CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of United States provisional patent application 62/117,902, filed February 18, 2015, entitled "SYSTEM AN D METHOD FOR ANALYZING BIG DATA ACTIVITI ES," hereby incorporated by reference.

FIELD

[0002] The present system and method relate generally to the field of computers, and particularly to a system and method for analyzing big data activities.

BACKGROUND

[0003] Big data systems are very complex. The productivity of application developers and operations staff plummets when they have to constantly track many interdependent factors such as application behavior, resource allocation, data layout, and job scheduling to keep big data applications running. Problems associated with the operation of big data systems becomes hard to identify, diagnose, and fix.

SUMMARY

[0004] A system and method for analyzing big data activities are disclosed. According to one embodiment, a system comprises a distributed file system for the entities and applications, wherein the applications include one or more of script applications, structured query language (SQL) applications, Not Only (NO) SQL applications, stream applications, search applications, and in-memory applications. The system further comprises a data processing platform that gathers, analyzes, and stores data relating to entities and applications. The data processing platform includes an application manager having one or more of a MapReduce Manage, a script applications manager, a structured query language (SQL) applications manager, a Not Only (NO) SQL applications manager, a stream applications manager, a search applications manager, and an in-memory applications manager. The application manager identifies if the applications are one or more of slow-running, failed, killed, unpredictable, and malfunctioning.

[0005] The above and other preferred features, including various novel details of

implementation and combination of elements, will now be more particularly described with reference to the accompanying drawings and pointed out in the claims. It will be understood that the particular methods and apparatuses are shown by way of illustration only and not as limitations. As will be understood by those skilled in the art, the principles and features explained herein may be employed in various and numerous embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The accompanying drawings, which are included as part of the present specification, illustrate the various embodiments of the present disclosed system and method and together with the general description given above and the detailed description of the preferred embodiment given below serve to explain and teach the principles of the present disclosure.

[0007] Figure 1 is an exemplary illustration of applications that the present system and method support, according to one embodiment.

[0008] Figure 2 is an exemplary illustration of the system architecture of the present system, according to one embodiment.

[0009] Figure 3 is an exemplary illustration of an exemplary events panel for an application, according to one embodiment.

[0010] Figure 4 is an exemplary illustration of a live workflow SLA alert and live resource wastage alert, according to one embodiment.

[0011] Figure 5 is an exemplary illustration of a user interface for the application manager, according to one embodiment.

[0012] Figure 6 is an exemplary illustration of a user interface for resource usage breakdown, according to one embodiment.

[0013] Figure 7 is an exemplary illustration of a user interface for data breakdown, according to one embodiment.

[0014] Figure 8 is an exemplary illustration of a navigation user interface, according to one embodiment.

[0015] Figure 9 is an exemplary illustration of a user interface for providing an execution view, according to one embodiment.

[0016] Figure 10 is an exemplary illustration of a user interface for a MapReduce timeline, according to one embodiment. [0017] Figure 11 is an exemplary illustration of a user interface for a skew view, according to one embodiment.

[0018] Figure 12 is an exemplary illustration of a user interface for providing log information, according to one embodiment.

[0019] Figure 13 is an exemplary illustration of a user interface for providing configuration information, according to one embodiment.

[0020] Figure 14 is an exemplary illustration of a user interface for centralized workflow, according to one embodiment.

[0021] Figure 15 is an exemplary illustration of a user interface for an instance compare, according to one embodiment.

[0022] Figure 16 is an exemplary illustration of a user interface for navigation, according to one embodiment.

[0023] Figure 17 is an exemplary illustration of a user interface for providing an execution view, according to one embodiment.

[0024] Figure 18 is an exemplary illustration of a user interface for providing a centralized applications view, according to one embodiment.

[0025] Figure 19 is an exemplary illustration of a user interface for a resource manager, according to one embodiment.

[0026] Figure 20 is an exemplary illustration of a user interface for a leaderboard, according to one embodiment.

[0027] Figure 21 is an exemplary illustration of a service manager, according to one

embodiment.

[0028] Figure 22 is an exemplary illustration of a user interface for a centralized inefficiencies display, according to one embodiment.

[0029] Figure 23 is an exemplary illustration of a user interface for a reporting display, according to one embodiment. [0030] It should be noted that the figures are not necessarily drawn to scale and that elements of structures or functions are generally represented by reference numerals for illustrative purposes throughout the figures. It also should be noted that the figures are only intended to facilitate the description of the various embodiments described herein. The figures do not describe every aspect of the teachings described herein and do not limit the scope of the claims.

