Performance and security management of applications deployed in hosted computing environments

• US 10,181,981 B2
• Filed: 02/26/2018
• Issued: 01/15/2019
• Est. Priority Date: 07/30/2013
• Status: Active Grant

• Current Assignee: Sysdig
• Original Assignee: Draios Inc.
• Inventors: Degioanni, Loris
• Primary Examiner(s): Eskandarnia, Arvin
• Application Number:
  US15/905,455
• Publication Number:
  US 20180248767A1
• Time in Patent Office: 323 Days
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Systems and methods for performance and security management of the computing infrastructure that supports an application deployed in a hosted computing environment are described. In one embodiment, for example, a system comprises agents installed on hosts. The agents capture and record system events from operating systems on the hosts that result from application component processes executing on the hosts. The system further includes a collection and analysis engine that obtains captured and recorded system events from the agents, identifies captured and recorded system events that pertain to an application transaction, and produces, from the identified system events, metric data reflecting quantity of computing resources used by the application component processes to process the application transaction. The system also includes a web dashboard that presents the metric data to a user, for example, on a web page.

Claims

1. A data tracking system comprising:

a plurality of hosts distributed across a plurality of data center hosting facilities, each host including one or more agents of a plurality of agents to capture and record system events at the plurality of hosts, the system events resulting from a plurality of component processes executing at the plurality of hosts;

one or more processors;

one or more storage media storing instructions which, when executed by the one or more processors, cause;

determining that a set of captured and recorded system events from the plurality of agents pertain to a distributed component distributed across the plurality of hosts;

reconstructing, from the set of captured and recorded system events that pertain to the distributed component, metric data reflecting quantity of computing resources used by the plurality of component processes executing at the plurality of hosts; and

causing display of the metric data to a user in a graphical user interface.

2. The system of claim 1, wherein the set of captured and recorded system events include system events executed in response to one or more distributed transactions that pertain to the distributed component.

3. The system of claim 1, wherein the computing resources used by the plurality of component processes include at least one of network data and file exchange, creation or removal of processes, library loading, or user impersonation.

4. The system of claim 1, wherein the one or more storage media storing instructions which, when executed by the one or more processors, further cause:

sorting, in a chronological order, the set of captured and recorded system events.

5. The system of claim 1, wherein the plurality of agents is configured to capture system events from operating systems on the plurality of hosts by intercepting system calls to the operating systems from the plurality of component processes.

6. The system of claim 1, wherein each host of the plurality of hosts is a computing device or a virtual machine instance.

7. The system of claim 1, wherein the distributed component includes a request corresponding to when a HyperText Transfer Protocol (HTTP) or a Secure HyperText Transfer Protocol (HTTPS) request is received at a web server host of the plurality of hosts and when the web server host completes sending of a HTTP or HTTPS response to the HTTP or HTTPS request.

8. The system of claim 1, wherein the distributed component includes a request corresponding to when a database query request is received at a database server host of the plurality of hosts and when the database server host completes sending of a database query response to the database query request.

9. The system of claim 1, wherein the graphical user interface is a web page.

10. The system of claim 1, wherein each of the plurality of component processes execute functionality of one of a plurality of components;

and wherein the metric data caused to be displayed the graphical user interface indicates, for each of the plurality of components, a quantity of a particular computing resource used by the component to process requests from the distributed component.

11. The system of claim 10, wherein each component of the plurality of components is one of a web server, an application server, and a database server.

12. The system of claim 1, wherein the metric data caused to be displayed in the graphical user interface indicates time spent by the plurality of component processes using the computing resources to process requests from the distributed component.

13. The system of claim 1, wherein the plurality of agents is configured to associate additional contextual information with a captured system event by querying one or more system state tables and/or querying an operating system interface using information from the captured system event.

14. A method comprising:

determining that a set of captured and recorded system events from a plurality of agents pertain to a distributed component distributed across a plurality of hosts, the plurality of hosts distributed across a plurality of data center hosting facilities, each host including one or more agents of the plurality of agents to capture and record system events at the plurality of hosts, the system events resulting from a plurality of component processes executing at the plurality of hosts;

reconstructing, from the set of captured and recorded system events that pertain to the distributed component, metric data reflecting quantity of computing resources used by the plurality of component processes executing at the plurality of hosts;

causing display of the metric data to a user in a graphical user interface; and

wherein the method is performed by a computing system having one or more processors and storage media, the storage media storing one or more programs having instructions configured to perform the method.

15. The method of claim 14, wherein the set of captured and recorded system events include system events executed in response to one or more distributed transactions that pertain to the distributed component.

16. The method of claim 14, wherein the computing resources used by the plurality of component processes include at least one of network data and file exchange, creation or removal of processes, library loading, or user impersonation.

17. The method of claim 14, further comprising:

sorting, in a chronological order, the set of captured and recorded system events.

18. One or more non-transitory computer-readable media storing one or more programs having instructions for execution by a computing system having one or more processors, the instructions configured for:

determining that a set of captured and recorded system events from a plurality of agents pertain to a distributed component distributed across a plurality of hosts, the plurality of hosts distributed across a plurality of data center hosting facilities, each host including one or more agents of the plurality of agents to capture and record system events at the plurality of hosts, the system events resulting from a plurality of component processes executing at the plurality of hosts;

reconstructing, from the set of captured and recorded system events that pertain to the distributed component, metric data reflecting quantity of computing resources used by the plurality of component processes executing at the plurality of hosts; and

causing display of the metric data to a user in a graphical user interface.

19. The one or more non-transitory computer-readable media of claim 18, wherein the set of captured and recorded system events include system events executed in response to one or more distributed transactions that pertain to the distributed component.

20. The one of more non-transitory computer-readable media of claim 18, wherein the computing resources used by the plurality of component processes include at least one of network data and file exchange, creation or removal of processes, library loading, or user impersonation.