Systems and methods for graphically filtering code call trees

Abstract

In an embodiment, a method includes accessing a call tree for a transaction, wherein the call tree traces routines called during execution of the transaction. The method further includes generating a graphical representation of the call tree in relation to two or more performance properties. In addition, the method includes causing the graphical representation of the call tree to be displayed. Further, the method includes allowing a user to graphically select a group of routines from the graphical representation of the call tree. In addition, the method includes creating a filtered call tree comprising the graphically selected group of routines. Furthermore, the method includes generating a drill-down visualization of the filtered call tree. The method also includes causing the drill-down visualization to be displayed.

Description

BACKGROUND

Technical Field

The present disclosure relates generally to data analysis and more particularly, but not by way of limitation, to systems and methods for graphical filtering code call trees.

History of Related Art

Modern web applications process millions of transactions per day and can include multiple redundant layers. When a problem occurs, it can be difficult to trace the problem to a cause. Typical reports and alerts regarding transactions are complex and do not adequately indicate a root cause of poor-performing transactions.

Moreover, as the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.

SUMMARY OF THE INVENTION

In an embodiment, a method is performed by a computer system. The method includes accessing a call tree for a transaction, wherein the call tree traces routines called during execution of the transaction. The method further includes generating a graphical representation of the call tree in relation to two or more performance properties. In addition, the method includes causing the graphical representation of the call tree to be displayed. Further, the method includes allowing a user to graphically select a group of routines from the graphical representation of the call tree. In addition, the method includes creating a filtered call tree comprising the graphically selected group of routines. Furthermore, the method includes generating a drill-down visualization of the filtered call tree. The method also includes causing the drill-down visualization to be displayed.

In an embodiment, an information handling system includes at least one processor, wherein the at least one processor is operable to implement a method. The method includes accessing a call tree for a transaction, wherein the call tree traces routines called during execution of the transaction. The method further includes generating a graphical representation of the call tree in relation to two or more performance properties. In addition, the method includes causing the graphical representation of the call tree to be displayed. Further, the method includes allowing a user to graphically select a group of routines from the graphical representation of the call tree. In addition, the method includes creating a filtered call tree comprising the graphically selected group of routines. Furthermore, the method includes generating a drill-down visualization of the filtered call tree. The method also includes causing the drill-down visualization to be displayed.

In an embodiment, a computer-program product includes a non-transitory computer-usable medium having computer-readable program code embodied therein to implement a method. The method includes accessing a call tree for a transaction, wherein the call tree traces routines called during execution of the transaction. The method further includes generating a graphical representation of the call tree in relation to two or more performance properties. In addition, the method includes causing the graphical representation of the call tree to be displayed. Further, the method includes allowing a user to graphically select a group of routines from the graphical representation of the call tree. In addition, the method includes creating a filtered call tree comprising the graphically selected group of routines. Furthermore, the method includes generating a drill-down visualization of the filtered call tree. The method also includes causing the drill-down visualization to be displayed.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete understanding of the method and apparatus of the present disclosure may be obtained by reference to the following Detailed Description when taken in conjunction with the accompanying Drawings wherein:

FIG. 1 illustrates a system for generating and performing analysis of end-to-end response times.

FIG. 2 illustrates an example data flow using the system of FIG. 1.

FIG. 3 illustrates an example of a process for graphically filtering a code call tree.

FIGS. 4A-B and 5-7 illustrate an example of applying a process similar to the process of FIG. 3.

DETAILED DESCRIPTION

In various embodiments, a performance-monitoring system can track and trace end-user (EU) transactions. The performance-monitoring system can produce and store, for example, an end-to-end (E2E) response time for each EU transaction. An EU transaction, as used herein, is initiated by an EU request such as, for example, a web request, includes subsequent processing of the request by a backend-computing system, and is concluded by a web response from the backend-computing system. EU transactions can cross multiple nodes such as, for example, a web browser, a web server, an application server, a database, one or more external services, etc. Additionally, EU transactions can include execution of numerous routines by a distributed software application. Thus, an E2E response time can include, for example, a time elapsed from initiation through conclusion of an EU transaction.

