Automated root cause analysis of single or N-tiered application

• US 10,114,726 B2
• Filed: 06/24/2015
• Issued: 10/30/2018
• Est. Priority Date: 06/24/2014
• Status: Active Grant

• Current Assignee: Virsec Systems, Inc.
• Original Assignee: Virsec Systems, Inc.
• Inventors: Gupta, Satya Vrat
• Primary Examiner(s): Ko, Chae M
• Application Number:
  US15/318,419
• Publication Number:
  US 20170123957A1
• Time in Patent Office: 1,224 Days
• Field of Search: 714 381
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence
• CPC Class Codes: G06F 11/3664 Environments for testing or debugging software

Abstract

In an example embodiment, a system may facilitate a root cause analysis associated with one or more computer applications. The system may receive a global time reference at the one or more computer applications. Each computer application may have a corresponding local time reference. Each computer application may synchronize its local time reference with the global time reference. The system may monitor at least one computer instructions of the computer applications with respect to the corresponding local time reference. The system may retrieve information associated with the at least one computer instruction. The system may forward at least a portion of the retrieved computer instruction information to a validation engine. The system may facilitate the root cause analysis using the at least a portion of the retrieved computer instruction information.

Claims

1. A method for facilitating a root cause analysis associated with one or more computer applications, the method executed by a physical computer comprising a processor within a system, the method comprising, by the processor:

receiving a global time reference at the one or more computer applications, each computer application of the one or more computer applications having a corresponding local time reference;

synchronizing each local time reference with the global time reference;

monitoring at least one computer instruction of the one or more computer applications with respect to the corresponding local time reference;

retrieving information associated with the at least one computer instruction; and

forwarding at least a portion of the retrieved computer instruction information to a validation engine, wherein the at least a portion facilitates the root cause analysis at the validation engine.

2. The method of claim 1, further comprising adjusting the global time reference for network jitter.

3. The method of claim 1, further comprising monitoring at least one sequence of the one or more computer instructions and corresponding computer instruction information of the at least one sequence.

4. The method of claim 1, wherein the one or more computer applications include at least two computer applications, each of the at least two computer applications having a different tier of a single computer application of the at least two computer applications.

5. The method of claim 1, further comprising, at the validation engine, comparing the retrieved computer instruction information with stored computer instruction information to determine unexpected behavior associated with the at least one computer instruction.

6. The method of claim 1, wherein the monitoring further comprises:

intercepting one or more of the at least one computer instruction in a pipeline of the physical computer;

performing dynamic binary instrumentation associated with the one or more of the at least one computer instruction to generate at least one binary-instrumented instruction, and

exchanging, in a cache memory of the physical computer, the one or more of the at least one computer instruction with the at least one binary-instrumented instruction.

7. The method of claim 1, wherein the retrieved computer instruction information includes at least one of:

a name of the at least one computer instruction, an address of the at least one computer instruction, an entry state of the at least one computer instruction, an input argument of the at least one computer instruction, an exit state of the at least one computer instruction, a time of the at least one computer instruction, and a return value of the at least one computer instruction.

8. The method of claim 1, wherein the at least one computer instruction includes at least one binary computer instruction and the at least one binary computer instruction includes at least one of a function, a system call, an inter-thread communications call, and an inter-process communications call.

9. The method of claim 1, further comprising;

receiving the global time reference at a plurality of computer applications, each computer application instance of the plurality of computer applications having a corresponding local time reference;

monitoring at least one computer instruction of the plurality of computer applications with respect to the corresponding local time reference, and retrieving information associated with the at least one computer instruction of the plurality of computer applications, and monitoring at least one communication between at least two computer applications of the plurality of computer applications, and retrieving information associated with the at least one communication; and

forwarding at least a portion of the retrieved computer instruction information and the retrieved communication information to the validation engine, wherein the at least a portion facilitates the root cause analysis at the validation engine.

10. The method of claim 8, wherein two or more of the plurality of computer applications are located on separate physical machines connected across a network.

11. A system comprising:

an analysis engine configured to;

receive a global time reference at the one or more computer applications, each computer application of the one or more computer applications having a corresponding local time reference; and

synchronize each local time reference with the global time reference; and

an instrumentation engine configured to;

monitor at least one computer instruction of the one or more computer applications with respect to the corresponding local time reference;

retrieve information associated with the at least one computer instruction; and

forward at least a portion of the retrieved computer instruction information to a validation engine, wherein the at least a portion facilitates the root cause analysis at the validation engine.

12. The system of claim 11, wherein the analysis engine is further configured to adjust the global time reference for network jitter.

13. The system of claim 11, wherein the instrumentation engine is further configured to monitor at least one sequence of the one or more computer instructions and corresponding computer instruction information of the at least one sequence.

14. The system of claim 11, wherein the one or more computer applications include at least two computer applications, each of the at least two computer applications having a different tier of a single computer application of the at least two computer applications.

15. The system of claim 11, further comprising, at the validation engine, comparing the retrieved computer instruction information with stored computer instruction information to determine unexpected behavior associated with the at least one computer instruction.

16. The system of claim 11, wherein the instrumentation engine is further configured to monitor, the monitoring including:

intercepting one or more of the at least one computer instruction in a pipeline of the physical computer;

performing dynamic binary instrumentation associated with the one or more of the at least one computer instruction to generate at least one binary-instrumented instruction, and

exchanging, in a cache memory of the physical computer, the one or more of the at least one computer instruction with the at least one binary-instrumented instruction.

17. The system of claim 11, wherein the retrieved computer instruction information includes at least one of:

a name of the at least one computer instruction, an address of the at least one computer instruction, an entry state of the at least one computer instruction, an input argument of the at least one computer instruction, an exit state of the at least one computer instruction, a time of the at least one computer instruction, and a return value of the at least one computer instruction.

18. The system of claim 11, wherein the at least one computer instruction includes at least one binary computer instruction and the at least one binary computer instruction includes at least one of a function, a system call, an inter-thread communications call, and an inter-process communications call.

19. The system of claim 11, wherein:

the analysis engine is further configured to;

receive the global time reference at a plurality of computer applications, each computer application instance of the plurality of computer applications having a corresponding local time reference; and

the instrumentation engine is further configured to;

monitor at least one computer instruction of the plurality of computer applications with respect to the corresponding local time reference, and retrieve information associated with the at least one computer instruction of the plurality of computer applications, and monitor at least one communication between at least two computer applications of the plurality of computer applications, and retrieve information associated with the at least one communication; and

forward at least a portion of the retrieved computer instruction information and the retrieved communication information to the validation engine, wherein the at least a portion facilitates the root cause analysis at the validation engine.

20. The system of claim 19, wherein two or more of the plurality of computer applications are located on separate physical machines connected across a network.

21. The system of claim 11, wherein the analysis engine and the instrumentation engine comprise a processor fabric including one or more processors.

22. The system of claim 11, wherein the analysis engine, the instrumentation engine, and the validation engine comprise a processor fabric including one or more processors.