MONITORING OF DISTRIBUTED APPLICATIONS

• US 20100251263A1
• Filed: 03/24/2009
• Published: 09/30/2010
• Est. Priority Date: 03/24/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Sanghvi, Ashvinkumar J., Letca, Ilarie G., Coelho, Alexandre A., Kurapati, Venkata Seshu Kumar, Sudhakar, Rajeev, Ganesan, Anandha K., Mahajan, Dhananjay M.
• Granted Patent: US 8,893,156 B2
• Time in Patent Office: Days
• US Class Current: 719/314
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3404 for parallel or distributed programming
• CPC Class Codes: G06F 11/3433 for load management allocation of a server based on load conditions G06F9/505; load rebalancing G06F9/5083; redistributing the load in a network by a load balancer H04L67/1029
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: G06F 2201/88 Monitoring involving counting
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues

Abstract

Methods, systems, and computer-readable media are disclosed for monitoring a distributed application. A particular method identifies a plurality of components of a distributed application. The method also identifies a specific technology associated with a particular component and attaches a technology specific interceptor to the particular component based on the identified specific technology. The method includes intercepting messages that are sent by or received by the particular component using the technology specific interceptor. At least one potential work item is generated based on the intercepted messages. The method includes determining whether to schedule the at least one potential work item for execution based on a predicted impact of the at least one work potential item on performance of the distributed application.

Claims

1. A monitoring method comprising:

identifying a plurality of components of a distributed application;

identifying a specific technology associated with a particular component of the plurality of components;

attaching a technology specific interceptor to the particular component based on the identified specific technology and intercepting messages that are sent by or received by the particular component using the attached technology specific interceptor;

generating at least one potential work item based on the intercepted messages; and

determining whether to schedule the at least one potential work item for execution based on a predicted impact of the at least one potential work item on performance of the distributed application.

2. The method of claim 1, wherein the at least potential one work item is scheduled for execution when the predicted impact of the at least one potential work item is below an acceptable performance impact threshold, and wherein the at least one potential work item is not scheduled for execution when the predicted impact of the at least one potential work item is above the acceptable performance impact threshold.

3. The method of claim 1, wherein the predicted impact of the at least one potential work item indicates an effect on processor utilization at the distributed application, message latency at the distributed application, execution queue length at the distributed application, or any combination thereof.

4. The method of claim 1, wherein the at least one potential work item expires when it is not scheduled within a work item expiration time period.

5. The method of claim 1, further comprising executing the at least one potential work item at the distributed application, wherein the at least potential work item includes instructions to store discovered dependency information related to the distributed application, instructions to store monitored activity information related to the distributed application, instructions to report performance counter information related to the distributed application, or any combination thereof.

6. The method of claim 5, further comprising allocating an operation call monitor to track an invocation of a particular function at the particular component based on the intercepted messages.

7. The method of claim 6, wherein the particular function has a source operation and a target operation, wherein the at least one potential work item indicates a dependency between the source operation and the target operation, and wherein executing the at least one potential work item includes storing the dependency in a dependency cache.

8. The method of claim 7, further comprising transferring the dependency from the dependency cache to a storage location via a storage service in response to determining that the dependency has not previously been stored.

9. The method of claim 5, further comprising allocating an activity monitor to track activity of a particular execution path at the particular component, wherein the at least one potential work item includes activity information related to the particular execution path, and wherein executing the at least potential one work item includes storing the activity information in an activity queue.

10. The method of claim 9, further comprising transferring the activity information from the activity queue to a storage location via a storage service.

11. The method of claim 5, further comprising allocating a counter monitor to track occurrences of a particular event based on the intercepted messages, wherein the at least one potential work item indicates at least one occurrence of the particular event, and wherein executing the at least one potential work item includes reporting the at least one occurrence of the particular event to one or more clients of the counter monitor.

