Patent Application
20110227925
The present invention relates to a method, system and computer readable article of manufacture for displaying a visualization from an event log. More specifically, the present invention relates to displaying a visualization from an event log showing common sequences and instances of events and transitions between events.
An event is something that has happened in a system, such as an automobile traffic network, a weather system, a manufacturing plant, etc. An event log is a record of events that have occurred. As another example, the development of a complex software or hardware system often benefits from tracing the system to create a log of information about the system's execution, where the execution of each instruction by a processor may be an event; the logs are typically used for debugging and profiling a system. These “event logs” or “trace logs” can become so large that understanding the logs becomes very difficult. Analysis tools may be used to display raw event data. For example, analysis tools can filter events based on their type or show statistics about events.
Accordingly, embodiments of the present invention provide a method, system and computer readable article of manufacture for displaying a visualization from an event log showing common patterns and instances of events and transitions.
In particular, an embodiment of the present invention provides a method of displaying a visualization from an event log. According to the method, common event sequences are extracted from the event log. The event log is a record of a plurality of events that occurred. A sequence graph is generated from the sequences. The sequence graph includes nodes representing the events of the event log and the events of each node have a common property. A sequence graph visualization is displayed from the sequence graph. The sequence graph visualization includes (i) node icons representing the nodes of the sequence graph, (ii) node transition icons representing relationships between nodes, and (iii) for at least one of the nodes, an event icon associated with that node for each of the events that are represented by that node.
In another embodiment, the present invention provides a system for displaying a visualization from an event log. A data storage device may store the event log, wherein the event log is a record of a plurality of events that occurred in a system. A sequence extraction processing module may extract sequences from the event log. A sequence graph generating module may generate a sequence graph from the sequences, based on common features of the sequences, wherein the sequence graph includes nodes representing one or more of the events of the event log. A graphing module may create a sequence graph visualization from the sequence graph, wherein the sequence graph visualization includes (i) node icons representing the nodes of the sequence graph, (ii) node transition icons representing transitions between nodes, and (iii) for at least one of the nodes, an event icon associated with that node for each of the one or more events that are represented by that node. A displaying device may display the sequence graph visualization.
In another embodiment, the present invention provides a computer readable article of manufacture tangibly embodying computer readable instructions which when executed causes a computer to carry out the steps of the above method.
Embodiments of the present invention may be used to display a visualization from an event log showing common patterns, instances of events, and transitions between events. A visualization is a visual representation of information or data, such as a diagram that is output to a computer display relating to a system being monitored, to a simulated system, to historical data about events, etc.
An event log is a record of events that occurred in a system. The system may be a software application running on hardware, but is not limited to only software applications. The system may be anything having a logical sequence between events, such as an automobile traffic network, a weather system, a manufacturing plant, etc. For example, in an automobile network, a car passing a particular sensor may be an event, and at a given time 5 cars might be passing sensors on Main Street, in which case these events all have as a feature in common that they occurred on Main Street. In the example of a manufacturing plant, a determination that there is a defect on part of the line may be an event, with the type of event being “defect.” Event logs can become very long and difficult to analyze depending on the size and complexity of the system. The events in event logs typically have common properties (i.e., features) depending on the complexity of the system. The embodiments of the present invention utilize these common features to construct a visualization useful in analyzing event logs.
In this example, event log records the event (e.g., execute instruction 1001), the type of event (e.g., an ADD instruction), the previous event that occurred (e.g., instruction 1119, which preceded this instance of instruction 1001), and the next event to occur (execute instruction 1002). The fields “PREVIOUS EVENT” and “NEXT EVENT” are added for illustrative purposes; the order of events can usually be recovered from the way these events are stored. In another example, the “event” field may include the time stamp for the execution of that instruction to differentiate it from other executions of that instruction. In an alternative embodiment, the event field may include the event type, the software module in which the event was generated, as well as other information related to the event.