One way to troubleshoot slow transaction performance is to analyze a code call tree. In general, each node in a code call tree corresponds to a particular routine of a software application. As used herein, the term “routine,” in addition to having its broad ordinary meaning, can include procedural routines, object-oriented routines, functions, methods, components, modules, combinations of the same, and/or the like. Each node in a call tree can have a number of performance properties such as, for example, an exclusive execution time, number of calls to the routine, a corresponding application name, a corresponding package name, a corresponding class name, combinations of same, and/or the like. Although code call trees can include an extensive amount of information usable for troubleshooting, their size and complexity can impede effective analysis. For example, code call trees may include many thousands of lines.

One way to address the size and complexity of a code call tree is to produce a top-N list. The top-N list can include information related to most important routines, most-called routines, top routines by exclusive execution time, combinations of same, and/or the like. The size and complexity of the code call tree can also be addressed by filtering the code call tree by a single variable such as, for example, a start time range, exclusive execution time, etc. However, in general, using this approach, users would be unaware of relationships between data contained in the code call tree. Approaches such as top-N lists and single-variable filtering could also result in important data being excluded, vast amounts of unimportant data obfuscating true trouble spots, etc.

The present disclosure describes examples of graphically filtering a code call tree. In certain embodiments, a graphical representation of the code call tree can be generated and displayed to a user. In various cases, the user can be allowed to view the graphical representation and, based thereon, graphically select a group of one or more routines of the call tree. For example, in some implementations, the user can draw a box around the group of routines using a mouse, tablet, or touch screen. In certain embodiments, a filtered call tree can be created based, at least in part, on the user's graphical selection. The filtered call tree can be used to generate a drill-down visualization that provides a zoomed-in view of the graphically selected group of routines (e.g., a graph that includes a higher level of granularity relative to the graphically selected group of routines).

Advantageously, in certain embodiments, graphical selection of groups of routines as described herein can enable users to more adeptly and efficiently attain access to information about computer performance. For example, the generated graphical representations described herein, in conjunction with the graphical selection enabled herein, can expose relationships between routines, performance properties, and other factors. In this fashion, routines causing poor computing performance can be more efficiently identified.

For purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, calculate, determine, classify, process, transmit, receive, retrieve, originate, switch, store, display, communicate, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an information handling system may be a personal computer (e.g., desktop or laptop), tablet computer, mobile device (e.g., personal digital assistant (PDA) or smart phone), server (e.g., blade server or rack server), a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, ROM, and/or other types of nonvolatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, touchscreen and/or a video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.

FIG. 1 illustrates an example of a system 100 for generating and performing analysis of code call trees. The system 100 includes at least one EU information handling system 102 communicating with a backend-computing system 110 over a network 106. The at least one EU information handling system 102 has a client application 104 such as, for example, a web-browser application, resident and executing thereon. The network 106 may include, for example, a public intranet, a private intranet, and/or the Internet. The system 100 further includes a monitoring system 118, an EU archive system 126, and an administrative system 140. The backend-computing system 110, the monitoring system 118, and the EU archive system 126 are operable to communicate over a network 132. Like the network 106, the network 132 may be representative, for example, of a public or private intranet or the Internet. In addition, the system 100 includes a data collector 108.

For illustrative purposes, the backend-computing system 110 is shown to utilize a three-tier architecture that includes a presentation tier 116, a logic tier 114, and a data tier 112. The presentation tier 116 includes at least one information server 138 such as, for example, a web server, that serves content to be rendered by the client application 104. The logic tier 114 includes at least one application server 136 that operates a platform based on, for example, Java EE, ASP.NET, PHP, ColdFusion, Perl, and/or the like. The data tier 112 includes at least one database 134 that further includes, for example, data sets and a database management system that manages and provides access to the data sets.

