Live Reorderable Accordion Drawing Live RAC Peter Mc

Live Reorderable Accordion Drawing (Live. RAC) Peter Mc. Lachlan MSc Thesis Presentation September, 2006

Presentation Overview • Motivation • Related Work • Live. RAC Overview and Implementation • Discussion Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion Live. RAC 2

Problem Domain • “Managed Hosting Services”, data center operations staff Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion 3

Network Devices • Network device: any electronic device that connects to a computer network • Most network devices can be monitored • Network Operation Centre (NOC): facility for monitoring large numbers of network devices Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion 4

Monitored Data • Most data collected from network devices is time-series data – time stamp and value • Two types of time-series objects collected: – performance metrics • [ 10 AUG 2006 9: 52: 37, CPU, 95% ] – alarm data • [ 10 AUG 2006 9: 52: 37, MAJOR, “HIGH TEMP” ] • Key difference for visualization: Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion – performance metrics quantitative – alarms categorical 5

Detail Overload Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion 6

RRDTool Motivation • Database system with statistical graphics • Monitors individual hosts Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC – 6 -inch view Discussion • Basis for many related applications http: //oss. oetiker. ch/rrdtool/ 7

Ganglia • Cluster monitoring tool, uses RRDtool backend • Provides aggregate charts, 100 -mile high overview Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion http: //ganglia. sourceforge. net/ 8

Open. NMS • Aggregates SNMP data from multiple hosts, uses RRDtool back-end • Alarm management • 1000 -mile high overviews Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion http: //opennms. org 9

Visualization Solution Requirements • Scale to large, dynamic datasets – thousands of devices – dozens of data channels – multiple time scales Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work • Three levels of activity Live. RAC Active region Time scale # of items Total database Days to years Billions In memory Several seconds Millions On screen Sub-second Thousands Back-end DB Discussion Live. RAC 10

Our solution: Live. RAC • Interactive user-directed exploration of overview & detail –Second to sub-second timeframe Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion 11

Our solution: Live. RAC • Reorderable matrix – rows of network devices – columns of time-series objects • Semantic zooming and aggregation for cells – large cells show time-series charts – compact representations in reduced areas – aggregate spatial representation shown in highly compressed regions Motivation Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion 12

Visual Introduction to Live. RAC 13

Research Contributions Motivation • A scalable visualization system called Live. RAC using real world data • Algorithms and code to support dynamic and reorderable data elements in accordion drawing • Infrastructure and algorithms for userdefinable semantic zoom in accordion drawing Overview Problem Domain Devices & Data Domain Tools Requirements Our Solution Related Work Live. RAC Discussion 14

Information Visualization • Human visual channel is highestbandwidth perceptual system [Norretranders, 1999] • Information visualization: field of study whose object is to aid cognition through the graphic representation of abstract data – displays relevant information graphically to assist in memory tasks – supports data exploration through direct interaction – assists in pattern finding through the display of overview and detail, search, and user-directed reordering Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion 15

Information Visualization Techniques - A few examples Small multiples Pre-attentive visual cues Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion 16

Information Visualization Techniques - A few examples Small multiples Pre-attentive visual cues Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion 17

Time-Series Data • Extensively explored in information visualization • Many techniques cluster similar time-series data points together, e. g. work by van Wijk et al. • Live. RAC provides many small-multiples views of time-series data Motivation Related Work J. van Wijk, E. Van Selow. Cluster and calendar based visualization of time series data. Proc. IEEE Symposium on Information Visualization, pp 4. Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion J. Lin, E. Keogh, S. Lonardi, J. Lankford, D. Nystrom. Visually mining and monitoring massive time series. SIGKDD 2004, 460 -469. 18

Statistical Graphics Motivation • Statistical graphics: Related Work – projection of abstract shapes representing observed quantitative data Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT – in use for centuries in various forms [Beniger, 1978] Live. RAC Discussion – used throughout science and industry in commonly available tools like Excel™ 19

Reorderable Visualizations • Supports user-directed pattern finding when patterns are not known a priori [Bertin, 1981] – allows users to group and sort data to identify or confirm patterns – supports an intuition-driven model for interacting with data • Live. RAC adds reordering to accordion drawing Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion E. Mäkinen, H. Siirtola. Reordering the Reorderable Matrix as an Algorithmic Problem. Theory and Application of Diagrams. 2000, 453– 467. 20

Semantic zooming • Semantic zooming represents data differently at different zoom levels [Perlin, 1993] • Optimize representation for available space • Allow multiple levels of detail Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC R. Bade, S. Schlechtweg, S. Miksch. Connecting Time-Oriented Data and Information to a Coherent Interactive Visualization. CHI 2004, pp 105 -112. Discussion 21

Accordion Drawing • Information visualization technique • Stretch-and-squish navigation – enlarge some areas while retaining surrounding context • Guaranteed visibility – important landmarks remain visible Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion Munzner, Guimbretiere, Tasiran, Zhou, and Zhang. Tree. Juxtaposer: Scalable Tree Comparison using Focus+Context with Guaranteed Visibility. SIGGRAPH 2003, 453 -462. 22

