Combining Visualization and Statistical Analysis to Improve Operator Confidence and Efficiency for Failure Detection and Localization

Abstract

Web applications suffer from software and configuration faults that lower their availability. Recovering from failure is dominated by the time interval between when these faults appear and when they are detected by site operators. We introduce a set of tools that augment the ability of operators to perceive the presence of failure: an automatic anomaly detector scours HTTP access logs to find changes in user behavior that are indicative of site failures, and a visualizer helps operators rapidly detect and diagnose problems. Visualization addresses a key question of autonomic computing of how to win operators' confidence so that new tools will be embraced. Evaluation performed using HTTP logs from Ebates.com demonstrates that these tools can enhance the detection of failure as well as shorten detection time. Our approach is application-generic and can be applied to any Web application without the need for instrumentation.

Guided Problem Diagnosis through Active Learning

“…Fa then characterizes the deviation of F from these healthy states to pinpoint the probable cause of the failure. Similar approaches have been proposed by other researchers, e.g., [3,8].…”

“…[7] applies Bayesian-network learning techniques to correlate performance metrics with high-level system behavior. Reference [3] is a recent example of the baseliningbased approach where a heuristic is proposed to capture and represent the baseline behavior of a Web service; and two techniques-one based on the χ 2 statistical test, and another based on naive Bayesian networks-are proposed to detect and categorize deviation from the baseline behavior. In [2], we describe a new clustering algorithm that pays particular attention to the failure data while clustering the healthy data; see Figure 2(b).…”

Utilizing PCFGs for Modeling and Learning Service Compositions in Sensor Networks

“…Other related error detection techniques utilize logs of the visited internet pages [11], CPU-instructions and function-calls [12], and messaging between components [13]. In sensor networks, [14] examines simple metrics on network performance.…”

Using Runtime Information and Maintenance Knowledge to Assist Failure Diagnosis, Detection and Recovery

“…We believe, however, that human knowledge is still a fundamental part of the diagnosis process, as discussed before, and even if manual work could be partially automated, it cannot be ignored. It is worth mentioning that others, as for instance Bodik et al (2005) and Xu et al (2008), follow the same assumption. Current automated diagnosis techniques are appropriate only for superficial failures, not for those that need internal-logic hypotheses investigation, thus requiring human knowledge to complement the necessary information and determine the root cause.…”

“…Some works (Takada & Koide, 2002;Stearley, 2004;Bodik et al, 2005;Tan et al, 2008) invest in visualization tools to assist manual inspection. These studies aim at solving the visual pollution problem of long log files by condensing the events and generating statistical graphs.…”