It should be appreciated that, in various embodiments, the backend-computing system 110 may include any number of tiers. In addition, in various embodiments, the backend-computing system 110 may implement various alternative architectures such as, for example, a model-view-controller architecture. It should also be appreciated that the at least one application server 136 and the at least one information server 138 are shown separately in FIG. 1 only for purposes of illustrating logically-related functionality. In various embodiments, the at least one application server 136 and the at least one information server 138 are combined into a single server that functions as web server and application server.

The backend-computing system 110 executes one or more distributed software applications such as, for example, a web application, from which backend-performance data is collected. Backend-performance data, as used herein, refers to data collected during runtime of a software application such as, for example, a web application, through instrumentation of the software application. In a typical embodiment, the one or more distributed software applications have been instrumented to provide the backend-performance data. Each of the one or more distributed software applications may be, for example, a collection of software components or services that make up an application stack. In various embodiments, the backend-computing system 110 may use an agent resident thereon to collect the backend-performance data.

The backend-performance data can include, for example, metrics related to infrastructure components (virtual or physical) such as, for example, the at least one database 134, the at least one application server 136, and the at least information server 138. The backend-performance data can also include metrics related to each routine of a software application that is executed. The backend-performance data can further include aggregated metrics related to infrastructure tiers such as, for example, the presentation tier 116, the logic tier 114, and the data tier 112. In addition, the backend-performance data can include metrics related to the application stack for each of the one or more distributed software applications. In a typical embodiment, the backend-performance data can trace EU transactions through a topology of nodes that can include, for example, infrastructure components, infrastructure tiers, and/or application-stack components as described above. Metrics can include, for example, execution time at each tier or by each component or node. Examples of how backend-performance data can collected and managed is described in detail in U.S. Pat. No. 7,979,245 and U.S. Pat. No. 8,175,863, each of which is hereby incorporated by reference.

More particularly, the backend-performance data can include information related to each routine of a software application that is executed on the backend-computing system 110 in connection with an E2E transaction. For example, the backend-performance data can trace the execution of the software application through each routine thereof to yield, for example, information related to execution times, a number of exceptions, a number of incomplete executions, a total number of calls to the routine during the E2E transaction, combinations of same, and/or the like. The information related to execution times can include an exclusive execution time, a total execution time, etc. In particular embodiments, the exclusive execution time can include time spent executing a particular routine, excluding time spent executing child routines called by the particular routine. In particular embodiments, the total execution time can include time spent executing the particular routine, inclusive of time spent executing child routines called by the particular routine. In various cases, the backend-performance data can be supplemented with statistical data related to any of the foregoing such as totals, averages, minimums, maximums, combinations of same, and/or the like. Also, in certain embodiments, the backend performance data can further include other performance properties such as a name of each routine, a type of the routine, etc.

The data collector 108 is a software component that collects EU-experience data for the at least one EU information handling system 102. EU-experience data, as used herein, refers to data collected through observation of one or more transactions from an EU perspective. In a typical embodiment, the data collector 108 is situated in the system 100 such that the data collector 108 is capable of seeing all network traffic (i.e., all packets exchanged) between the at least one EU information handling system 102 and the backend-computing system 110. In this fashion, the data collector 108 functions as a packet analyzer and is operable to extract the EU-experience data and transmit the EU-experience data to the EU archive system 126. The EU archive system 126 includes at least one server computer 128 and at least one database 130. The EU archive system 126 receives the EU-experience data from the data collector 108 and stores the EU-experience data in the at least one database 130. An example of how EU-experience data can be collected is described in U.S. Pat. No. 7,941,385. U.S. Pat. No. 7,941,385 is hereby incorporated by reference.

As illustrated, the data collector 108 can reside at various nodes in the system 100. For example, the data collector 108 can reside on the backend-computing system 110 between the presentation tier 116 and the logic tier 114. The data collector 108 can also be resident on the backend-computing system 110 between the presentation tier 116 and the network 106. In addition, in various embodiments, the data collector 108 is representative of client-side scripting that is executed on the at least one EU information handling system 102. In this fashion, the data collector 108 can also be resident on the at least one EU information handling system 102. It should be appreciated that other locations for the data collector 108 such as, for example, within the presentation tier 116, are also contemplated.

