Application performance analyzer and corresponding method

• US 10,339,457 B2
• Filed: 01/29/2016
• Issued: 07/02/2019
• Est. Priority Date: 02/02/2015
• Status: Active Grant

• Current Assignee: New Relic
• Original Assignee: New Relic
• Inventors: Ryckbosch, Frederick, Polfliet, Stijn, De Vylder, Bart
• Primary Examiner(s): Holmes, Michael B
• Application Number:
  US15/010,121
• Publication Number:
  US 20160224898A1
• Time in Patent Office: 1,250 Days
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/047 Pattern matching networks; Rete networks

Abstract

An application performance management system is provided, which is adapted to analyze the performance of one or more applications running on information technology (IT) infrastructure. The application performance management system includes a data collector, an anomaly detector, an anomaly correlator, an anomaly ranking unit, and a source problem detector. The data collector collects performance metrics for one or more applications running on the IT infrastructure. The anomaly detector analyzes the performance metrics and detects anomalies, which may include performance metrics whose values deviate from historic values with a deviation that exceeds a predefined threshold. The anomaly correlator detects dependencies between plural anomalies and generates anomaly clusters. Each anomaly cluster includes anomalies that are correlated through one or more of the dependencies. The anomaly ranking unit ranks anomalies within an anomaly cluster. The source problem detector pinpoints a problem source from the lowest ranked anomaly in an anomaly cluster.

Claims

1. An application performance management system adapted to analyze the performance of one or more applications running on information technology (IT) infrastructure, said application performance management system comprising:

a data collector adapted to collect performance metrics for said one or more applications running on said IT infrastructure and adapted to collect communication path data being indicative of communication paths between nodes of said IT infrastructure; and

an anomaly detector adapted to analyze said performance metrics and to detect anomalies,

wherein said application performance management system further comprises;

an anomaly correlator adapted to detect dependencies between plural anomalies based on said communication path data and to generate anomaly clusters, each anomaly cluster including anomalies that are correlated through one or more of said dependencies;

an anomaly ranking unit adapted to rank anomalies within an anomaly cluster based on said communication path data; and

a source problem detector adapted to pinpoint a problem source from the lowest ranked anomaly in said anomaly cluster.

2. The application performance management system defined by claim 1,

wherein said performance metrics comprise at least one of:

CPU usage;

disk space occupancy;

memory usage;

requests per second;

response time;

or

error count value.

3. The application performance management system defined by claim 1,

wherein said anomaly detection engine is adapted to apply the k-Nearest Neighbor algorithm or k-NN algorithm to detect said anomalies.

4. The application performance management system defined by claim 1, further comprising:

a lightweight agent (AG) installed on one or more nodes of said IT infrastructure and configured to obtain said performance metrics, and to send said performance metrics to said data collector.

5. The application performance management system defined by claim 1,

wherein said correlation engine is further adapted to cluster said anomalies based on heuristics defining communication paths between nodes of said IT infrastructure or defining application insights of said one or more applications.

9. The application performance management system defined by claim 1, wherein the detected anomalies include performance metrics with values that deviate from historic values with a deviation that exceeds a predefined threshold.

10. The application performance management system defined by claim 1,

wherein the application performance management system further comprises a lightweight agent (AG) installed on one or more nodes of said IT infrastructure and configured to obtain said communication path data, and to send said communication path data to said data collector.

6. A method to analyze the performance of one or more applications running on IT infrastructure, said method comprising the steps of, by a computing system:

collecting performance metrics for said one or more applications running on said IT infrastructure and collecting communication path data being indicative of communication paths between nodes of said IT infrastructure;

analyzing said performance metrics and detecting anomalies;

detecting dependencies between plural anomalies based on said communication path data, and generating anomaly clusters, each anomaly cluster including anomalies that are correlated through one or more of said dependencies;

ranking anomalies within an anomaly cluster based on said communication path data; and

pinpointing a problem source from the lowest ranked anomaly in said anomaly cluster.

8. A non-transitory computer readable storage medium having stored thereon executable instructions that when executed by one or more processors of the computer system configure the system to perform the method of claim 6.

11. The method according to claim 6, wherein the detected anomalies include performance metrics with values that deviate from historic values with a deviation that exceeds a predefined threshold.

7. A computing system comprising:

one or more processors; and

one or more non-transitory computer readable mediums having stored thereon executable instructions that when executed by the one or more processors configure the system to perform at least the following;

collect performance metrics for said one or more applications running on said IT infrastructure and collect communication path data being indicative of communication paths between nodes of said IT infrastructure; and

analyze said performance metrics and detect anomalies;

detect dependencies between plural anomalies based on said communication path data, and generating anomaly clusters, each anomaly cluster including anomalies that are correlated through one or more of said dependencies;

rank anomalies within an anomaly cluster based on said communication path data; and

pinpoint a problem source from the lowest ranked anomaly in said anomaly cluster.

12. The computing system according to claim 7, wherein the detected anomalies include performance metrics with values that deviate from historic values with a deviation that exceeds a predefined threshold.