BACKGROUND

This disclosure relates to analysis of instrumented software systems in general and more specifically to determining characteristics of servers based on data streams received from instrumented software executing on servers.

Software developers monitor different aspects of software they develop by instrumenting the code. These include performance of the software, errors encountered during execution of the software, significant events encountered during execution of the software, information describing which parts of code are being executed and which parts are not being executed, and so on. Instrumentation of software executing in large enterprises results in generation of large amounts of data. Analysis of this data is typically performed by experts and can take significant amount of time. For example, if a problem occurs in one or more servers, analysis of the data to identify the problem can take days or weeks. Conventional techniques are often unable to process the data received from the instrumented software in reasonable time to be able to detect problems in systems executing the software to be able to take fast and appropriate action. Furthermore, conventional techniques often do not provide high level information that identifies problems with systems executing the software and information useful for taking appropriate action for addressing a problem identified.

SUMMARY

Embodiments of an instrumentation analysis system analyze servers providing data streams generated by instrumented software executing on the servers. The instrumentation analysis system stores values of attributes describing the servers. An attribute of a server may represent data received as a data stream from the server. For example, an attribute may represent resource utilization of a server, for example, memory utilization, CPU (central processing unit) utilization, disk utilization, or utilization of any other resource. An attribute may represent metadata describing the server specified independent of the data streams. For example, the attribute may store information describing a data center associated with the server, a group of user accounts associated with the server, and so on. The instrumentation analysis system receives a filtering criterion based on an attribute representing resource utilization of servers. For example, the filtering criterion may identify servers having excessive memory utilization or servers having low CPU utilization. The instrumentation analysis system identifies a filtered set of servers satisfying the filtering criterion. The instrumentation analysis system selects a plurality of properties of the filtered set of servers. The instrumentation analysis system determines a score for each selected property. The score represents a measure indicative of a strength by which the property distinguishes servers of the filtered set from remaining servers. In an embodiment, the score is determined based on a comparison of the likelihood that a server from the filtered set has the property with the likelihood that a server outside the filtered set has the property. The instrumentation analysis identifies a characteristics property based on the score. The characteristic property distinguishes the filtered set of servers from the remaining servers. The instrumentation analysis system reports the identified property, for example, by sending an alert to a user account or providing information describing the characteristic property via a user interface.

The features and advantages described in the specification are not all inclusive and in particular, many additional features and advantages will be apparent to one of ordinary skill in the art in view of the drawings, specification, and claims. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the disclosed subject matter.