The monitoring system 118 includes at least one server computer 120 and at least one database 122. The at least one server computer 120 is operable to execute a correlator 124. The correlator 124 is typically a software component that correlates the EU-experience data maintained by the EU archive system 126 with the backend-performance data maintained by the monitoring system 118 to yield E2E response times for EU transactions. In many cases, the monitoring system 118, the at least one server computer 120, and/or the at least one database 122 can be or be implemented on information handling systems. Example operation of the system 100 will be described with respect to FIG. 2.

The administrative system 140 includes a reporting module 142. The administrative system 140 can include any number of server computers and/or databases. The reporting module 142 can include hardware and/or software for generating and/or presenting alerts, reports, and/or the like based on data stored or generated by the monitoring system 118 and the EU archive system 126. The reports and/or alerts can be served to an administrative user using, for example, an information handling system similar to the EU information handling system 102. For example, in certain embodiments, the reporting module 142 can facilitate graphical filtering of a code tree as described with respect to FIGS. 3-7.

One of ordinary skill in the art will appreciate that each instance of a computer or computer system as described above may be representative of any number of physical or virtual server computers. Likewise, each instance of a database may be representative of a plurality of databases. In addition, it should be appreciated that, in various embodiments, each instance of a network such as, for example, the network 106 or the network 132, can be viewed as an abstraction of multiple distinct networks. For example, the network 106 and the network 132 can each include one or multiple communications networks such as, for example, public or private intranets, a public switch telephone network (PSTN), a cellular network, the Internet, or the like. In addition, in various embodiments, the network 106 and the network 132 may overlap or refer to a same network.

FIG. 2 illustrates an example data flow 200 using the system 100 of FIG. 1. The EU information handling system 102 initiates a transaction by directing a request such as, for example, an HTTP request, to the at least one information server 138 of the presentation tier 116. The at least information server 138 forwards the request to an appropriate application server, i.e., the at least one application server 136, for handling. The at least one application server 136 generates an identifier (e.g., a UUID) for the transaction. In a typical embodiment, the backend-computing system 110 uses the identifier to identify backend-performance data collected during processing of the transaction, which data is stored by the monitoring system 118 as described above.

A monitoring agent on the at least one application server 136 injects the identifier in a response to the request (i.e., a UUID-injected response), which response is directed to the at least one EU information handling system 102 along a transmission path that includes that at least one information server 138 and the at least one EU information handling system 102. In this fashion, no modification of application code is required to inject the identifier. Rather, the monitoring agent, which is already being utilized for existing instrumentation of the distributed software application, injects the identifier into the response. The response may be a web response such as, for example, an HTTP response. In various embodiments, the identifier can be injected, for example, into a response header for the response. In some embodiments, the identifier may be inserted into a cookie that is sent as part of the response header. Content of the UUID-injected response is rendered on the at least one EU information handling system 102 via the client application 104.

As noted above, the data collector 108 is situated on the system 100 so that the data collector 108 can observe all network traffic exchanged between the backend-computing system 110 and the EU information handling system 102. Therefore, the data collector 108 is effectively a transparent node along the transmission path. The data collector 108 passively observes the UUID-injected response and uses the identifier to identify EU-experience data that is collected.

The correlator 124 is operable to extract EU-experience data not previously obtained by the correlator (i.e., new EU-experience data) from the EU archive system 126. In various embodiments, the correlator 124 may operate on a periodic basis, on-demand, or in real-time. The correlator 124 is operable to correlate the EU-experience data and the backend-performance data that relates to a same transaction (i.e., a same request and response) by cross-referencing identifiers. In this manner, data resulting from instrumentation (the backend-performance data) and the EU-experience data, which is typically collected without instrumentation, can be correlated. The correlated data can be stored in the at least one database 122. The correlated data can also be used to generate E2E response times for end-user transactions. In addition, on a periodic basis (e.g., every five minutes) or on demand, the correlator 124 may aggregate the correlated data into one or more high-level transaction categories such as, for example, log-in, search, or checkout. Therefore, problems with particular transaction categories can be readily identified and appropriate alerts generated.

