Saturday, March 23, 2013

Analyzing wtmpx on Sun Ray servers (part 2)

Following the previous blog entry in this article I'll take a deeper look into wtmpx of a Sun Ray server over time.

At my former company there were hundreds of Sun Ray servers deployed all over the world. In this example I picked one to show a couple of ways what to do with wtmpx data of Sun Ray servers.
Looking at wtmpx data one could get a first impression on how well Sun Ray servers are being used. Of course the sheer existence of a user session does not say much about what is being done in a session, which applications are being run by the user, is the user typing at all or is only the screenlock running but it is a first picture of what is going on on a machine.

All of the graphs below have been created out of one wtmpx file on one particular server in Europe (I have disguised the name).

In the graphs below I'll show certain takes on the data:

  • all sesssions and their durations (displayed as vectors. I chose two colours simply for illustration purposes, red and blue don't have any other meaning).
  • the count of running sessions on a particular day
  • Histograms to show the number of sessions which lasted a particular time. I chose time ranges 1-10, 11-20 etc. and an additional '1' which contains all sessions lasting less than one day.

    I am showing in three tables the graphs

  • for one full year April 2006 - March 2007
  • for one month in that year (December 2006)
  • for one week in that year (first week of December 2006)

    Year view
    April 2006 - March 2007
    All displays
    Each Sun Ray session is assigned a DISPLAY number. Looking at the distribution of DISPLAY numbers the graphs shows a not quite even distribution. From time to time there are gaps. Few high numbered DISPLAYs have been chosen and the assignment is not continuous. Particularly interesting to me are the few above 120. How did they get into place at all?
    This would require some digging into the Sun Ray server details, something I haven't done.
    0-100 only

    Same as before but restricted to DISPLAY numbers up to 100.
    In the latter half of 2006 more Sun Ray servers were deployed in this location which explains the count decrease after August.
    Each week shows a fuzzy peak which is due to additional sessions started and stopped during that week.
    Very clearly the majority of sessions did last less than one day.
    But there were also some very long lasting sessions (several months, look at the 101-110 bin in the next histogram) and in fact there is no technical reason to login/logout the same day: it was company policy to advise people to logout at the end of their working day, one of the reasons being not to leave behind unsaved data in open windows in case one of the rare event of a server crash. Another reason was that some applications did show memory leaks over time (e.g. web browsers) and in order to prevent that one would have needed to restart these applications regularly. The easier advice was to restart the session and thus restart the applications automatically.
    A good portion of the employees did not follow the daily logout advice as can be seen in the next graph.
    more than 10 days

    This shows the sessions which took longer than 10 days (the previous graph without the first two columns).

    As one can see the Sun Ray servers first of all could run for years without having to reboot and could sustain user sessions equally long. The longest user session I could find (not on this machine) was about 400 days i.e. well over a year. In my experience there were more reboots caused by power issues in the building or server room reorganizations than by actual machine or software failures (something which I couldn't say for my Windows machines nor my Macs).

    Month view
    December 2006
    0-100 only

    In the month view the sessions (display numbers and duration) are better viewable and distinguishable than in the year view. One can clearly see numerous short lived sessions, weekly sessions but also longer sessions going beyond the end of the month.
    In this view the weekly pattern becomes more obvious. Above a certain level of seemingly permanent sessions each working week day shows some peaks. At the end of the month after December 23rd there is a significant drop in session activity (many people seem to have logged out for Christmas) but the last working days in December (27, 28 and 29, the 30th was a Saturday in 2006) show similar peaks as before.
    The histograms show the same pattern than in the year view.
    more than 10 days

    Week view
    December 1-8 2006
    0-100 only
    December 2 and 3 2006 were a weekend.
    On December 4 one can see the session increase at around a third of the day column which is approximately 8:00. Later that day there is a drop (I would say at around 17:00) but not to the level of the weekend so out of all the new sessions at the start of the week some logged out again and others stayed logged on.
    At Friday December 7 in the afternoon the number of sessions reaches approximately the level of the weekend before.

    A few more interesting things: during the weekend December 2-3 there is also a slight fluctuation, why? There is a small chance that people had come to the office to do some work but a better explanation is that Sun Microsystems had established at that time a functioning "work from home" model which included provisioning employees with Sun Ray clients at home. Running a user session on a Sun Ray server in any location and accessing it from home was standard working practice, in my case server and home were hundreds of kilometers apart and even situated in different countries. So going to your home Sun Ray client and either starting a new session or switching to your existing one could be done and some people did so over the weekend when needed.
    In this example the weekend fluctuation is two or three sessions.

    Same patterns than in the year and month view: many single day sessions have been run and a few longer ones have been started in this week.

    All of the above relate to one machine. What one could do now is of course a broader analysis. Compare this machine to the other machines in the same location. Compare this location with other locations in the same country and in other countries.
    What are the differences? What are the similarities?
    Increase the time range and look at several years.
    If there are any changes what factors could have influenced them?
    Taking into account people data one could introduce groupings (e.g. by department, office building, ...) and look at these groups separately and again try to compare, find patterns etc.

    About the gnuplot code

    Each of the three types of graphs had a different data source.
  • display duration: the data file as explained in the previous blog
  • count and histogram: their files were generated by parsing the original data file with a little awk

    The graphs with display number limits or different periods of time were simply using new yrange or xrange settings (and of course different titles and output file names).

    The histogram graph for durations greater than 10 used the histogram data file minus the first two lines.

    Code for counts based on data files like this (timestamp and count):

    20060405130501 35 
    20060405135502 34 
    20060405150057 33 
    20060405151213 32 
    20060405152449 33 
    20060405164318 34 
    20060405170129 33 
    20060405170954 32 
    20060405172414 31 
    20060405173537 30 
    set title "wtmpx - server name\nSession count\n1 year"
    set key off
    set ylabel "Number of sessions"
    set yrange [0:99]
    set timefmt "%Y%m%d%H%M%S"
    set xlabel "Date"
    set xdata time
    set xrange ['20060401000000':'20070401000000']
    set format x "%Y\n%m/%d"
    set output "filename_count.png"
    plot '...filename...' using 1:2 with lines lc rgb "#800000"

    Code for histograms based on data files like this (bins and frequencies):

    1 43 
    1-10 24 
    11-20 10 
    21-30 1 
    31-40 1 
    41-50 0 
    51-60 1 
    61-70 0 
    71-80 0 
    set title "wtmpx - server name\nHistogram\n1 year"
    set key off
    set ylabel "Frequencey"
    set xlabel "Duration of session\n(in n days or less)"
    set style data histograms
    set style fill solid border -1
    set output "filename_histo.png"
    plot '...filename...' using 2:xtic(1) lc rgb "navy"

    All of this was done in gnuplot 4.4 on a Solaris 10 machine.

  • No comments:

    Post a Comment