storage  212  may be any type of storage device, including hard disk, solid state memory devices, magnetic tape, optical storage, or other type of storage. The nonvolatile storage  212  may be read only or read/write capable. In some embodiments, the nonvolatile storage  212  may be cloud based, network storage, or other storage that may be accessed over a network connection. 
         [0070]    The user interface  214  may be any type of hardware capable of displaying output and receiving input from a user. In many cases, the output display may be a graphical display monitor, although output devices may include lights and other visual output, audio output, kinetic actuator output, as well as other output devices. Conventional input devices may include keyboards and pointing devices such as a mouse, stylus, trackball, or other pointing device. Other input devices may include various sensors, including biometric input devices, audio and video input devices, and other sensors. 
         [0071]    The network interface  216  may be any type of connection to another computer. In many embodiments, the network interface  216  may be a wired Ethernet connection. Other embodiments may include wired or wireless connections over various communication protocols. 
         [0072]    The software components  206  may include an operating system  218  on which various software components and services may operate. An operating system may provide an abstraction layer between executing routines and the hardware components  204 , and may include various routines and functions that communicate directly with various hardware components. 
         [0073]    An execution environment  220  may execute an application  222  and a tracer  226  may collect timestamps and other information at checkpoints in the application  222 . The tracer  226  may store its output as tracer data  228 . 
         [0074]    The execution environment  220  may be any mechanism that may cause the application  222  to be executed and include a tracer  226  that may gather data at each checkpoint. In some embodiments, the execution environment  220  may be a virtual machine such as a process virtual machine or system virtual machine that may be instrumented with a tracer  226 . In other embodiments, the execution environment  220  may be an integrated development environment that may include a code editor, compiler, debugging tools, and other functionality. 
         [0075]    The tracer  226  may be any mechanism that may collect data at each checkpoint. In some cases, the tracer  226  may include function calls or other code that may be inserted into the executable code as binary code, intermediate code, or source code. In other cases, the tracer  226  may operate without modifying the executable code of the application  222 . 
         [0076]    A checkpoint inserter  224  may create checkpoints and cause the tracer  226  to collect data at the various checkpoints. In some cases, the checkpoint inserter  224  may decorate the application  222  with function calls or other tracer-related code. In other cases, the checkpoint inserter  224  may create checkpoints that may be monitored by the tracer  226  to collect the tracer data  228 . 
         [0077]    In some embodiments, the checkpoint inserter  224  may be a fully automated application part that may select checkpoints and cause the tracer  226  to execute at each checkpoint. In other embodiments, the checkpoint inserter  224  may have some user interface through which a human programmer may select locations for checkpoints, which may be automatically or manually inserted into an application. 
         [0078]    A data analyzer  230  may receive the tracer data  228  to detect various bottlenecks. In some embodiments, the output of the data analyzer  230  may be transmitted to a rendering engine  232  to display graphical results. 
         [0079]    In a network  234  environment, some embodiments may be deployed over multiple devices. 
         [0080]    A tracer manager device  236  may operate on a hardware platform  238 , which may be similar to the hardware platform  204 . In some cases, the various hardware platforms may include cloud based execution environments which may or may not have a notion of a computing ‘device’. 
         [0081]    A tracer manager  240  may manage the operations of a tracing system over multiple devices, such as applications that may be deployed on a clustered computer configuration or other multiple-device architecture. In such embodiments, the tracer manager  240  may coordinate execution of an application, tracers on each device, as well as load generators and other components. The tracer manager  240  may also control a checkpoint inserter  242  and data analyzer  244 . 
         [0082]    In some embodiments, the tracer manager  240  may operate bottleneck detection as a paid service. In such an embodiment, customers may pay for bottleneck detection analysis using a payment manager  245 , which may charge on a subscription basis, a pay-per-use basis, or other mechanisms. 
         [0083]    One or more execution platforms  246  may execute the application and may collect checkpoint data. The execution platforms  246  may each have a hardware platform  248  on which an execution environment  250  may run. Each application  252  may be identical instances of the same application or may be different components of a larger application. The tracers  254  may gather trace data when a checkpoint is reached. 