Power. Set. Viewer • Dynamic accordion drawing – insert and remove data at run time • Limitations: – domain-specific solution – not user-reorderable Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion Qiang Kong. Visual mining of power sets with large alphabets. UBC CS, Master’s thesis, May 2006. 23

PRISAD • Introduces the concept of per-frame partitioning of data into screen-visible regions • Reduces n data nodes to p where p is bounded by the number of display pixels • Provides an API for developing accordion drawing applications • Limitation: Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion – static data structures Slack, Hildebrand, and Munzner. Partitioned Rendering Infrastructure for Scalable Accordion Drawing (Extended Version) Information Visualization, 5(2), p. 137 -151, 2006. 24

SWIFT • SWIFT is a set of data storage, aggregation and visualization tools that integrate multiple data sources [Koutsofios, 1999] • Developed at AT&T Labs, fully deployed in a production role • Data sources include SNMP, intrusion detection systems, Windows system monitors, and custom written daemons • Highly scalable • Optimized for streaming data Motivation Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT Live. RAC Discussion 25

SWIFT Front-ends • Existing views: Motivation – Geographic views – Node-link diagrams – Raw data text Related Work Info. Vis Time-series Statistical Graphics Reorderable Vis Semantic Zoom Accordion Drawing SWIFT • Limitations: – Cannot compare between large numbers of timeseries objects Live. RAC Discussion • Live. RAC: reorderable matrix visualization Koutsofios, North, Truscott, and Keim. Visualizing large-scale telecommunication for SWIFT networks and services. IEEE Visualization 1999, 457 -461 26

Live. RAC Architecture Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion 27

Live. RAC Architecture PRISAD • Uses and enhances the PRISAD accordion drawing API – PRISAD provides: • well-established scalability • pixel-bounded rendering performance • extensive infrastructure • Contributions: Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion – fully dynamic generic data structures • add, remove and reorder 28

Live. RAC Architecture SWIFT • SWIFT back-end provides: – unified interface for multiple collected data sources – temporal aggregation • Separate rendering and data-service threads allow interaction during data retrieval • Time window can be selected to display historical or live data Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion 29

Semantic Zooming • CPU usage at several levels of detail Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion 30

Variable LOD Charts • j. GLChart. Util: Highperformance Open. GL statistical graphics library • Several data representations: – – – line charts scatter charts bar charts histograms sparklines Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion 31

Variable LOD Charts • Optimizes chart representation for best use of available space – scales fonts – ‘best fit’ axis labeling – modifies chart grid Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion • Representation and size selected by application, not library 32

Defining Semantic Zoom Levels • Bundle: specification of how to draw cells in a column – defines graphical representation at different cell sizes – can contain single or multiple timeseries objects – pre-defined in configuration file Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion • Generic bundles provide defaults 33

Aggregation • At lowest level of detail, multiple rows are aggregated to single visual representation – convey single useful value for large quantity of information • Aggregated representation is colored box with varying saturation Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion – for alarms, color indicates highest severity alarm – gray indicates metric data – saturation is a function of density 34

Live. RAC Semantic Zooming Video 35

Reordering • Live. RAC allows rows and columns to be reordered – rows sorted by device name, or by customer identifier and sub-sorted by device name, or ordered arbitrarily – columns ordered arbitrarily, locations specified by user • Required significant extensions to PRISAD to provide dynamic data structures Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion 36

Reordering Rows and Columns - Visual Example Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Reordering Video Conclusion 37

Live. RAC Data Playback • Playback consists of advancing the time window by a configurable duration at regular intervals • Historical data can be viewed faster than real-time • Current data can be viewed in realtime Motivation Related Work Live. RAC Architecture Semantic Zoom Reordering Playback Discussion 38

39

Discussion & Results • Live. RAC was deployed using real world data at AT&T Labs • Live. RAC proved to be scalable – interactive frame rates Motivation Related Work Live. RAC Discussion • 4000+ device rows • dozens of performance/alarm columns Active region Time scale # of items Total database 3 Months Millions In memory <5 seconds 80, 000 On screen 10 -15 FPS Thousands Results Future Work Conclusion 40

Live. RAC Case Study Case study video 41

User Feedback Motivation • Demo feedback was positive: – users familiar with the old system were able to quickly recognize customers based on familiarity with the data – Live. RAC identified by domain managers as possible next-generation tool for data center usage – users had numerous suggestions for the system, a good indication that they were excited by the possibilities Related Work Live. RAC Discussion Results Future Work Conclusion 42

Future Work • Interaction: – field study Live. RAC in real-world environment – support alternative navigation options • auto-expanding search region • hot-keying groups of devices or metrics – expand data representation library • Data processing: Motivation Related Work Live. RAC Discussion Results Future Work Conclusion – computational correlation of alarm and metric data • Performance: – lazy evaluation during reordering 43

