CORRELATING INPUT AND OUTPUT REQUESTS BETWEEN CLIENT AND SERVER COMPONENTS IN A MULTI-TIER APPLICATION

• US 20120246287A1
• Filed: 02/03/2012
• Published: 09/27/2012
• Est. Priority Date: 02/04/2011
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: OPNET Technologies Incorporated (Riverbed Technology Incorporated)
• Inventors: MALLOY, Patrick, CROSBY, Peter Anthony, MEAGHER, Robert
• Granted Patent: US 9,549,030 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

The present invention relates to correlating requests between a client and a server to a particular transaction. In one embodiment, transactions in a system of clients and servers are monitored and traced. From this information, a context comprising sets or groupings of transaction call sequences are determined. For example, a sequence of method calls on a client process is traced to a socket carrying data for transmission of a request message to a server. In response to this request message, the server then executes a set of method calls that can be correlated to the request message and the socket. This set of actions is considered part of a causally related grouping, and thus, associated together. In one embodiment, HTTP requests from a client may be comprise a unique custom header that is readily identified and traced. For other protocols, a client socket is associated with a corresponding server socket or to data received over a socket receive call.

Claims

1. A method of marking a transaction at a first node for correlation with a related transaction at a second node, said method comprising:

determining when a socket connection is opened by the first node for a communication destined to the second node;

assigning a connection ID to the socket connection;

emitting the connection ID responsive to a successful socket write action by the first node; and

emitting, at offsets within the communication, respective markers for each of the offsets.

2. The method of claim 1, further comprising emitting an amount of data sent and an amount data received for each socket connection.

3. The method of claim 1, wherein emitting the respective markers comprises emitting a checksum value calculated based on the offset.

4. The method of claim 1, wherein emitting the checksum value comprises emitting a Jenkins checksum value based on the offset.

5. The method of claim 1, wherein emitting the respective markers comprises emitting a checksum and the offset as a pair value.

6. A method for correlating communications between a first node and a second node for a transaction, said method comprising:

monitoring a plurality of method calls and a plurality of socket actions at the first and second nodes;

assigning a socket ID to each socket connection that is opened on the first and second nodes;

emitting, for each successful socket write action and each successful socket read action at the first and second nodes, the socket ID and respective marker corresponding to an offset within the connection; and

correlating the communications between the first and second nodes based on the socket ID and the respective markers.

7. The method of claim 6, wherein emitting the respective markers corresponding to an offset within the connection comprises emitting a checksum value calculated based on the offset.

8. The method of claim 6 further comprising emitting, for each successful socket write action, a local address, a remote address, a number of bytes sent, and a checksum value.

9. The method of claim 6, further comprising emitting, for each successful socket read action, a local address, a remote address, a number of bytes received, and a checksum value.

10. The method of claim 6, further comprising recording each of the plurality of method calls and their corresponding emissions to a database.

11. The method of claim 6, further comprising maintaining an index that is keyed on the markers.

12. The method of claim 11, wherein maintaining an index that is keyed on the markers and a timestamp indicating when each marker was created.

13. The method of claim 6, further comprising maintaining an index that is keyed on identifiers for the first and second nodes, an identifier for each process associated with the method calls, and an identifier for the socket connection.

14. The method of claim 6, wherein correlating the communications between the first and second nodes based on the socket ID and the respective markers comprises a lookup for socket calls matching the socket ID and a corresponding range of markers.

15. The method of claim 6, wherein correlating the communications between the first and second nodes based on the socket ID and the respective markers comprises a lookup for socket calls matching the socket ID and a corresponding range of checksum values calculated for offsets within the communications.

16. A method for correlating a transaction recorded at two or more nodes, comprising:

monitoring a plurality of method calls and a plurality of socket actions for transactions at each of the two or more nodes;

associating a socket ID with each socket connection that is opened;

for each successful socket connection, emitting the socket ID, a local address, and a remote address;

for each successful socket write action, emitting the socket ID, a current output stream offset, a number of bytes sent, and on selected fixed boundaries and at the end of a socket connection a checksum value;

for each successful socket read action, emitting the socket ID, a current input stream offset, a number of bytes received, and on selected fixed boundaries and at the end of a socket connection, a checksum value;

associating each emission with at least one of the plurality of method calls;

recording information about each of the plurality of method calls and their corresponding emissions; and

identifying a correlation between at least two of the plurality of method calls based on the recorded information.

17. The method of claim 16, wherein identifying the correlation comprises determining a relation between at least two of the plurality of method calls based on a heuristic matching of the emitted checksums.

18. The method of claim 16, wherein identifying the correlation comprises determining a relation between at least two of the plurality of method calls based on a heuristic matching of custom headers.

19. The method of claim 16, further comprising displaying transactions related to correlated method calls as a single transaction to a user.

20. The method of claim 19, wherein displaying transactions related to correlated method calls as a single transaction to a user comprises displaying the single transaction with method calls that span between the first and second nodes.

21. A first node configured to mark a transaction for correlation with a related transaction at a second node, said first node comprising:

a memory comprising executable program code; and

a processor configured by the executable program code to determine when a socket connection is opened by the client for a communication destined to the second node, assign a connection ID to the socket connection, emit the connection ID responsive to a successful socket write action by the first node, and emit, at offsets within the communication, respective markers for each of the offsets.

22. The first node of claim 21, wherein the processor is configured to emit an amount of data sent and an amount data received for each socket connection.

23. The first node of claim 21, wherein the processor is configured to emit a checksum value calculated based on the offset.

24. The first node of claim 21, wherein the processor is configured to emit a Jenkins checksum value based on the offset.

25. The first node of claim 21, wherein the processor is configured to emit a checksum and the offset as a pair value.

26. A system configured to correlate communications between a first node and a second node for a transaction of an application running over a network, said system comprising:

a communications interface coupled to the network and configured to receive trace information from at least the first and second nodes;

a processor configured by executable program code to;

monitor a plurality of method calls and a plurality of socket actions for transactions at each of the two or more nodes,

associate a socket ID with each socket connection that is opened,

wherein for each successful socket connection, the socket ID, a local address, and a remote address has been emitted by the first and second nodes,

wherein for each successful socket write action, the socket ID, a current output stream offset, a number of bytes sent, and on selected fixed boundaries and at the end of a socket connection a checksum value has been emitted by the first and second nodes,

wherein for each successful socket read action, the socket ID, a current input stream offset, a number of bytes received, and on selected fixed boundaries and at the end of a socket connection, a checksum value, has been emitted by the first and second nodes,

associate each emission with at least one of the plurality of method calls, record information about each of the plurality of method calls and their corresponding emissions, and

identify a correlation between at least two of the plurality of method calls based on the recorded information.

27. The system of claim 26, wherein the processor is configured to determine a relation between at least two of the plurality of method calls based on a heuristic matching of the emitted checksums.

28. The system of claim 26, wherein the processor is configured to determine a relation between at least two of the plurality of method calls based on a heuristic matching of custom headers.

29. The system of claim 26, wherein the processor is configured to provide information for displaying transactions related to correlated method calls as a single transaction to a user.

30. The system of claim 29, wherein the processor is configured to provide information for displaying the single transaction with method calls that span between the first and second nodes.