         [0084]    A data collection device  264  may operate on a hardware platform  266  and may contain an application programming interface  268  that may receive data from the tracers  254  and store the tracer data  270  for analysis. The application programming interface  268  may receive data taken at each checkpoint occurrence, then store the data. 
         [0085]    In some cases, the application programming interface  268  may perform some processing of the incoming data. For example, some embodiments may create a timestamp when a data element is received from a tracer  254 . In another example, some embodiments may preprocess the incoming data into a format that may be further processed by an analysis engine. 
         [0086]    The application programming interface  268  may be used by the tracer  226  that may operate on an embodiment with a single execution environment, as well as gathering data from multiple tracers  254  on multiple execution environments. 
         [0087]    A load generator device  258  may operate on a hardware platform  260  and may have a load generator  262  application. The load generator  262  may create workloads that may be processed by an application. In some cases, such workloads may be artificial or fictitious workloads that may exercise the application so that bottlenecks may appear in the tracer data. 
         [0088]      FIG. 3A  is a diagram illustration of an example embodiment  300  showing a graph identifying inflection points as bottlenecks from trace data. Embodiment  300  illustrates a graph showing load on the X axis versus backlog on the Y axis. 
         [0089]    The backlog may indicate the amount of time that a workload took to reach a given checkpoint. Five lines  304 ,  306 ,  308 ,  310 , and  312  are shown in the graph, and each line may represent the backlog for a given checkpoint as a function of the load experienced by the system. 
         [0090]    The graph of embodiment  300  may or may not reflect the sequence of workloads processed by an application, but instead may reflect measurements taken at different levels of loading. If the workload was applied in ever increasing amounts, the graph  300  may represent the backlog received over time, but in many cases, data used to generate a graph such as embodiment  300  may be gathered over many cycles of high, medium, and low loads. 
         [0091]    In a normal situation where a checkpoint does not experience a bottleneck, the checkpoint lines may be horizontal lines, such as for checkpoints  304  and  306 . 
         [0092]    At a certain amount of load, checkpoint line  308  may diverge at the inflection point  314 . The inflection point  314  may identify the load at which a bottleneck occurred, as well as identified that the bottleneck occurred between checkpoints  306  and  308 . A programmer may be able to spot the inflection point  314  visually and investigate the bottleneck in the code between checkpoints  306  and  308 . 
         [0093]    As the load increases, a second inflection point  316  may indicate a second bottleneck that may occur between checkpoints  310  and  312 . Again, a programmer may be able to investigate and attempt to address the bottleneck. 
         [0094]    The graph of embodiment  300  may be created by mapping the elapsed time for each workload measured from an initial starting point. When such a measurement or calculation is performed, each checkpoint may be illustrated as a stacked line configuration, where the sequence of workflow may be from the bottom of the graph to the top. 
         [0095]    The result of such a measurement may also yield lines that are parallel to each other. For example, checkpoint  310  remains parallel to checkpoint  308  after the inflection point  314 . This indicates that the time between checkpoints  308  and  310  may not have changed even after the bottleneck was incurred. The rise of the checkpoint  310  may reflect the downstream effects of the bottleneck in checkpoint  308 . 
         [0096]    In some embodiments, the infection points  314  and  316  may be identified through numerical analysis. Such numerical analysis may attempt to fit a curve to the data points, beginning with a straight line curve, and progressing to more complex curves. When the data may not fit a straight line curve, an analysis may attempt to find an inflection point by fitting two line segments. The correlation coefficient for each curve fitting step may be used as a measure of variance in the data as well as a metric for determining when a fitted curve is a sufficient match. 
         [0097]    The analysis of checkpoint lines may involve comparing the slope of a linear curve fitting analysis, such as linear regression. In such analysis, a positive change in slope from one checkpoint line to a subsequent checkpoint line may indicate a bottleneck. 
         [0098]      FIG. 3B  is a diagram illustration of an example embodiment  302  showing a graph identifying inflection points as bottlenecks from trace data. Embodiment  302  illustrates a graph showing time on the X axis versus backlog on the Y axis. Embodiment  300  as described above represents load on the X axis, embodiment  302  illustrates a different graph with time on the X axis. 
