Model-driven, repository-based application monitoring system

• US 7,814,198 B2
• Filed: 10/26/2007
• Issued: 10/12/2010
• Est. Priority Date: 10/26/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kishore, Mandyam N., Vannelli, Leo S. III, Dhoot, Anubhav, Borsa, Mariusz G., Kulkarni, Amol Sudhakar, Wu, Haoran Andy, Sedukhin, Igor, Christensen, Erik B.
• Primary Examiner(s): Hu; Jinsong
• Application Number:
  US11/925,326
• Publication Number:
  US 20090112559A1
• Time in Patent Office: 1,082 Days
• Field of Search: 709/203, 709/224, 709/225, 709/204, 709/212, 707/100
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 2209/544 Remote
• CPC Class Codes: G06F 8/10 Requirements analysis; Specification techniques
• CPC Class Codes: G06F 8/35 model driven
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Enabling and processing events. To enable events, an application model correlated to an application is declaratively defined. The application model describes operations of the application. One or more event models correlated to the application model are declaratively defined. The event models describe application execution locations where events are desired to be emitted in the execution of the application. Based on the correlation of the event models to the application models, the applications are instrumented with instrumentation code to cause the application to emit events at the execution locations. To process events an application model is defined. The application model includes one or more observation models. The observation models include a correlation of events to the observation model by defining instrumentation models in the application model. An event is received. The event is applied to the observation model based on the correlation. The event is processed according to the observation model.

Claims

1. In a distributed computing environment, a method of enabling events from applications, the method performed upon one or more computer processors, the method comprising;

declaratively defining an application model correlated to an application, the application model describing operations of the application;

declaratively defining one or more event models correlated to the application model, the event models describing application execution locations where events are desired to be emitted in the execution of the application;

based on the correlation of the event models to the application models, instrumenting the applications with instrumentation code to cause the application to emit events at the execution locations; and

defining an aggregation point for aggregating events wherein aggregating events comprises combining events through logical operations.

2. The method of claim 1, further comprising emitting events by driving the applications and causing the execution of the instrumentation code.

3. The method of claim 2, further comprising using emitted events to adaptively control the application.

4. The method of claim 1, wherein the instrumentation code causes events emitted to include a reference to an application model corresponding to the event.

5. The method of claim 1, further comprising:

routing the generated events to the aggregation point defined for the event.

6. The method of claim 5, wherein defining an aggregation point for events comprises defining a hierarchical event aggregation system where events aggregated at a plurality of aggregation point are aggregated at a higher level aggregation point.

7. The method of claim 5, wherein defining an aggregation point for events comprises defining an aggregation point that is distributed across a plurality of nodes.

8. The method of claim 5, wherein at the aggregation point, the events are manipulated.

9. The method of claim 8, wherein manipulating events comprises storing the events.

10. The method of claim 8, wherein manipulating events comprises generating key performance indicators from aggregated events.

11. A method of processing events, the method performed upon one or more computer processors, the method comprising;

defining an application model, wherein the application model includes one or more observation models, wherein the observation models comprise a correlation of events to the observation model by defining instrumentation models in the application model;

receiving an event;

applying the event to the correlated observation model based on the correlation; and

processing the event according to the observation model, wherein processing the event comprises aggregating events and wherein aggregating events comprises combining events through logical operations.

12. The method of claim 11, wherein processing the event according to the observation model comprises storing the event.

13. The method of claim 11, wherein processing the event according to the observation model comprises processing the event in aggregators arranged hierarchically.

14. The method of claim 11, wherein processing the event according to the observation model comprises sending events to an aggregator based on the event type.

15. The method of claim 11, wherein processing the event according to the observation model comprises monitoring events using a generic monitoring module wherein the generic monitoring module references an input event definition to correlate output from an event source with input to an event listener.

16. A monitoring system comprising:

a repository, wherein the repository comprises models of applications, wherein the models of applications include instrumentation models correlated to application execution locations where events are desired to be emitted;

one or more event processors configured to receive events from an instrumented application, wherein at least one of the one or more event processors is configured to aggregate events; and

drivers coupled to repository, wherein the drivers are configured to instrument application code based on the correlation of instrumentation models to application execution locations.

17. The system of claim 16, wherein at least one of the one or more event processors belongs to a hierarchical event aggregation structure.

18. The system of claim 16, further comprising one or more event stores configured to store events.