Conclusion • Contributions: – working system for interactive visualization of large real-world time -series data sets – algorithms for reorderable accordion drawing – infrastructure for semantic zoom in accordion drawing Motivation Related Work Live. RAC Discussion Results Future Work Conclusion 44

45

46

47

Targeted User Activities • Overview: – Situational awareness – Critical alarm notification • Detail: – Incident investigation – Capacity planning – Trend analysis Motivation Related Work Live. RAC Architecture Visual Encoding Aggregation Semantic Zoom Reordering Playback Discussion Future Work Conclusion 48

Monitoring Large-scale Systems: A Difficult Problem • Many disparate data sources – Different platforms – Different protocols – Different services – Lack of integrated solutions • Lack of context in standard tools • Shortage of integrated visualization solutions Motivation Related Work Live. RAC Architecture Visual Encoding Aggregation Semantic Zoom Reordering Playback Discussion Future Work Conclusion 49

SWIFT Limitations • Visualizations for SWIFT only provide node-link and geographic views • These views are good for mapping physical relationships Motivation Related Work Live. RAC Architecture Visual Encoding Aggregation Semantic Zoom Reordering Playback Discussion Future Work Conclusion 51

SWIFT Architecture Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Conclusion 52

Live. RAC handles rows and columns differently Motivation • Large number of rows in a typical data view (thousands) • Comparatively small number of columns (dozens) Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Conclusion 53

Performance Requirements • Live. RAC must maintain interactive frame rates while modifications to the grid are taking place • We need to draw guaranteed visible zones first to provide landmarks • The system needs to scale to thousands of devices, and tens of categories of monitored alarms & metrics • The system must support a large number of data points for alarms & metrics Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Conclusion 54

Split Line Performance Motivation Split Line Tree Operation Related Work Complexity Find split line bounds O(1) (cached) Find split line by index O(log n) Find index of node O(log n) Insert split line Delete split line O(9 log n) O(12 log n) Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Conclusion 55

Charting Performance • System: 3 Ghz Pentium-IV • Chart: 3 data series, 100 points each series – First draw: ~50 ms – Subsequent redraws after modification: <5 ms – Redraw from cached Open. GL display list: <1 ms Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Conclusion 56

Statistical Graphics Line chart Scatter plot Bar chart Pie chart 57

Live. RAC Visual Encoding • Matrix view – rows of devices – columns of metrics and alarms: time-series objects – a cell contains a representation for a set of values of any time-series object • at highest density, cells are colored boxes • at lower densities cells can contain text, or graphical representations Motivation Related Work Live. RAC Architecture Visual Encoding Aggregation Semantic Zoom Reordering Playback Discussion Future Work Conclusion 58

Accordion Drawing Split Line Structure Motivation Related Work Live. RAC Split lines Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Future Work Conclusion Slack. Partitioned Rendering Infrastructure For Stable Accordion Navigation M. Sc. Thesis 59

Accordion Drawing Split Line Structure Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Future Work Conclusion Slack. Partitioned Rendering Infrastructure For Stable Accordion Navigation M. Sc. Thesis 60

Static Split Lines • Previous accordion drawing implementations used static, ordered lists of split lines 0 1 2 3 4 5 6 7 Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance • Insert, remove and reorder operations were O(n) Discussion Future Work Conclusion 61

Dynamic Split Lines • Dynamic split lines are required for maintaining interactive frame rates while adding/removing rows or columns to the matrix • Client-server streaming architecture implies that new devices, alarms and metrics will be a common occurrence • Dynamic split lines support reordering of data • In the future, direct user modification of the data set can be supported Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Conclusion 62

Dynamic Split Line Requirements • Requirements: – Worst case logarithmic insert and remove operations – O(log n) worst case path to any node from the root – Linear scalability in memory usage – Support for arbitrary ordering with enumeration • Can we use a red-black tree? – Red-black trees address the first three requirements – How can we avoid re-enumeration of keys if we allow nodes to be manipulated arbitrarily? Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Conclusion 63

Dynamic Split Lines: Solution: Maintain sub-tree sizes Motivation Find: node index 3 Related Work 3 < (3+1), descend left Live. RAC Overview Architecture 3 > (1 + 1), descend right Dynamic Structure Reordering Aggregation Semantic Zoom Performance found index 3 Discussion Future Work Conclusion 1 2 3 4 5 64

Reordering Rows and Columns: Implementation • For rows, we can swap pointers from split lines to devices without changing the split line structure – O(1) – Preserves layout topology • For columns, we use a global ordering list, mapping a bundle/metric/alarm name to an index number, changes to this list affects rendering of all columns – A hash map is maintained to back map column name to index numbers for O(1) lookups during rendering, this must also be fixed during a reorder – Swapping columns is O(c), where c is the number of columns, typically < 100 Motivation Related Work Live. RAC Overview Architecture Dynamic Structure Reordering Aggregation Semantic Zoom Performance Discussion Future Work Conclusion 65

66