Unified error monitoring, alerting, and debugging of distributed systems

Patent metadata

Field	Value
Publication number	US-2020201699-A1
Application number	US-201816226405-A
Country	US
Kind code	A1
Filing date	Dec 19, 2018
Priority date	Dec 19, 2018
Publication date	Jun 25, 2020
Grant date	—

Abstract

The disclosed embodiments provide a system for performing unified error monitoring, alerting, and debugging of distributed systems. During operation, the system receives logs of activity within a distributed system over event streams in a distributed streaming platform. Upon identifying an error in the received logs, the system collects, from the event streams, log entries generated within a time window of the error into a contextual log associated with the error. The system then outputs an alert containing metadata for accessing the contextual log.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by one or more computer systems, logs of activity within a distributed system over event streams in a distributed streaming platform; upon identifying an error in the received logs, collecting, by the one or more computer systems from the event streams, log entries generated within a time window of the error into a contextual log associated with the error; and outputting, by the one or more computer systems, an alert comprising metadata for accessing the contextual log.

2 . The method of claim 1 , further comprising:
displaying a representation of the contextual log within a user interface; and updating the displayed representation based on one or more filters specified through the user interface.

3 . The method of claim 2 , wherein the representation of the contextual log comprises at least one of:
a visualization of events represented by the log entries; a visual indication of a potential root cause of the error; and a time-based ordering of the log entries.

4 . The method of claim 2 , wherein the one or more filters comprise at least one of:
a log file name; a host name; a time; a process; a logging source; a class of error; and a duration of execution.

5 . The method of claim 1 , wherein collecting the log entries within the time window of the error into the contextual log associated with the error comprises:
searching the event streams for the log entries that fall within the time window of the error and match an attribute associated with the error; and aggregating the log entries into the contextual log.

6 . The method of claim 5 , wherein collecting the log entries within the time window of the error into the contextual log associated with the error further comprises:
standardizing metadata fields in the log entries prior to aggregating the log entries into the contextual log.

7 . The method of claim 6 , wherein the metadata fields comprise at least one of:
a timestamp; a host name; a cluster name; and a log file name.

8 . The method of claim 5 , wherein the attribute comprises at least one of:
a cluster in which the error was generated; a tree of service calls related to the error; and a session associated with the error.

9 . The method of claim 1 , wherein the log entries comprise:
an application log entry; and a machine state entry.

10 . The method of claim 9 , wherein the machine state entry comprises at least one of:
processes running on a machine; a resource usage; a network status; and a socket status.

11 . The method of claim 1 , wherein the error comprises at least one of:
an exception; a logged error; and a core dump.

12 . The method of claim 1 , wherein the metadata comprises at least one of:
a link to the contextual log; and a path to a location of the contextual log.

13 . A system, comprising:
one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the system to:
receive logs of activity within a distributed system over event streams in a distributed streaming platform;
upon identifying an error in the received logs, collect, from the event streams, log entries generated within a time window of the error into a contextual log associated with the error; and
output an alert comprising metadata for accessing the contextual log.

14 . The system of claim 13 , wherein the memory further stores instructions that, when executed by the one or more processors, cause the system to:
display a representation of the contextual log within a user interface; and update the displayed representation based on one or more filters specified through the user interface.

15 . The system of claim 14 , wherein the representation of the contextual log comprises at least one of:
a visualization of events represented by the log entries; a visual indication of a potential root cause of the error; and a time-based ordering of the log entries.

16 . The system of claim 14 , wherein the one or more filters comprise at least one of:
a log file name; a host name; a time; a process; a logging source; a class of error; and a duration of execution.

17 . The system of claim 13 , wherein collecting the log entries within the time window of the error into the contextual log associated with the error comprises:
searching the event streams for the log entries that fall within the time window of the error and match an attribute associated with the error; standardizing metadata fields in the log entries; and aggregating the log entries into the contextual log.

18 . The system of claim 17 , wherein the metadata fields comprise at least one of:
a timestamp; a host name; a cluster name; and a log file name.

19 . A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:
receiving logs of activity within a distributed system over event streams in a distributed streaming platform; upon identifying an error in the received logs, collecting, from the event streams, log entries generated within a time window of the error into a contextual log associated with the error; and outputting an alert comprising metadata for accessing the contextual log.

20 . The non-transitory computer-readable storage medium of claim 19 , the method further comprising:
displaying a representation of the contextual log within a user interface; and updating the displayed representation based on one or more filters specified through the user interface.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Yu Yan
• Constandache Ionut
• Miller Brent D
• Meyer Scott M
• Arsintescu Bogdan G

Classifications

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/327

  Alarm or error message display · CPC title

• G06F11/0781

  Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level · CPC title

• G06F11/0778

  Dumping, i.e. gathering error/state information after a fault for later diagnosis · CPC title

• G06F11/3086

  where the reporting involves the use of self describing data formats, i.e. metadata, markup languages, human readable formats · CPC title