FIG. 3 illustrates an example of a process 300 for graphically filtering a code call tree. In various embodiments, the process 300 can be performed for an EU transaction selected by user or computer system, an aggregation of EU transactions, combinations of same, and/or the like. For simplicity of description, the process 300 will be described for a single EU transaction. For example, the process 300, in whole or in part, can be implemented by one or more of the monitoring system 118, the correlator 124, the EU archive system 126, the administrative system 140, the reporting module 142, and/or the EU information handling system 102. The process 300 can also be performed generally by the system 100. Although any number of systems, in whole or in part, can implement the process 300, to simplify discussion, the process 300 will be described in relation to specific systems or subsystems of the system 100.

At block 302, the reporting module 142 access a call tree for a transaction. As described above, the call tree generally traces routines that are called during the execution of the transaction. At block 304, the reporting module 142 generates a graphical representation of the call tree. The graphical representation can take various forms such as, for example, a graphical plot of the routines of the call tree in relation to two or more performance properties. For example, the graphical representation can illustrate a change in the two or more performance properties for each of the routines of the call tree.

At block 305, the reporting module causes the graphical representation to be displayed on an EU computing device. For example, the block 305 can include transmitting, publishing, or otherwise making the graphical representation available over a network such as the network 106 and/or the network 132. At block 306, the reporting module 142 enables a user to graphically interact with the graphical representation. For example, in various embodiments, the user can be allowed to draw a box around or otherwise graphically select a group of routines from the graphical representation of the call tree. At decision block 308, the reporting module 142 determines whether a group of routines has been graphically selected by the user. If not, the process 300 returns to block 306 and proceeds as described above. Otherwise, if it is determined at decision block 308 that a group of routines has been graphically selected by the user, the process 300 proceeds to block 310.

At block 310, the reporting module 142 creates a filtered call tree that includes the graphically selected group of routines. In some embodiments, the block 310 can include automatically identifying one or more additional routines based, at least in part, on an analysis of the graphically selected routines and of the call tree. For example, in certain embodiments, immediate parents and/or immediate children of each of the graphically selected group of routines can be automatically identified and included in the filtered call tree. In a typical embodiment, an immediate parent of a given routine is a routine from which the given routine is called. In a typical embodiment, an immediate child of a given routine is routine that is called within the given routine.

At block 312, the reporting module 142 generates a drill-down visualization of the filtered call tree. In general, the drill-down visualization can provide a zoomed-in view of the routines of the filtered call tree. For example, the drill-down visualization can provide additional information regarding one or more performance properties related to the routines of the filtered call tree.

At block 314, the reporting module 142 causes the drill-down visualization to be displayed. In certain embodiments, the block 314 can include functionality similar to that which is described above with respect to block 305. From block 314, the process 300 returns to block 306. In certain embodiments, the reporting module 142 allows multiple levels of granularity so that the user can continue, in effect, to zoom-in on routines of the call tree (and filtered versions thereof). In some embodiments, the user can generate one, two, three, four, or any other suitable number of drill-down visualizations. In certain embodiments, a predefined number (e.g., two) can be established such that once the predefined number of drill-down visualizations have been generated and displayed, the process 300 ends. The process 300 can also end when terminated by the user, an administrator, or if other suitable termination criteria is satisfied.

FIGS. 4A-B and 5-7 illustrate an example of applying a process similar to the process 300 of FIG. 3. In particular, FIG. 4A illustrates an example of a call tree 400 that can be accessed, for example, as described with respect to block 302 of FIG. 3. FIG. 4B illustrates an example of a graphical representation 450 of the call tree 400. In particular, the graphical representation 450 can be generated and caused to be displayed as described with respect to blocks 304 and 305, respectively, of FIG. 3.