DETAILED DESCRIPTION

[0031] A system and method for analyzing big data activities are disclosed. According to one embodiment, a system comprises a distributed file system for the entities and applications, wherein the applications include one or more of script applications, structured query language (SQL) applications, Not Only (NO) SQL applications, stream applications, search applications, and in-memory applications. The system further comprises a data processing platform that gathers, analyzes, and stores data relating to entities and applications. The data processing platform includes an application manager having one or more of a MapReduce Manage, a script applications manager, a structured query language (SQL) applications manager, a Not Only (NO) SQL applications manager, a stream applications manager, a search applications manager, and an in-memory applications manager. The application manager identifies if the applications are one or more of slow-running, failed, killed, unpredictable, and malfunctioning.

[0032] In the following description, for purposes of clarity and conciseness of the description, not all of the numerous components shown in the schematic are described. The numerous components are shown in the drawings to provide a person of ordinary skill in the art a thorough enabling disclosure of the present system and method. The operation of many of the components would be understood to one skilled in the art.

[0033] Each of the additional features and teachings disclosed herein can be utilized separately or in conjunction with other features and teachings to provide a detachable frame for a mobile computer. Representative examples utilizing many of these additional features and teachings, both separately and in combination, are described in further detail with reference to the attached drawings. This detailed description is merely intended to teach a person of skill in the art further details for practicing preferred aspects of the present teachings and is not intended to limit the scope of the present disclosure. Therefore, combinations of features disclosed in the following detailed description may not be necessary to practice the teachings in the broadest sense and are instead taught merely to describe particularly representative examples of the present teachings.

[0034] Moreover, various features of the representative examples and the dependent claims may be combined in ways that are not specifically and explicitly enumerated in order to provide additional useful embodiments of the present teachings. In addition, it is expressly noted that all features disclosed in the description and/or the claims are intended to be disclosed separately and independently from each other for the purpose of original disclosure, as well as for the purpose of restricting the claimed subject matter independent of the compositions of the features in the embodiments and/or the claims. It is also expressly noted that all value ranges or indications of groups of entities disclose every possible intermediate value or intermediate entity for the purpose of original disclosure, as well as for the purpose of restricting the claimed subject matter. It is also expressly noted that the dimensions and the shapes of the components shown in the figures are designed to help understand how the present teachings are practiced but are not intended to limit the dimensions and the shapes shown in the examples.

[0035] The present system and method creates a holistic view of big data activities. An operator can quickly understand what is working, get insights into potential issues proactively, and easily dig deep into what is not working or what is not working properly in an integrated and intelligent platform. The present system and method also increases team and system productivity, empowers developers to become self-servicing, and transforms operations from reactive to proactive.

[0036] Whether it is an ad-hoc SQL inquiry in Hive or a repeatedly-run workflow in Spark running either on the cloud or an on-premises cluster, extensive knowledge of the inner workings of big data systems is required to obtain the desired application performance and cluster efficiency. The present system and method learns about big data usage, identifies errors, and recommends solutions. Thereby, companies can focus on their core business issues instead of spending time and resources at optimizing big data applications and their systems.

[0037] The present system and method also allows companies to take control of the entire big data operation from applications to infrastructure and allow them to focus on making big data work for their business. The present system and method analyzes big data activities from different dimensions to continuously spot and eliminate problems that lower return-on- investment, impede data democracy, and prevent the company from innovating with big data.

[0038] The present disclosure describes an intelligence platform that helps simplify, optimize and control big data activities. The present intelligence platform works for big data application engines and can be used for any type of deployment: bare-metal, cloud, or hybrid. The present system and method provides big data analytics to allow companies and service providers to increase performance of big data systems, for example, increasing a Hadoop workload by multiple times, while saving time in finding optimal settings. Typical Hadoop dashboards provide information about the system performance but an expert is required to identify system errors or failures and fix them. The present system makes it easy to discover and solve problems by making operations proactive and users self-servicing.

[0039] FIG. 1 shows an exemplary big data system, according to one embodiment. The top part of FIG. 1 shows the breadth of applications that the present system and method can support. A program is submitted on a big data system to produce desired results. These applications come in a wide variety such as MapReduce, Pig, Hive, Tez, HCatalog, HBase, Accumulo, Storm, In- Mem Search, etc. Applications can be submitted directly or be submitted through higher-level software such as Tabaleu. It is apparent that the present system and method can cover other application types submitted both directly and indirectly.

