1. 8/5/2015 1 Monitoring Big, Distributed, Streaming Data Daniel Keren, Haifa U Tsachi Sharfman, Technion Assaf Schuster, Technion

2. SRDC 2013 2 Large scale and widespread networked systems Large scale and widespread networked systems Continuous production of data Continuous production of data High volume High volume Dynamic nature Dynamic nature Required to detect a global property Required to detect a global property Often in (near) real time Often in (near) real time Distributed Stream Networks

3. 8/5/2015 3 Web Page Frequency Counts Mirrored web site Mirrored web site Mirrors record the frequency of requests for pages Mirrors record the frequency of requests for pages Detect when the global frequency of requests for a page exceeds a predetermined threshold Detect when the global frequency of requests for a page exceeds a predetermined threshold Req #1 Req #2 Req #3

4. SRDC 2013 8/5/2015 4 Air Quality Monitoring Sensors monitoring the concentration of air pollutants. Sensors monitoring the concentration of air pollutants. Each sensor holds a data vector comprising measured concentration of various pollutants (CO 2, SO 2, O 3, etc.). Each sensor holds a data vector comprising measured concentration of various pollutants (CO 2, SO 2, O 3, etc.). A function on the average readings determines the Air Quality Index (AQI) A function on the average readings determines the Air Quality Index (AQI) Issue an alert in case the AQI exceeds a given threshold. Issue an alert in case the AQI exceeds a given threshold.

5. 8/5/2015 5 Sensor Networks Sensors monitoring the temperature in a server room (machine room, conference room, etc.) Sensors monitoring the temperature in a server room (machine room, conference room, etc.) Ensure uniform temp.: monitor variance of readings Ensure uniform temp.: monitor variance of readings Alert in case variance exceeds a threshold Alert in case variance exceeds a threshold Temperature readings by n sensors x 1, …, x n Temperature readings by n sensors x 1, …, x n Each sensor holds a data vector v i = (x i 2, x i ) T Each sensor holds a data vector v i = (x i 2, x i ) T The average data vector is v = The average data vector is v = Var(all sensors) = Var(all sensors) =

6. SRDC 2013 8/5/2015 6 Search Engine Distributed datacenter/warehouse Distributed datacenter/warehouse 10Ks horizontal partitions 10Ks horizontal partitions “ Our logs are larger than any other data by orders of magnitude. They are our source of truth. ” Sridhar Ramaswamy. SIGMOD’08 keynote on “Extreme Data Mining” “ Our logs are larger than any other data by orders of magnitude. They are our source of truth. ” Sridhar Ramaswamy. SIGMOD’08 keynote on “Extreme Data Mining” Mining the logs: Compute pairs of keywords for which the correlation index is high Mining the logs: Compute pairs of keywords for which the correlation index is high Thousands simultaneous tasks Thousands simultaneous tasks “ Network bandwidth is a relatively scarce resource in our computing environment ”. Dean and Ghemawat. MapReduce paper, OSDI ’ 04 “ Network bandwidth is a relatively scarce resource in our computing environment ”. Dean and Ghemawat. MapReduce paper, OSDI ’ 04

7. SRDC 2013 Cloud Health Monitoring 8/5/2015 7 Amazon Web ServicesAmazon Web Services » Service Health DashboardService Health Dashboard Amazon S3 Availability Event: July 20, 2008 “At 8:40am PDT, error rates in all Amazon S3 datacenters began to quickly climb and our alarms went off. By 8:50am PDT, error rates were significantly elevated and very few requests were completing successfully. By 8:55am PDT, we had multiple engineers engaged and investigating the issue. Our alarms pointed at problems processing customer requests in multiple places within the system and across multiple data centers. While we began investigating several possible causes, we tried to restore system health... At 9:41am PDT, we determined that servers within Amazon S3 were having problems… By 11:05am PDT, all server-to-server communication was stopped, request processing components shut down, and the system's state cleared…. “

8. SRDC 2013 Ad-Hoc Mobile P2P Networks 8/5/2015 8 Peer-to-peer network invites drivers to get connected CarTorrent could smarten up our daily commute, reducing accidents and bringing multimedia journey data to our fingertips Laura Parker The Guardian,The Guardian Thursday January 17 2008 “The name BitTorrent has become part of most people's day-to-day vernacular, synonymous with downloading every kind of content via the internet's peer-to-peer networks. But if a team of US researchers have their way, we may all be talking about CarTorrent in the not too distant future….. Researchers from the University of California Los Angeles are working on a wireless communication network that will allow cars to talk to each other, simultaneously downloading information in the shape of road safety warnings, entertainment content and navigational tools….”

9. SRDC 2013 8/5/2015 9

10. SRDC 2013 Distributed Monitoring – State of the Art Periodically send all data to a central location Periodically send all data to a central location High communication High communication High latency High latency A tradeoff A tradeoff Expensive central resources Expensive central resources Power inefficient Power inefficient Can we do better? Can we do better? Linear systems Linear systems Non-linear systems  Non-linear systems  8/5/2015 10

11. Threshold 8/5/2015 11 Monitoring Distributed Non-Linear Functions

12. Given a 2X2 table, the mutual information is defined as The mutual information of the global table is much larger than the local values. As in the parabola case, there’s no way to infer about the global MI given the local ones. 8/5/2015 12 Mutual Information

13. 8/5/2015 13 Non-Linear Functions “… The link function is, of course, nonlinear. So we agonize over trading off optimization performance with ability to use the massive infrastructure. …” Sridhar Ramaswamy. SIGMOD’08 Keynote talk on “Extreme Data Mining” Slide title: “10 top reasons why googlers do not sleep at night” (Coffee is reason #5)

14. SRDC 2013 Geometric Method – Idea The behavior of a general function over distributed data may be hard to see The behavior of a general function over distributed data may be hard to see Local indications may be misleading Local indications may be misleading Non-linear Non-linear Looking at the *domain* of the function may be easier Looking at the *domain* of the function may be easier For long periods, the local inputs are stationary, or do not change much For long periods, the local inputs are stationary, or do not change much 8/5/2015 14