         [0099]    The backlog may indicate the amount of time that a workload took to reach a given checkpoint. Six lines  318 ,  320 ,  322 ,  324 ,  326 , and  328  are shown in the graph, and each line may represent the backlog for a given checkpoint as a function of the time. 
         [0100]    The graph of embodiment  302  may illustrate a system&#39;s response to increasing and decreasing loads. The amount of load is not shown in the graph, but the effects of load may be illustrated. 
         [0101]    As with graph  300 , checkpoints  318  and  320  illustrate checkpoints where no bottlenecks have been experienced. At inflection point  330 , checkpoint  322  experienced a bottleneck that continues to build until inflection point  332 , where the bottleneck recedes until the bottleneck dissipates. While that is occurring, checkpoint  326  experiences an inflection point  334 , which indicates a second bottleneck. In the graph  302 , the bottleneck of checkpoint  326  appears to build while the bottleneck of checkpoint  332  recedes. 
         [0102]      FIG. 3C  is a diagram illustration of an example embodiment  336  showing raw data that may be plotted on a graph. Embodiment  336  illustrates data for multiple workloads as those workloads are received, and the timestamps for each checkpoint for each workload. 
         [0103]    The X axis may show datasets for individual workloads as organized by the start time for the workload. Workloads  338 ,  340 ,  342 , and  344  are illustrated with data points indicating when the workloads passed checkpoints  346 ,  348 , and  350 . Additional workloads are also shown. 
         [0104]    The checkpoints  346 ,  348 , and  350  may have lines representing a best fit across the various checkpoint data points for the workloads. From even casual observation, the line fitted to checkpoint  346  data appears to be flat and does not change over time, while the line fitted to checkpoint  348  appears to rise, and the line fitted to checkpoint  350  appears to rise even further. 
         [0105]    The difference between the slopes of the lines for checkpoint  346  and  348  may indicate that a bottleneck exists between checkpoints  346  and  348 , and that the bottleneck grows as time increases. A similar situation may also be present between checkpoints  348  and  350 . In some datasets, workloads may be processed in irregular patterns. In the example of embodiment  336 , workloads  338  and  340  may be received with a time distance  352 , while workloads  342  and  344  may have been received with a shorter time distance  354 . 
         [0106]      FIG. 4  is a flowchart illustration of an embodiment  400  showing a method for gathering tracer data. The operations of embodiment  400  may illustrate one method that may be performed by the tracers  226  or  254  of embodiment  200 . 
         [0107]    Other embodiments may use different sequencing, additional or fewer steps, and different nomenclature or terminology to accomplish similar functions. In some embodiments, various operations or set of operations may be performed in parallel with other operations, either in a synchronous or asynchronous manner. The steps selected here were chosen to illustrate some principles of operations in a simplified form. 
         [0108]    A tracer may operate in an execution environment to gather timestamp and other data at each checkpoint. In some cases, the checkpoint may be identified by function calls or other markers in the executable code. In other cases, a checkpoint may be an event, executable code component, or other identifiable element of an executing code. 
         [0109]    An execution environment may receive workloads for an application in block  402 . For each workload in block  404 , the workload may be executed to a first checkpoint in block  406  and timestamp and other data may be taken in block  408 . The workload may be executed to a second checkpoint in block  410  and a second timestamp and other data may be taken in block  412 . Similarly, the workload may be executed to a third checkpoint in block  414  and a third timestamp and other data may be taken in block  416 . The sequence of execution to a checkpoint and collecting data may continue until the workload has finished being processed. 
         [0110]    The execution environment may process many workloads in the manner of blocks  406  through  416 . In many cases, multiple workloads may be progressing through an application at once. 
         [0111]    After collecting all the timestamps and other data, the data may be stored in block  418  and analysis may be performed on the data in block  420 . 
         [0112]      FIG. 5  is a flowchart illustration of an embodiment  500  showing a method for analyzing tracer data in real time. The operations of embodiment  500  may illustrate one method that may be performed by the data analyzers  230  or  244  of embodiment  200 . 
