Correlating protocol events in distributed applications

• US 6,618,766 B1
• Filed: 09/29/1999
• Issued: 09/09/2003
• Est. Priority Date: 09/29/1999
• Status: Expired due to Fees

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Eshghi, Kave
• Primary Examiner(s): Courtenay, III, St. John
• Assistant Examiner(s): Nguyen, Van H.
• Application Number:
  US09/408,734
• Time in Patent Office: 1,441 Days
• Field of Search: 709/224, 709/318, 709/230, 709/223, 707/6, 714/48, 700/108
• US Class Current: 719/318
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Mechanisms for correlating protocol events in a distributed application to the high level transactions that caused the protocol events. The mechanisms for correlating include a set of protocol sensors which are associated with the components of the distributed application. Each protocol sensor detects the protocol events generated by its corresponding component of the distributed application. The detection of protocol events by the protocol sensors is non-invasive in that it does not require recoding or recompilation of software components or redesign or modification of hardware components. The mechanisms for correlating also include a set of event correlators associated with the protocol sensors. Each event correlator uses the results of a prior training phase for the distributed application to determine which of a set of high level transactions in the distributed application caused the corresponding protocol events.

Claims

1. A distributed application, comprising:

a set of components;

a set of protocol sensors associated with the components, each protocol sensor for detecting a series of protocol events generated by a corresponding one of the components;

a trigger associated with each of a set of high level transactions that may occur in the distributed application wherein the triggers are determined during a training phase in the distributed application;

a set of event correlators associated with the protocol sensors, each event correlator for determining which of the high level transactions caused the corresponding protocol events by determining a set of features of each protocol event and finding the triggers that correspond to the features.

2. The distributed application of claim 1, wherein the components include one or more hardware components.

3. The distributed application of claim 1, wherein the components include one or more software components.

4. The distributed application of claim 1, wherein one or more of the high level transactions is an end-user transaction.

5. The distributed application of claim 1, wherein one or more of the high level transactions is a business transaction.

6. The distributed application of claim 1, wherein during the training phase a set of end-user transactions associated with the high level transactions are executed in the distributed application and a set of samples are obtained from the protocol sensors.

7. The distributed application of claim 6, wherein during the training phase a set of tables are constructed that associate the samples to the high level transactions that caused the samples.

8. The distributed application of claim 6, wherein during the training phase the tables are analyzed to determine the triggers for determining the high level transactions.

9. A method for correlating protocol events in a distributed application, comprising the steps of:

determining a trigger for each of a set of high level transactions that may occur in the distributed application during a training phase in the distributed application;

detecting a series of protocol events generated by each of a set of components of the distributed application;

determining which of the high level transactions caused the corresponding protocol events by determining a set of features of each protocol event and finding the triggers that correspond to the features.

10. The method of claim 9, wherein the step of determining which of the high level transactions caused the corresponding protocol events comprises the step of determining which of a set of end-user transactions in the distributed application caused the corresponding protocol events.

11. The method of claim 9, wherein the step of determining which of the high level transactions caused the corresponding protocol events comprises the step of determining which of a set of business transactions in the distributed application caused the corresponding protocol events.

12. The method of claim 9, wherein the training phase comprises the steps of executing a set of end-user transactions associated with the high level transactions and obtaining a set of samples of the protocol events.

13. The method of claim 12, wherein the training phase further comprises the step of constructing a set of tables that associate the samples to the high level transactions that caused the samples.

14. The method of claim 12, wherein the training phase further comprises the step of analyzing the tables to determine the triggers for the high level transactions.