Capture, analysis, and visualization of concurrent system and network behavior of an application

• US 10,075,509 B2
• Filed: 02/19/2014
• Issued: 09/11/2018
• Est. Priority Date: 08/19/2005
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: Baron, Steven, Malloy, Patrick J., Cohen, Alain J., Schneider, Marc I., Stocks, Cheryl
• Primary Examiner(s): Donabed, Ninos
• Application Number:
  US14/183,524
• Publication Number:
  US 20140172941A1
• Time in Patent Office: 1,665 Days
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A first capture system that captures network communication events related to an application, and a second capture system that captures internal processing events related to the application. A visualization system analyzes the data captured by each of the capture systems, synchronizes and correlates the data, and presents an integrated display of these communication and processing events. In a preferred embodiment, the communicated messages include an identifier of the application, and the processing components also associate an identifier of the application to each recorded processing event. To facilitate the integrated display of the events, the visualization system synchronizes the recorded communication and processing events to a common time base.

Claims

1. A non-transitory computer-readable medium that includes a program that, when executed by a processor, causes the processor to:

receive processing events of an application executing on a first node of a network;

receive communication events of the application, each communication event including information that facilitates identification of the application;

establish a common time base to properly place the processing events and the communication events on a common timeline;

correlate the communication and processing events, wherein the correlating comprises;

identifying a first processing event when the application begins to wait for data to be received from a second node over a network connection,

identifying a second processing event when the application stops waiting after receiving the data from the second node over the network connection,

identifying a set of communication events that occur over the network connection after the first processing event, but before the second processing event, and

correlating (1) the first processing event and the second processing event with (2) the set of communication events;

generate a timing diagram that illustrates a correlation between the processing events and the communication events on the common timeline; and

display the timing diagram in a graphical user interface (GUI).

2. The medium of claim 1, wherein the processing events include a record of times associated with function calls within the application, and wherein the record of function calls includes a hierarchical record of the function calls.

3. The medium of claim 1, wherein the program causes the processor to trace the processing events across different threads of the application.

4. The medium of claim 1, wherein the program causes the processor to:

determine times associated with function calls within the application, and

filter the times associated the function calls based on user definable preferences.

5. The medium of claim 4, wherein the user definable preferences include a mapping of one or more function calls to one or more function groups, and the program causes the processor to provide composite time parameters corresponding to each function group.

6. The medium of claim 5, wherein the user definable preferences include a mapping of one or more function groups to one or more upper-level function groups in a hierarchical manner, and the program causes the processor to provide other composite time parameters corresponding to at least one of the upper-level function groups, based on the composite time parameters corresponding to the function groups within the upper-level function groups.

7. The medium of claim 1, wherein the network connection is associated with (1) an Internet Protocol (IP) address of the first node and (2) an IP address of the second node, (3) a port of the first node, (4) a port of the second node, and (5) a communication protocol name.

8. The medium of claim 7, wherein the first processing event and the second processing event are associated with a system call on the first node that receives data over the network connection.

9. The medium of claim 1, wherein the program causes the processor to determine statistics corresponding to a hierarchical organization of the processing events, to facilitate display of the statistics at multiple levels of detail.

10. The medium of claim 9, wherein the graphical user interface is configured to display statistics related to the processing events at multiple levels of detail.

11. A method for execution on a plurality of machines on a communication network, comprising:

receiving communication events of an application on the network,

receiving processing events of the application on a first node of the network,

establishing a common time base to properly place the processing events and the communication events on a common timeline,

correlating the communication and processing events, wherein the correlating comprises;

identifying a first processing event when the application begins to wait for data to be received from a second node over a network connection,

identifying a second processing event when the application stops waiting after receiving the data from the second node over the network connection,

identifying a set of communication events that occur over the network connection after the first processing event, but before the second processing event, and

correlating (1) the first processing event and the second processing event with (2) the set of communication events;

generating a timing diagram that illustrates a correlation between the processing events and the communication events on the common timeline; and

displaying the timing diagram in a graphical user interface (GUI),

wherein each communication event includes information that facilitates identification of the application.

12. The method of claim 11, including tracing the processing events across different threads of the application.

13. The method of claim 11, wherein receiving the processing events includes:

determining times associated with function calls within the application, and

filtering the times associated the function calls based on user definable preferences.

14. The method of claim 11, including:

mapping one or more function calls to one or more function groups, and

providing composite time parameters corresponding to each function group.

15. The method of claim 11,

wherein the network connection is associated with (1) an Internet Protocol (IP) address of the first node and (2) an IP address of the second node, (3) a port of the first node, (4) a port of the second node, and (5) a communication protocol name;

and

wherein the first processing event and the second processing event are associated with a system call on the first node that receives data over the network connection.

16. The method of claim 11, including determining statistics corresponding to a hierarchical organization of the processing events, to facilitate display of the statistics at multiple levels of detail.