[0040] FIG. 2 shows the system architecture of the present system, according to one embodiment. The present intelligence platform 200 consists of a core 210 and a suite of applications 220. The core 210 is a data processing platform that constantly gathers, analyzes, and stores data about entities and applications of the distributed file system 250 (e.g., Hadoop distributed file system). The distributed file system 250 runs a data operating system 260 (e.g., YARN) and various applications therefrom such as Script applications (e.g., Pig), structured query language (SQL) applications (e.g., Hive, HCatalog), Not Only (NO) SQL applications (e.g., HBase, Accumulo), stream applications (e.g., Storm), search applications (e.g., Solr), In-memory applications (e.g., Spark), and other applications (e.g., YARN-ready applications). The results of the analysis may be fed back to the distributed file system 250 to increase the performance of the distributed file system 250. The present system processes this data to power the applications.

[0041] The present intelligence platform engine applies several processes to the data gathered in the core to power events, alerts, root-cause analysis, recommendations and solutions. Table

1 shows exemplary features of the present intelligence platform.

d) Entity Search inefficiencies, and errors in the cluster

Enables custom tagging of applications, resources, tables, users, etc., for reporting, discoverability, and comparison.

Enables powerful and easy search over applications, resources, tables, users, etc.

4) Ops Central Enables automatic diagnosis and resolution a) Application Central of inefficient cluster usage

b) Resource Central Proactively alerts on inefficient or c) Data Central inappropriate use of data and resources by d) User Central applications

e) Service Central - Chargeback/Showback - Splits usage and cost of f) Inefficiencies Central the cluster and resources by user group, g) Reporting application type, etc.

Automatically creates leaderboards to identify the most resource-consuming and resource- wasting applications, users, tables, and queues

Correlates changes in application performance with changes in data size, resource contention, and performance degradation of Hadoop services

5) Data Manager Identifies hot and cold tables

a) Top-N lists Summarizes data usage and access patterns b) Pattern Analyzer across files, tables, queries, columns, and joins c) Auditor Recommends the best data partitioning and storage layout based on usage

Audits data access by applications and users

6) Planner Identify cheapest or fastest infrastructure for workload

Which datasets to move

Which Application Engine to choose

How to allocate resources

When and how to scale-up and scale-down

Table 1

[0042] The present intelligence platform comes with built-in core applications that power smart features and allow for the productive and efficient management of big data systems. Examples of core applications include, but are not limited to, Deep Events, Live Alerts, Info Tags, and Entity Search.

[0043] Deep Events - powered by machine-learning algorithms. The Deep Events application takes a role of a Hadoop expert to identify errors and inefficiencies in the system automatically. The Deep Events application also provides automatic root-cause analysis and solutions for application and system-level problems. The Deep Events application is tightly integrated with other applications such as the Application Manager, Workflow Manager, Ops Central, and Data Manager.

[0044] FIG. 3 shows a screen shot of an exemplary events panel for an application, according to one embodiment. The Events Panel may list other events associated with the application to provide analysis and solutions for the application.

[0045] Live Alerts -users can set custom alerts on applications, workflows, users, tables, queues, etc., to proactively find and eliminate errors and inefficiencies. Live Alerts are Twitterlike streams that bring users' attention to the most important tasks. FIG. 4 shows a screen shot of an exemplary Live Alert, according to one embodiment. The Live Alerts shows workflow Service Level Agreement (SLA) alert and resource wastage.

[0046] Info Tags - the present intelligence platform provides tagging as an easy mechanism to improve grouping and discoverability. Teams can tag applications, workflows, tables, users, and any other entity to be able to search, group, and report over.

[0047] Entity Search - the integrated search engine of the present intelligence platform intelligently indexes and associates all cluster activity with applications, workflows, tables, users, queues, machines, and other entities. With Entity Search, developers and operations staff can search for any entity and get all relevant information for it instantly in a single screen. For example, searching for a user presents all information about that user including applications run, resources used, inefficiencies caused, etc. [0048] The Application Manager provides a comprehensive view into the behavior of

MapReduce, Pig, Hive, Spark, and custom applications. The Application Manager is used by Hadoop application owners (e.g., developers, business analysts, data scientists) to quickly understand and resolve inefficiencies, bottlenecks, and reasons for application failure.

[0049] In addition to applications being submitted directly through Hive, Pig, Spark, etc. the application manager also captures applications that are not being submitted directly but through a third party program. For example, a user who wants to check out graphs using Tableau software may submit Hive applications under the cover. The application manager tells the user when his/her graph does not show up or takes a long time to load. FIG.5 shows a screen shot of the application manager, according to one embodiment. The application manager shows the events and the status (e.g., success, killed), a duration, data I/O, and the number of resources, the execution view.

[0050] The Application Manager includes the following features:

1) Deep Events - Deep Events automatically identify inefficiencies and errors. Deep Events also provide automated remedies as well as guidance on how to resolve the identified application problems.

