A Distributed Linkage Method for a Large Amount of Event Data

摘要

In this paper, we propose a new distributed linkage method for the great amount of event data. This method is used for event-data processing such as System Behavior Visualization, which can diagnose and provide information about complex distributed IT system behavior from communication messages. In this method, we use two techniques: probe and data distribution by “source”. The probe links event data based on the linkage model, which expresses the transaction of communication messages. In distributed computing environment, the counts of probe communication are very important for scalability. In our method, event data are allocated based on their “source” information because this can reduce the counts of probe communication. However, this approach is hard to link effectively in case of Gap model. Gap model means that it has a lack of the relation between message and next message. For Gap model, our method divides linkage processing based on the gap point. Each linkage processing runs concurrency and merged individually. We evaluate our method from the view-points of the throughput related with the load and the number of event processing servers. By using this method, the event-data processing can perform highly in the distributed computing environment. Experimental data demonstrated the viability of our propose method.