         [0113]    Other embodiments may use different sequencing, additional or fewer steps, and different nomenclature or terminology to accomplish similar functions. In some embodiments, various operations or set of operations may be performed in parallel with other operations, either in a synchronous or asynchronous manner. The steps selected here were chosen to illustrate some principles of operations in a simplified form. 
         [0114]    Embodiment  500  illustrates one method for analyzing tracer data in real time or near-real time. A timestamp may be received in block  502  and a workload level or other data may be determined in block  504 . The timestamp may include a workload identifier and checkpoint identifier. In some embodiments, only the workload identifier and checkpoint identifier may be received, and the timestamp may be determined after receiving the data. 
         [0115]    In the example of embodiment  500 , the timestamp may represent a value in the Y axis and the workload level may represent a value in the X axis, which may be used to generate a graph such as may be shown in embodiment  300 . 
         [0116]    In the example of embodiment  302  where the X axis represents time, the workload level may not be collected in block  504 . 
         [0117]    A set of time series statistics may be updated in block  506 . The time series statistics may be any type of statistics from which further analyses may be performed. In a simple example of such statistics, the time series statistics may reduce or compress the full trace of X and Y values to the sum of all X values, sum of all Y values, the sum of the square of X values, the sum of the square of Y values, the sum of the product of XY, and the number of samples. From these time series data, linear regression may be performed on the dataset to generate a slope and intercept as well as a correlation coefficient. 
         [0118]    In such an embodiment, an analysis may be performed that compares the slope of adjacent checkpoint datasets. When the slope of a later checkpoint diverges or increases from a previous checkpoint, a bottleneck may be identified. 
         [0119]    After updating the time series statistics in block  506 , the process may loop back to block  502  to process another incoming dataset. Such a loop may be performed relatively quickly, and the remaining blocks  508  and  510  may be performed either offline or in a different thread or process so that the data collection of blocks  502  through  506  may proceed without delay. 
         [0120]    In block  508 , new values for a visualization graph may be determined and the visualization may be rendered in block  510 . In many cases, the calculation and rendering operations of blocks  508  and  510  may consume a relatively large amount of resources than blocks  502  through  506 , thus blocks  508  and  510  may be separated. 
         [0121]      FIG. 6  is a flowchart illustration of an embodiment  600  showing a method for detecting bottlenecks from tracer data. The operations of embodiment  600  may illustrate one method that may be performed by the data analyzers  230  or  244  of embodiment  200 . 
         [0122]    Other embodiments may use different sequencing, additional or fewer steps, and different nomenclature or terminology to accomplish similar functions. In some embodiments, various operations or set of operations may be performed in parallel with other operations, either in a synchronous or asynchronous manner. The steps selected here were chosen to illustrate some principles of operations in a simplified form. 
         [0123]    Embodiment  600  illustrates a method that analyzes data gathered in a process such as that of embodiment  400  and detects bottlenecks. 
         [0124]    Historical data may be received in block  602 . The data may be analyzed for each checkpoint in block  604 . For a given checkpoint, the data for each workload may be analyzed in block  606 . 
         [0125]    For each workload, a time difference may be calculated from a previous checkpoint in block  608 . The time difference may be calculated from the immediately preceding checkpoint in some embodiments, while other embodiments may calculate the time difference from a start time for the workload. 
         [0126]    In block  610 , a workload factor may be identified for the time corresponding to the timestamp of the current workload at the current checkpoint. The workload factor may be used in embodiments where the analysis may be performed on historical data. In an embodiment such as embodiment  302  where the X axis of a graph may be time, a workload factor may not be used. 
         [0127]    After preparing the data in blocks  606  through  610 , a curve fitting analysis may be performed. In some cases, the curve fitting may be performed against a load factor, while in other cases, the curve fitting may be performed against time. 
         [0128]    An analysis of the fitted curve may be performed in block  614  for any anomalies. An anomaly may be a very high correlation coefficient in a linear curve fitting attempt, an inflection point in a more complicated curve fitting method, or some other indicator that that data may not be adequately represented by a line. When an anomaly is not detected in block  616 , the checkpoint curve may not reveal a bottleneck. When an anomaly is detected in block  616 , the location may be labeled as a bottleneck. 