More specifically, the graphical representation 450 is a graphical plot of the routines of the call tree 400 in relation to three performance properties. A y-axis of the graphical representation 450 illustrates an exclusive execution time of each of the routines of the call tree 400. An x-axis of the graphical representation 450 illustrates a point on an overall timeline for a transaction at which each of the plotted routines was called. The overall timeline can, in some cases, correspond to an E2E response time. In addition, a shading, color, shape or other indication relative to each of the plotted routines can indicate whether each plotted routine corresponds to a JAVA method, JAVA Naming and Directory Interface (JNDI), database, web client, servlet, combinations of same, and/or the like.

FIG. 5 illustrates an example of graphical interaction with the graphical representation 450 of FIG. 4B. In particular, as illustrated, the user has graphically selected a group of routines 502. For example, the graphically selected group of routines 502 can result from the block 306 of FIG. 3.

FIG. 6 illustrates an example of a drill-down visualization 600 that can result from the graphically selected group of routines 502. In various embodiments, the drill-down visualization 600 can be a visualization of a filtered call tree that is created, for example, as described with respect to block 310 of FIG. 3. The drill-down visualization 600 can be generated and caused to be displayed as described, for example, with respect to blocks 312 and 314, respectively, of FIG. 3.

More particularly, the drill-down visualization 600 is an example of a heat map of the filtered call tree. The routines of the filtered call tree are listed along an y-axis of the drill-down visualization 600. A transaction timeline is illustrated along a x-axis of the drill-down visualization 600. As shown, the drill-down visualization 600 graphically indicates a number of calls to each routine of the filtered call tree (e.g., via darker shading or denser stippling for greater numbers of calls), along with each routine's exclusive execution time relative to the transaction timeline (e.g., via a length of each horizontal bar). In addition, as described with respect to FIG. 3, in certain embodiments, multiple levels of drill-down visualization can be generated and displayed. For example, as illustrated in FIG. 6, a user has graphically selected a group of routines 602 for an additional drill-down visualization.

FIG. 7 illustrates an example of a drill-down visualization 700 that can result from the graphically selected group of routines 602 of FIG. 6. In various embodiments, the drill-down visualization 700 can be a visualization of another filtered call tree that is created, for example, during another iteration of the block 310 of FIG. 3. The drill-down visualization 700 can be generated and caused to be displayed as described, for example, with respect to blocks 312 and 314, respectively, of FIG. 3.

The drill-down visualization 700 is an example of a histogram that graphically indicates a distribution of routine-call counts for particular types of routines over particular intervals of the transaction timeline. More particularly, for each interval illustrated in the drill-down visualization 700, a vertical bar indicates a total number of routine calls per second over that interval for the graphically selected group of routines 602. A shading, color or other designation within each vertical bar can further indicate a proportion of the total number of routine calls per second (for that interval) that is attributable to particular categories of routines such as, for example, routines corresponding to a JAVA method, JAVA Naming and Directory Interface (JNDI), database, web client, servlet, combinations of same, and/or the like.

Although various embodiments of the method and apparatus of the present invention have been illustrated in the accompanying Drawings and described in the foregoing Detailed Description, it will be understood that the invention is not limited to the embodiments disclosed, but is capable of numerous rearrangements, modifications and substitutions without departing from the spirit of the invention as set forth herein.

Claims

1. A method comprising, by a computer system: accessing a code call tree for an end-user transaction, wherein the code call tree traces routines called during execution of the end-user transaction, wherein each node in the code call tree corresponds to a particular routine of a software application;generating a graphical representation of the code call tree in relation to two or more performance properties;causing the graphical representation of the code call tree to be displayed;allowing a user to graphically select a group of routines from the graphical representation of the code call tree;creating a filtered code call tree comprising the graphically selected group of routines;generating a drill-down visualization of the filtered code call tree;wherein the drill-down visualization comprises a heat map of the filtered code call tree, the heat map graphically indicating a number of calls to each routine of the filtered code call tree; andcausing the drill-down visualization to be displayed.

2. The method of claim 1, wherein the graphical representation comprises a plot of the routines of the code call tree in relation to the two or more performance properties.