2) Resource usage breakdown - Resource usage breakdown understands how and what resources are used by an application. Resource usage breakdown shows slot usage and map/reduce attempt successes and failures in an intuitive visual. FIG.6 shows a screen shot of an exemplary resource usage breakdown, according to one embodiment. The number of attempts for map tasks and reduce tasks are shown in a slot usage graph including a slot duration.

3) Data breakdown - Data breakdown understands how and how much data is read and written by an application and by every stage in the application. FIG.7 shows a screen shot of an exemplary data breakdown, according to one embodiment. The data associated with a MapReduce are shown in a tabular format listing the table names, the amount of I/O data, the number of records, and the number of tasks.

4) Duration breakdown - Understand how time was spent in various stages and phases of the application execution.

5) Navigation - Navigation provides an easy navigation of applications and their components with drill-down capabilities. FIG. 8 shows a screen shot of an exemplary navigation, according to one embodiment.

6) Execution view - Execution view provides a graphical view of application execution.

Execution view helps identify bottlenecks and get detailed information about each stage of the application. FIG. 9 shows a screen shot of an exemplary execution view, according to one embodiment.

7) MapReduce timeline - MapReduce timeline provides a detailed view of each map/reduce task along a timeline on the machines that an application is executed. MapReduce timeline includes filters to display map, reduce, failed, killed, and successful tasks. MapReduce timeline helps to understand map, reduces execution phases, and narrow down problematic tasks and machines. FIG. 10 shows a screen shot of an exemplary MapReduce timeline, according to one embodiment.

8) Skew view - Skew view shows distribution of time and size of map and reduce tasks to identify a skew. Skew view also acts as a filter to narrow down skewed tasks on the

MapReduce timeline. FIG. 11 shows a screen shot of an exemplary skew view, according to one embodiment.

9) Log information - Log information selects an application, a job, and task-level logs to provide the user with complete information about an application. FIG. 12 shows a screen shot of an exemplary log information, according to one embodiment. 10) Configuration information - Configuration information provides a complete list of all configuration settings affecting an application. FIG. 13 shows a screen shot of an exemplary configuration information, according to one embodiment.

[0051] The Workflow Manager is designed to integrate with popular workflow engines such as Oozie and cron or custom workflow engines. The Workflow Manager provides an intuitive view to understand workflows and its components in a comprehensive manner. The Workflow Manager is used by workflow (or pipeline) owners to identify and eliminate anomalies, inefficiencies, and bottlenecks in workflow instances, and to guarantee SLAs. The Workflow Manager includes the following features:

1) Workflow Central - Workflow Central provides a single view of defined or 'tagged' workflows in the system. Workflow Central also provides status of how each workflow is performing against its SLA. FIG. 14 shows a screen shot of an exemplary workflow central, according to one embodiment.

2) Workflow Detail Page - Workflow Detail Page provides a view into each workflow to provide users a detailed understanding of the workflow execution. Workflow Detail Page includes:

a. Deep Events - Deep Events automatically identify inefficiencies and errors. Deep Events also provide automated remedy as well as guidance on how to resolve the identified problems for workflows. In one embodiment, Deep Events are the same as in application management. b. Instance Compare - Instance Compare provides an intuitive comparison graph showing duration, resources used, data processed, and number of applications across various instances of the workflow. Instance Compare is particularly useful to identify anomalies and trends. FIG. 15 shows a screen shot of an exemplary instance compare, according to one embodiment. c. Navigation - Navigation provides an easy navigation of the workflow and its components with drill-down capabilities. FIG. 16 shows a screen shot of an exemplary navigation, according to one embodiment. d. Execution view - Execution view provides a graphical view of workflow execution.

Execution view helps to identify bottlenecks and get detailed information about each stage of the workflow. FIG. 17 shows a screen shot of an exemplary execution view, according to one embodiment.

e. Resource usage breakdown - Resource usage breakdown understands how and what resources were used by the workflow. Resource usage breakdown also shows slot usage, number of map/reduce task successes and failures in an intuitive visual. In one embodiment, Resource usage breakdown is the same as application manager.

f. Data breakdown - Data breakdown understands how and how much data is read and written by the workflow. In one embodiment, the Data breakdown is the same as application manager.

g. Duration breakdown - Duration breakdown understands how time is spent in various stages and phases of the workflow execution.

[0052] Ops Central is an extensible application that provides cluster-level information for diagnosing inefficient usage. Ops Central is used by Hadoop administrators and operations engineers to ensure optimal resource usage. Ops Central includes the following features:

1) Deep Events and Live Alerts - Deep Events and Live Alerts automatically detect inefficiencies with applications, tables, users, and resources and provide alerts to bring attention to missing SLAs, applications wasting resources, and more. FIG. 4 shows a screen shot of workflow SLA alert and resource wastage alerts.

