Platform for computer process monitoring

• US 7,000,150 B1
• Filed: 06/12/2002
• Issued: 02/14/2006
• Est. Priority Date: 06/12/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Green, Bradley Ray, Zunino, Gilles
• Primary Examiner(s): Bonzo, Bryce P.
• Application Number:
  US10/167,836
• Time in Patent Office: 1,343 Days
• Field of Search: 714/38, 714/46, 714/57, 714/10, 714/16, 714/8, 714/19
• US Class Current: 714/38.11
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Monitoring components that provide monitors for computer processes are disclosed, including a monitoring component that provides multiple monitors that may be selectively activated for a particular process where each monitor is responsive to a different type of event that signifies a defect. The monitoring component provides monitors including a debugger monitor, window monitor, a hang monitor, and a timeout monitor that may individually or collectively be activated for a process. A Remote Monitoring component is disclosed that consolidates control for multiple monitoring components instantiated for multiple processes on one computer where each monitoring component has one or more monitors that are activated. A Remote Monitor Client component is also disclosed and consolidates control for multiple remote monitoring components that are instantiated on multiple computers to control monitoring components attached to the distributed processes of one or more applications.

Claims

1. A method of monitoring multiple processes of a computer, comprising:

instantiating a remote monitoring component for controlling individual monitoring components, the remote monitoring component having at least one interface, wherein each individual monitoring component includes a set of multiple monitors;

for each process being monitored under the remote monitoring component, instantiating on the computer an individual monitoring component providing at least one monitor and at least one interface;

for each instantiated individual monitoring component, activating the at least one monitor that is responsive to a particular type of even, wherein each of the multiple monitors of the set are selectively activatable when instantiating each individual monitoring component;

for each process being monitored, detecting events with the at least one monitor of the monitoring component;

when an event is detected by the at least one monitor for a process, reporting an indication of the event through the at least one interface to the remote monitoring component; and

once an indication of the event is reported to the remote monitoring component, reporting the event from the remote monitoring component through the at least one interface of the remote monitoring component.

2. The method of claim 1, wherein the indication of the event reported through the interface of the individual monitoring component comprises a process ID.

3. The method of claim 1, wherein the set includes a service monitor, a debugger monitor, a window monitor, a time-out monitor, and a hang monitor.

4. The method of claim 1, further comprising starting the process to be monitored by specifying a target for the instantiated monitoring component from the remote monitoring component.

5. The method of claim 1, further comprising after receiving the indication of the event from the individual monitoring component, filtering the indication based upon at least one criteria and reporting the event from the remote monitoring component through the at least one interface of the remote monitoring component when the indication of the event passes through the filtering.

6. The method of claim 5, wherein filtering is performed by an event filter specific to each individual monitoring component and the event filter is configured to modify the indication of the event received from the individual monitoring component prior to reporting the indication of the event.

7. A remote monitoring component that monitors multiple processes on a computer, comprising:

at least one interface;

a queue;

a monitoring component control that directs instantiation of individual monitoring components, receives indications of detected events from the individual monitoring components, and stores the indications in the queue;

a session table that stores the identification of each individual monitoring component that is instantiated as a session; and

an event handler that reports the indications in the queue through the at least one interface.

8. The remote monitoring component of claim 7, wherein the monitoring component control activates at least one monitor from a set of monitors provided by the individual monitoring component.

9. The remote monitoring component of claim 7, wherein a separate event handler is provided for each session of the session table.

10. The remote monitoring component of claim 7, wherein the remote monitoring component is a COM object.

11. A method of monitoring multiple processes distributed across a plurality of computers, comprising:

on a computer that monitors the multiple processes, instantiating a remote monitor client component that controls remote monitoring components on the plurality of computers and that has at least one interface;

on each computer running a process being monitored, instantiating a remote monitoring component that controls at least one individual monitoring component and that has at least one interface;

for each process being monitored, instantiating on the computer running the process an individual monitoring component that provides at least one monitor and at least one interface;

for each instantiated monitoring component, activating the at least one monitor wherein the at least one monitor is responsive to a particular type of event;

for each process being monitored, detecting events with the at least one monitor of the monitoring component; and

when an event is detected by the one or more monitors of a process, reporting an indication of the event and the process where the event occurred through the at least one interface of the monitoring component to the remote monitoring component; and

when the remote monitoring component obtains an indication of an event from the monitoring component, reporting the indication of the event, the process where the event occurred, and the computer running the process from the remote monitoring component to the remote monitor client component.

12. The method of claim 11, further comprising storing the indications of events received from the remote monitoring component in a table of the remote monitor client component.

13. The method of claim 12, further comprising prioritizing the indications of events in the table according to severity and time of occurrence.

14. The method of claim 13, further comprising removing the indications of events from the table starting with the indication of event having the highest priority.

15. The method of claim 11, wherein activating the at least one monitor comprises activating one or more monitors from a set of monitors of the monitoring component.

16. The method of claim 11, wherein reporting each indication of an event from the remote monitoring component to the remote monitor client component comprises reporting an indication that includes a process ID and a machine ID.

17. The method of claim 11, further comprising starting the process to be monitored by specifying a target for the instantiated monitoring component from the remote monitor client component to the remote monitor component, and from the remote monitoring component to the monitoring component.

18. The method of claim 11, wherein on the computer that instantiates the remote monitor client component, running a process being monitored and instantiating a remote monitoring component that controls at least one individual monitoring component and that has at least one interface.

19. A remote monitor client component for monitoring processes on multiple computers, comprising:

at least one interface;

an event table storing indications of events;

a remote monitoring component control that directs instantiation of individual remote monitoring components for each of the multiple computers, receives indications of detected events from the individual remote monitoring components, and stores the indications in the table, and wherein the remote monitoring components control individual monitoring components that provide at least one monitor for the processes on the multiple computers;

a session table that stores the identification of each individual remote monitoring component that is instantiated as a session; and

an event handler that reports the indications in the event table through the at least one interface.

20. The remote monitor client component of claim 19, wherein the remote monitoring component controls activate at least one monitor from a set of monitors provided by the individual monitoring components.

21. The remote monitor client component of claim 19, wherein a separate event handler is provided for each session of the session table.

22. The remote monitor client component of claim 19, wherein the remote monitor client component is a COM object.

23. A computer readable medium containing instructions that when executed perform the steps of:

instantiating a remote monitor client component for controlling individual remote monitoring components, the remote monitor client component having at least one interface;

directing the instantiation of a plurality of remote monitoring components that control at least one monitoring component where each remote monitoring component has at least one interface;

on each computer running a process being monitored, in response to directing the instantiation of a plurality of remote monitoring components, instantiating a remote monitoring component that controls at least one individual monitoring component and that has at least one interface;

for each process being monitored instantiating on a computer running the process an individual monitoring component that provides at least one monitor and at least one interface;

for each instantiated monitoring component activating the at least one monitor wherein the at least one monitor is responsive to a particular type of event;

for each process being monitored, detecting events with the at least one monitor of the monitoring component;

when an event is detected by the one or more monitors of a process, reporting an indication of the event and the process where the event occurred through the at least one interface of the monitoring component to the remote monitoring component; and

when the remote monitoring component obtains an indication of an event from the monitoring component, reporting the indication of the event, the process where the event occurred, and the computer running the process from the remote monitoring component to the remote monitor client component; and

once an indication of an event is reported to the remote monitor client component through the interface of a remote monitoring component, prioritizing the indication of the event from the remote monitoring component.