Application discovery and dependency mapping

• US 10,320,626 B1
• Filed: 04/07/2016
• Issued: 06/11/2019
• Est. Priority Date: 04/07/2016
• Status: Active Grant

• Current Assignee: Wells Fargo Bank NA (Wells Fargo & Company)
• Original Assignee: Wells Fargo Bank NA (Wells Fargo & Company)
• Inventors: Cross, Shane D., Miller, Jack H.
• Primary Examiner(s): Bayard, Djenane M
• Application Number:
  US15/093,461
• Time in Patent Office: 1,160 Days
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 9/00 Arrangements for program control, e.g. control units program control for peripheral devices G06F13/10
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses

Abstract

In an example, a computer-implemented method includes determining, by one or more processors, a server dependency between a first server and a second server of a multi-server system, where determining the server dependency comprises identifying a bilateral communication between the first server and the second server. The method also includes determining, by the one or more processors, for the determined server dependency, an application dependency between a first application executed at the first server and a second application executed at the second server based on first process information associated with the first application and second process information associated with the second application, and generating data that indicates at least one of the determined server dependency and the determined application dependency.

Claims

1. A computer-implemented method comprising:

receiving, by one or more processors, first network information from a first server of a multi-server system, wherein the first network information has been obtained by the first server at a synchronized time at periodic intervals;

receiving, by the one or more processors, second network information from a second server of the multi-server system, wherein the second network information has been obtained by the second server at the synchronized time or approximately the synchronized time;

determining, by the one or more processors, a server dependency between the first server and the second server of the multi-server system based on the first network information received from the first server and the second network information received from the second server, wherein determining the server dependency comprises identifying a bilateral communication between the first server and the second server;

determining, by the one or more processors, for the determined server dependency, an application dependency between a first application executed at the first server and a second application executed at the second server, wherein determining the application dependency further comprises;

determining first directory information associated with the first application and indicated by a first process identifier assigned to the first application by the first server;

mapping the first directory information to the first application using an application identification file;

determining second directory information associated with the second application and indicated by a second process identifier assigned to the second application by the second server; and

mapping the second directory information to the second application using the application identification file; and

generating data that indicates at least one of the determined server dependency or the determined application dependency.

2. The method of claim 1, wherein identifying the bilateral communication comprises:

determining that the second server is a destination for one or more messages transmitted from the first server; and

determining that the first server is a destination for one or more messages transmitted by the second server.

3. The method of claim 2, further comprising:

determining that the second server is the destination for the one or more messages from the first server based on the first network information included with the one or more messages from the first server; and

determining that the first server is the destination for the one or more messages from the second server based on the second network information included with the one or more messages from the second server.

4. The method of claim 1,

wherein identifying the bilateral communication between the first server and the second server comprises identifying the bilateral communication as having occurred at the synchronized time or approximately the synchronized time based on the received first network information and the received second network information.

5. The method of claim 4, further comprising configuring the first server and the second server to obtain the first network information and the second network information, respectively, at the synchronized time.

6. The method of claim 4, wherein receiving the first network information from the first server and the second network information from the second server further comprises configuring the first server and the second server to transmit the first network information and the second network information, respectively, at a predetermined time, different from the synchronized time.

7. The method of claim 1, wherein each of the first or second network information comprises at least one of an internet protocol (IP) address of one or more messages or transmission control protocol (TCP) data for the one or more messages.

8. The method of claim 1, wherein the application identification file is derived from at least one of application build logs or third-party software installs for the first and second applications.

9. A non-transitory computer-readable medium having instructions stored thereon that, when executed, cause one or more processors to:

receive first network information from a first server of a multi-server system, wherein the first network information is time-indexed and has been obtained from the first server at a synchronized time at periodic intervals;

receive second network information from a second server of the multi-server system, wherein the second network information is time-indexed and has been obtained from the second server at the synchronized time or approximately the synchronized time;

determine a server dependency between the first server and the second server of the multi-server system based on the first network information received from the first server and the second network information received from the second server, wherein determining the server dependency comprises identifying a bilateral communication between the first server and the second server;

determine for the determined server dependency, an application dependency between a first application executed at the first server and a second application executed at the second server, wherein to determine the application dependency, the instructions cause the one or more processors to;

determine first directory information associated with the first application and indicated by a first process identifier assigned to the first application by the first server;

map the first directory information to the first application using an application identification file;

determine second directory information associated with the second application and indicated by a second process identifier assigned to the second application by the second server; and

map the second directory information to the second application using the application identification file; and

generate data that indicates at least one of the determined server dependency or the determined application dependency.

10. The non-transitory computer-readable medium of claim 9, wherein to identify the bilateral communication, the instructions cause the one or more processors to:

determine that the second server is a destination for one or more messages transmitted from the first server based on the first network information included with the one or more messages from the first server; and

determine that the first server is a destination for one or more messages transmitted by the second server based on the second network information included with the one or more messages from the second server.

11. The non-transitory computer-readable medium of claim 9,

wherein to identify the bilateral communication between the first server and the second server, the instructions cause the one or more processors to identify the bilateral communication as having occurred at the synchronized time or approximately the synchronized time based on the received first network information and the received second network information.

12. The non-transitory computer-readable medium of claim 9, wherein each of the first or second network information comprises at least one of an internet protocol (IP) address of one or more messages or transmission control protocol (TCP) data for the one or more messages.

13. A computing system comprising:

one or more processors of a first server of a multi-server system, the one or more processors configured to;

capture network information at a predetermined time interval for a predetermined duration, wherein the network information is associated with one or more outgoing messages of the first server and indicates a destination of the one or more outgoing messages; and

capture process information at the predetermined time interval for the predetermined duration, wherein the process information is associated with the one or more outgoing messages of the first server and indicates a process responsible for generating the one or more outgoing messages, and wherein the process information comprises a process identifier assigned to the process by the first server and configured to indicate directory information associated with the process; and

a memory configured to store the captured network information and the captured process information over the predetermined duration,

wherein the one or more processors are further configured to transmit, at the end of the predetermined duration, the captured network information and the captured process information from the first server to a computing device for determining at least one dependency between the first server and a second server of the multi-server system.

14. The computing system of claim 13, wherein the one or more processors are further configured to time-index the captured network data and the captured process data according to a time capture.

15. The computing system of claim 13, further comprising de-duplicating the captured network information and the captured process information during the predetermined duration.