12. The method of claim 1, further comprising:

calculating at least one metric related to the distributed application, wherein the at least one metric includes a number of generated exceptions, a number of reported errors, or any combination thereof;

detecting a failure condition of the distributed application; and

identifying the particular component as a potential cause of the failure condition based on the at least one metric.

13. A monitoring system comprising:

a plurality of technology specific interceptors including a first technology specific interceptor associated with a first technology and a second technology specific interceptor associated with a second technology that is different from the first technology; and

a technology agnostic interceptor manager;

wherein the first technology specific interceptor is configured to;

track the operation of a first distributed application component associated with the first technology, including intercepting messages sent by and received by the first distributed application component;

generate work items based on the tracked operation of the first distributed application component; and

send the work items based on the tracked operation of the first distributed application component to the technology agnostic interceptor manager;

wherein the second technology specific interceptor is configured to;

track the operation of a second distributed application component associated with the second technology, including intercepting messages sent by and received by the second distributed application component;

generate work items based on the tracked operation of the second distributed application component; and

send the work items based on the tracked operation of the second distributed application component to the technology agnostic interceptor manager; and

wherein the technology agnostic interceptor manager includes a plurality of work item managers, including a first work item manager associated with the first technology specific interceptor and a second work item manager associated with the second technology specific interceptor;

wherein each work item manager is associated with a particular technology specific interceptor and configured to;

receive work items from the particular technology specific interceptor;

queue the received work items in a work item queue;

compare an impact of a particular work item on performance of a distributed application component tracked by the particular technology specific interceptor to an acceptable performance impact threshold;

schedule the particular work item for execution when the impact is less than the acceptable performance impact threshold; and

drop the particular work item without scheduling the particular work item for execution when the impact is greater than the acceptable performance impact threshold.

14. The system of claim 13, wherein each technology specific interceptor is further configured to request an empty work item from its associated work item manager, to generate a work item by storing information in the empty work item, and to send the generated work item to the technology agnostic interceptor manager.

15. The system of claim 13, wherein each of the work item managers is further configured to:

limit a number of concurrently executing work items;

limit a size of the work item queue;

reject work items that are received when the work item queue is full;

schedule a particular work item for execution in a foreground thread of a thread pool or in a background thread of the thread pool; and

limit a number of concurrently executing threads of the thread pool.

16. The system of claim 13, wherein the technology agnostic interceptor manager includes one or more monitors allocated by the plurality of technology specific interceptors, wherein the monitors include an identity monitor, an endpoint monitor, a component monitor, an activity monitor, a business perspective monitor, an operation call monitor, a counter monitor, an instrument monitor, or any combination thereof, and wherein the technology agnostic interceptor manager further includes a garbage collector.

17. The system of claim 16, wherein the garbage collector runs at a fixed time interval and deallocates monitors that have not been used during the fixed time interval.

18. The system of claim 13, wherein the technology agnostic interceptor manager is configured via a configuration file.

19. A computer-readable medium comprising instructions, that when executed by a monitoring computer, cause the computer to:

receive, at a technology agnostic interceptor manager, a first work item from a first technology specific interceptor attached to a first component of a distributed application, wherein the first technology specific interceptor is specific to a first technology and the first component is associated with the first technology;

receive, at the technology agnostic interceptor manager, a second work item from a second technology specific interceptor attached to a second component of the distributed application, wherein the second technology specific interceptor is specific to a second technology, the second component is associated with the second technology, and the second technology is different from the first technology; and

determine whether to schedule the first work item and the second work item for execution based on a first impact of the first work item on the distributed application and a based on second impact of the second work item on the distributed application.

20. The computer-readable medium of claim 19, wherein the first technology or the second technology includes a Java technology, a NET technology, a Unix-based technology, a Windows-based technology, an Internet Information Services (IIS) technology, a Windows Communication Foundation (WCF) technology, or any combination thereof;

and wherein the first component or the second component includes a web service, a web client, a web server, an application server, a database server, or any combination thereof.