         [0129]    The analysis of blocks  604  through  618  may analyze the data at each checkpoint to attempt to identify a bottleneck. The analysis from blocks  620  through  630  may attempt to identify bottlenecks by comparing two checkpoint data streams to each other. 
         [0130]    For each checkpoint in block  620 , the curve of the current checkpoint is compared to the curve of the previous, upstream checkpoint in block  622 . The comparison in block  622  may compare the slope of one checkpoint dataset to the slope of a second checkpoint dataset. In such embodiments, a diverging slope may indicate that a later checkpoint contains a bottleneck with respect to the previous checkpoint. 
         [0131]    In other embodiments where the curve fitting is a more complex expression, the comparison may detect whether both checkpoint curves are offset or parallel to each other. Diverging data sets may indicate that the later checkpoint may contain a bottleneck with respect to the earlier checkpoint. 
         [0132]    When the difference between the two curves is not significant in block  624 , the current checkpoint may not be considered as a bottleneck in block  626 . 
         [0133]    When the difference between the two curves is significant in block  624 , the current checkpoint may be considered to have a bottleneck in block  628 , and the checkpoint may be labeled as a bottleneck in block  630 . 
         [0134]      FIG. 7  is a flowchart illustration of an embodiment  700  showing an iterative method for detecting bottlenecks from a running application. The operations of embodiment  700  may illustrate one method that may be performed by the tracer manager  240  of embodiment  200 . 
         [0135]    Other embodiments may use different sequencing, additional or fewer steps, and different nomenclature or terminology to accomplish similar functions. In some embodiments, various operations or set of operations may be performed in parallel with other operations, either in a synchronous or asynchronous manner. The steps selected here were chosen to illustrate some principles of operations in a simplified form. 
         [0136]    Embodiment  700  is an example of an iterative method to identify a bottleneck with a high degree of specificity. Embodiment  700  is an example of a method by which a relatively small number of checkpoints may be spread through an application, and when a bottleneck is detected between two of the checkpoints, another set of checkpoints may be placed in the area of the application between the checkpoints and the process may be repeated. 
         [0137]    The method of embodiment  700  may iterate repeatedly to find a bottleneck with a high degree of specificity. Such specificity may be at the level of a single function call or even a specific line of an application, depending on the embodiment. 
         [0138]    In block  702 , an application may be received. The application may be analyzed in block  704  to identify checkpoints, and the checkpoints may be added to the application in block  706 . 
         [0139]    In some embodiments, the checkpoints in block  704  may be ‘natural’ locations in an application where a checkpoint may be relevant. Examples of such locations may be at function calls or other points within the application. In other embodiments, the checkpoints may be identified by merely spacing the checkpoints within the application code by a predefined number of instruction lines or some other method. 
         [0140]    The application may begin execution in block  708  and data may start to be collected. In block  710 , a load may be applied, which may be an artificial load or a natural load in a production system. 
         [0141]    The checkpoint data may be analyzed to identify a bottleneck in block  712 . In some cases, the application may be driven with ever increasing loads until a bottleneck becomes apparent. 
         [0142]    If the bottleneck is identified in block  712  but the bottleneck is not identified with enough specificity in block  714 , an additional set of checkpoints may be determined in block  718  and added to the application in block  720 . The older checkpoints may be removed or turned off in block  722 , and the process may return to block  708  to iterate again. 
         [0143]    The iterations may continue with smaller and smaller spacing between checkpoints until the bottleneck is defined with sufficient specificity in block  714 , at which point the iterations may stop and the bottleneck may be identified for the developer in block  716 . 
         [0144]    The foregoing description of the subject matter has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the subject matter to the precise form disclosed, and other modifications and variations may be possible in light of the above teachings. The embodiment was chosen and described in order to best explain the principles of the invention and its practical application to thereby enable others skilled in the art to best utilize the invention in various embodiments and various modifications as are suited to the particular use contemplated. It is intended that the appended claims be construed to include other alternative embodiments except insofar as limited by the prior art.