3. The method of claim 1, wherein the creating of the filtered code call tree comprises automatically identifying one or more additional routines based, at least in part, on an analysis of the code call tree, the filtered code call tree comprising the one or more additional routines.

4. The method of claim 3, wherein the one or more additional routines comprise routines that, in the code call tree, are immediate parents of one or more of the graphically selected group of routines.

5. The method of claim 3, wherein the one or more additional routines comprise routines that, in the code call tree, are immediate children of one or more of the graphically selected group of routines.

6. The method of claim 1, comprising: allowing the user to graphically select a subsequent group of routines from the drill-down visualization;creating a subsequent filtered code call tree comprising the graphically selected subsequent group of routines;creating a subsequent drill-down visualization of the subsequent filtered code call tree; andcausing the subsequent drill-down visualization to be displayed.

7. The method of claim 6, wherein the subsequent drill-down visualization comprises a histogram of routine call counts.

8. The method of claim 1, wherein the two or more performance properties comprise, for each routine of the routines: a point on a transaction timeline at which the routine was called;information related to an execution time of the routine; andinformation related to a property of the routine.

9. The method of claim 8, wherein the information related to an execution time of the routine comprises an exclusive execution time of the routine.

10. An information handling system comprising: at least one processor, wherein the processor is operable to implement a method comprising:accessing a code call tree for an end-user transaction, wherein the code call tree traces routines called during execution of the end-user transaction, wherein each node in the code call tree corresponds to a particular routine of a software application;generating a graphical representation of the code call tree in relation to two or more performance properties;causing the graphical representation of the code call tree to be displayed;allowing a user to graphically select a group of routines from the graphical representation of the code call tree;creating a filtered code call tree comprising the graphically selected group of routines;generating a drill-down visualization of the filtered code call tree;wherein the drill-down visualization comprises a heat map of the filtered code call tree, the heat map graphically indicating a number of calls to each routine of the filtered code call tree; andcausing the drill-down visualization to be displayed.

11. The information handling system of claim 10, wherein the graphical representation comprises a plot of the routines of the code call tree in relation to the two or more performance properties.

12. The information handling system of claim 10, wherein the creating of the filtered code call tree comprises automatically identifying one or more additional routines based, at least in part, on an analysis of the code call tree, the filtered code call tree comprising the one or more additional routines.

13. The information handling system of claim 12, wherein the one or more additional routines comprise routines that, in the code call tree, are immediate parents of one or more of the graphically selected group of routines.

14. The information handling system of claim 12, wherein the one or more additional routines comprise routines that, in the code call tree, are immediate children of one or more of the graphically selected group of routines.

15. The information handling system of claim 10, the method comprising: allowing the user to graphically select a subsequent group of routines from the drill-down visualization;creating a subsequent filtered code call tree comprising the graphically selected subsequent group of routines;creating a subsequent drill-down visualization of the subsequent filtered code call tree; andcausing the subsequent drill-down visualization to be displayed.

16. The information handling system of claim 15, wherein the subsequent drill-down visualization comprises a histogram of routine call counts.

17. The information handling system of claim 10, wherein the two or more performance properties comprise, for each routine of the routines: a point on a transaction timeline at which the routine was called;information related to an execution time of the routine; andinformation related to a property of the routine.

18. The information handling system of claim 17, wherein the information related to an execution time of the routine comprises an exclusive execution time of the routine.

19. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising: accessing a code call tree for an end-user transaction, wherein the code call tree traces routines called during execution of the end-user transaction, wherein each node in the code call tree corresponds to a particular routine of a software application;generating a graphical representation of the code call tree in relation to two or more performance properties;causing the graphical representation of the code call tree to be displayed;allowing a user to graphically select a group of routines from the graphical representation of the code call tree;creating a filtered code call tree comprising the graphically selected group of routines;generating a drill-down visualization of the filtered code call tree;wherein the drill-down visualization comprises a heat map of the filtered code call tree, the heat map graphically indicating a number of calls to each routine of the filtered code call tree; andcausing the drill-down visualization to be displayed.