Big Data Meets HPC Log Analytics: Scalable Approach to Understanding Systems at Extreme Scale
Total Page:16
File Type:pdf, Size:1020Kb
Big Data Meets HPC Log Analytics: Scalable Approach to Understanding Systems at Extreme Scale Byung H. Park∗, Saurabh Hukerikar∗, Ryan Adamsony, and Christian Engelmann∗ ∗Computer Science and Mathematics Division yNational Center for Computational Sciences Oak Ridge National Laboratory Oak Ridge, TN, USA Email: fparkbh, hukerikarsr, adamsonrm, [email protected] Abstract—Today’s high-performance computing (HPC) sys- This system activity and event information is logged for mon- tems are heavily instrumented, generating logs containing in- itoring and analysis. Large-scale HPC installations produce formation about abnormal events, such as critical conditions, various types of log data. For example, job logs maintain faults, errors and failures, system resource utilization, and about the resource usage of user applications. These logs, once fully a history of application runs, the allocated resources, their analyzed and correlated, can produce detailed information about sizes, user information, and exit statuses, i.e., successful vs. the system health, root causes of failures, and analyze an failed. Reliability, availability and serviceability (RAS) system application’s interactions with the system, providing valuable logs derive data from various hardware and software sensors, insights to domain scientists and system administrators. However, such as temperature sensors, memory errors and processor processing HPC logs requires a deep understanding of hardware and software components at multiple layers of the system stack. utilization. Network systems collect data about network link Moreover, most log data is unstructured and voluminous, making bandwidth, congestion and routing and link faults. Input/output it more difficult for system users and administrators to manually (I/O) and storage systems produce logs that record perfor- inspect the data. With rapid increases in the scale and complexity mance characteristics as well as data about degradations and of HPC systems, log data processing is becoming a big data errors detected. challenge. This paper introduces a HPC log data analytics frame- work that is based on a distributed NoSQL database technology, HPC log data, when thoroughly investigated both in spatial which provides scalability and high availability, and the Apache and temporal dimensions, can be used to detect occurrences Spark framework for rapid in-memory processing of the log of failures and understand their root causes, identify per- data. The analytics framework enables the extraction of a range sistent temporal and spatial patterns of failures, track error of information about the system so that system administrators propagation, evaluate system reliability characteristics, and and end users alike can obtain necessary insights for their specific needs. We describe our experience with using this framework to even analyze contention for shared resources in the system. glean insights from the log data about system behavior from the However, HPC log data is derived from multiple monitoring Titan supercomputer at the Oak Ridge National Laboratory. frameworks and sensors and is inherently unstructured. Most log entries are not set up to be understood easily by humans, with some entries consisting of numeric values while others I. INTRODUCTION include cryptic text, hexadecimal codes, or error codes. The Log data is essential for understanding the behavior of high- analysis of this data and finding correlations faces two main arXiv:1708.06884v1 [cs.DC] 23 Aug 2017 performance computing (HPC) systems by recording their difficulties: first, the volume of RAS logs makes the manual usage and troubleshooting system faults. Today’s HPC systems inspection difficult; and second, the unstructured nature and are heavily instrumented at every layer for health monitoring idiosyncratic properties of log data produced by each subsys- by collecting with performance counters and resource usage tem log adds another dimension of difficulty in identifying data. Most components also report information about abnormal implicit correlation among the events recorded. Consequently, events, such as critical conditions, faults, errors and failures. the usage of log data is, in practice, largely limited to detection of mere occurrences of known text patterns that are already This manuscript has been authored by UT-Battelle, LLC under Contract No. known to be associated with certain types of events. DE-AC05-00OR22725 with the U.S. Department of Energy. The United States As the scale and complexity of HPC systems continues Government retains and the publisher, by accepting the article for publication, acknowledges that the United States Government retains a non-exclusive, paid- to grow, the storage, retrieval, and comprehensive analysis up, irrevocable, worldwide license to publish or reproduce the published form of the log data is a significant challenge. In future extreme of this manuscript, or allow others to do so, for United States Government scale HPC systems the massive volume of monitoring and purposes. The Department of Energy will provide public access to these results of federally sponsored research in accordance with the DOE Public Access log data makes manual inspection and analysis impractical, Plan (http://energy.gov/downloads/doe-public-access-plan). and therefore poses a data analytics challenge. To address this Main hash/distribution key Sorted by timestamp StartTime:Userid StartTime:Userid Hour … AppName EndTime Node list AppName EndTime Node list Timestamp Timestamp Timestamp Hour:Type … Source Amount Source Amount Source Amount A data row for event occurrences arranged by event type StartTime:Userid StartTime:Userid Application … Other Info EndTime Node list Other Info EndTime Node list Timestamp Timestamp Timestamp Hour:Source … Type Amount Type Amount Type Amount StartTime:AppName StartTime:AppName User … Other Info EndTime Node list Other Info EndTime Node list A data row for event occurrences arranged by location of occurrence Fig. 1. Schemas for event occurrences: event schema ordered by time of Fig. 2. Schemas for application runs: Application schema ordered by time of occurrence (Top) and by location of occurrence (Bottom) occurrence (Top), by name of application (Middle), and by users (Bottom) II. DATA MODEL challenge, scalable methods for processing log and monitoring The monitoring infrastructure in supercomputing systems data are needed. This will require storing the enormous produces data streams from various sensors, which captures data sets in flexible schemas based on scalable and highly the resource and capacity utilization, power consumption, available database technologies, which can support large-scale cooling systems, application performance, as well as various analytics with low latencies, and high performance distributed types of faults, errors and failures in the system. With the rapid data processing frameworks to support batch, real-time, and increase in the complexity of supercomputing systems due to advanced analytics on the system data. the use of millions of cores, complex memory hierarchies, In this paper, we introduce a scalable HPC system data and communication and file systems, massive amounts of analytics framework, which is designed to provide system log monitoring data must be handled and analyzed in order to data analysis capabilities to a wide range of researchers and understand the characteristics of these systems and correlations engineers including system administrators, system researchers, between the various system measurements. The analysis of and end users. The framework leverages Cassandra, a NoSQL system monitoring data requires capturing relevant sensor distributed database to realize a scalable and fast-response data and system events, storing them in databases, developing backend for high throughput read/write operations, the Apache analytic models to understand the spatial and temporal features Spark for supporting rapid analysis on the voluminous system of the data, or correlation between the various data streams, data. The framework provides a web-based graphical, inter- and providing tools capable of visualizing these system char- active frontend interface that enables users to track system acteristics, or even building predictive models to improve the activity and performance and visualize the data. Using the system operation. With the explosion in the monitoring data, framework, users can navigate spatio-temporal event space that this rapidly becomes a big data challenge. Therefore, to handle overlaps with particular system events, faults, application runs, the massive amounts of system monitoring data and to support and resource usage to monitor the system, extract statistical capabilities for more rigorous forms of user defined analytics, features, and identify persistent behavioral patterns. End users we adopt storage solutions designed to handle large amounts can also visually inspect trends among the system events and of data, and an in-memory data processing framework. contention on shared resources that occur during the run of their applications. Through such analysis, the users may find A. Design Considerations sources of performance anomalies and gain deeper insights An implementation of an HPC system log analytics frame- into the impact of various system behaviors on application work should start with extracting, transforming, and loading performance. (ETL) of log data into a manageable database that can serve a The rest of the document is organized as follows: Section