Visual system trace analysis tool 100 is typically embodied as a software application running on a general or special purpose computer system as shown in
The node icons 301, 302 are connected by a node transition icon 303 representing the transitions between nodes represented by the node icons 301, 302. In this example, the node transition icon 303 contains a number reflecting the number of event transitions. Referring to
However, it may be useful for a developer or user to view the individual events from the event log represented by the common sequences 306 shown in the sequence context visualization 140. The event icons 304 represent the constituent events of the node represented by node icon 301. In the example described above, there would be 49 separate event icons 304, each shown as a separate vertical line, because node icon 301 represents 49 separate constituent events. In this example, each event icon 304 represents one instance of the event BR IEAVWUQA. In an embodiment, each event icon is displayed in a manner such that the event icon is shown as associated with the node icon. For example, the event icons 304 may be located within or approximate the node icon 301 in order to show that the event icons 304 represent constituent events of the node represented by the node icon 301. The user may move a pointer over any of the event icons 304 to see details for each event in a tool tip 307. The event icons 304 may be displayed or hidden by expanding or collapsing the node 301. The displaying or hiding of event icons may be controlled by a first and second input from a user. For example, in the embodiment shown in
The maximum metric magnitude that corresponds to the maximum visual state of the visual characteristic 604 may also be varied by a user. For example, if the maximum visual state of the visual characteristic 604 is red or a full colored portion of the event icon, then this may be varied to correspond with 10 microseconds of elapsed time or 10 seconds of elapsed time. This allows the user to compare the event metrics of events that are on different orders of magnitude. For example, if the elapsed time for some events was on the order of 1 second and the elapsed time for other events was on the order of 1 microsecond, then it would be hard to compare events that are in a similar range of metric magnitude (e.g. an event with an elapsed time of 5 microseconds and a second event with an elapsed time of 7 microseconds) if the visual characteristic 604 corresponded to the full range from microseconds to seconds.
The node icons 301 may also have a visual characteristic 601 representing the average magnitude of event metrics for each of the constituent events within the node represented by the node icon 301. In a preferred embodiment, the height of the colored portion of the node icon 301 indicates the average magnitude of event metrics for each of its constituent events. In yet another embodiment, other mathematical functions in addition to the average magnitude of event metrics may be used.
The transition icons 303 may have a transition icon characteristic 603 representing a transition property. For example, the transition icon characteristic 603 may be that the transition icon 303 is dotted or dashed. Examples of a transition property include an event thread change or an elapsed time but are not limited to such.
An event flow view 701 shows the events of the event log ordered from top to bottom to show the logical order of events in the trace. In embodiments, each event in the event log is represented by a colored rectangle. The event rectangles may be colored according to their component and positioned horizontally according to the module of the event. The events may be categorized horizontally by address location and process space. Detailed information about the events may be viewed by moving a pointer over an event. A user may also zoom in to regions within the event flow view 701 in order to reveal more details for each event. For example, in the zoomed in view the user can see a white vertical marker within each event rectangle. The horizontal position of the marker relative to the event rectangle indicates which part of the code in the module was executed.
A statistical view 702 may be included to show the events sorted by event type in descending order of frequency. The summary nodes on the left portion of the statistics view 702 each represent a group of events of a certain type. The event icons to the right of each summary node represent the individual events ordered chronologically from left to right. The bars representing individual events in the statistics view 702 may contain a visual characteristic just as the event icons in the sequence graph visualization 703. The visual characteristic, such as color or height, represent elapsed time. The summary nodes can be expanded or collapsed to show or not show the event icons. Further, the summary nodes can be partitions by event type, event subtype, modules, object module, offset, etc.
As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.
Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
Aspects of the present invention are described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks. The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
The CPU 801 may operate on the basis of programs stored in the ROM and RAM so as to control each component. The graphic controller 805 may acquire image data generated by the CPU 801 or the like on a frame buffer provided in the RAM and displays the acquired image data on display unit 105. Alternatively, the graphic controller 805 may include a frame buffer for storing image data generated by the CPU 801 or the like.
A program may be installed into the visual system trace analysis tool 100 and intended to cause it to function as the system for displaying a visualization from an event log shown in
In other words, when information written in this program is read by the system, the sequence extraction processing module 102, the sequence graph generating module 103, the graphing module 104, and the displaying device 105 are realized as specific means in which software and the above-mentioned various hardware resources collaborate with each other to effect the embodiments of the present invention.
The above-mentioned program or modules may be stored in an external recording medium. Among such recording media are a flexible disk and DVD as well as optical recording media such as a digital versatile disc (DVD) and a compact disc (CD), magneto-optical recording media such as a magneto-optical (MO) disk, tape media, and semiconductor memories such as an IC card. Also, a storage device, such as a hard disk or a random access memory (RAM), provided in a server system connected to a dedicated communication network or the Internet may be used as a recording medium and the above-mentioned program stored in such a storage device may be provided to the system via a network.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