2) Application Central - Application Central shows applications that are running, complete, killed, or failed along with their KPIs across several clusters on one screen. Application Central helps to easily understand the workload at any point in time. Application Central allows for grouping applications by type, queues, and business units for easy reporting. Application Central provides the capability to dig into any of these applications to understand more about the application. Application Central is useful when debugging or tuning a particular application of interest. Application Central also allows operations engineers to prioritize jobs, kill rogue jobs and eliminate problems before they become a nuisance on the cluster. FIG. 18 shows a screen shot of an exemplary applications central, according to one embodiment. For applications and workflows running today. The number of successes and killed tasks and the percentage of success rates are shown on the Application Central. According to one embodiment, applications may be grouped by the different operations of a company, for example, financial, advertising, modeling, and default.

3) Resource Manager - Resource Manager shows how queues in the system are being used at any point in time. Resource Manager helps to compare current utilization against average and configured utilization levels to understand which queues are over and under-utilized.

Resource Manager helps system administrators with resource allocation and capacity planning. FIG. 19 shows a screen shot of an exemplary resource manager, according to one embodiment.

4) Leaderboard - Leaderboard helps to analyze how the system is used. Leaderboard can break down cluster usage by users, data, resources, and queues for workload analysis. Besides showing who is using the system the most, Leaderboard is useful when trying to determine how to partition data, how to allocate resources, and tying system processes to business units. FIG. 20 shows a screen shot of an exemplary leaderboard, according to one embodiment.

5) Service Manager - Service Manager provides a customizable view to understand the status of various services running on the big data platform. Examples of services include, but are not limited to, Pig, Meta-store, and Hue. FIG. 21 shows a screen shot of an exemplary service manager, according to one embodiment.

6) Inefficiencies Central - Inefficiencies Central provides an automatically curated list of applications that have caused inefficiencies in the system. Inefficiencies such as resource wastage, inefficient join, etc. are captured by Inefficiencies Central. FIG. 22 shows a screen shot of an exemplary inefficiencies central, according to one embodiment. 7) Reporting - Reporting includes chargeback/showback reports to understand how each user/department is utilizing the cluster, their inefficiencies and wastage. Reporting also includes dollar amounts for each of the above. Reporting also includes cluster utilization forecasting report that helps in planning upgrades. FIG. 23 shows a screen shot of an exemplary reporting, according to one embodiment.

[0053] Data Manager is designed to provide data architects a comprehensive analysis of data access and usage.

1) Top-N lists provides customizable top-N lists to show which tables, columns, joins, and queries are used the most in the system. Top-N lists also allows users to better partition and layout their data.

2) Pattern analyzer identifies the most important tables and columns in workloads to help design the right storage strategy.

3) Auditor reports data usage and access by applications and users.

[0054] Planner helps developers, operations and business leaders to plan their activities to achieve efficiency and productivity. Planner identifies the cheapest or fastest infrastructure for a workload. The present intelligence platform can take any workload (an application or group of applications) profile it, and simulate this workload on any type of server. The result of the simulation is a graph that compares time and cost across the various server types.

[0055] Which datasets to move: the present intelligence platform maintains a history of every time a data set or table was touched by an application. This information can be used by companies to help them decide what data to move. For example, if they only wanted recently accessed data to move, they could see the summary of all such tables very easily in the present intelligence platform.

[0056] Which Application Engine to choose: similar to which datasets to move, the present intelligence platform can also help to choose an application engine that can work best for a particular workload by profiling that workload and simulating execution across various engine types.

[0057] How to allocate resources: Allocating resources within an organization is a challenging task. To find the best allocation one needs to understand how each department/user group is using the infrastructure. Since the present intelligence platform has information about every application that ran, the present intelligence platform can tell companies which department is using what percentage of resources. This helps the companies to allocate resources in an intelligent way rather than simply guessing or splitting down the middle.

[0058] When and how to scale-up and scale-down - the present intelligence platform can forecast future usage based on current usage. Therefore, the present intelligence platform can warn the operator ahead of time when running out of capacity. Because the present intelligence platform can also find inefficiencies, the present intelligence platform can also tell what percentage of the resources is used efficiently versus what is wasted. This can help companies plan whether they should scale up or down accordingly.

[0059] While particular embodiments have been illustrated and described, it would be obvious to those skilled in the art that various other changes and modifications can be made without departing from the scope of the invention. It is therefore intended to cover in the appended claims all such changes and modifications that are within the use.