Adaptive correlation of service level agreement and network application performance

• US 7,822,837 B1
• Filed: 12/30/2004
• Issued: 10/26/2010
• Est. Priority Date: 12/30/2004
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Packeteer Incorporated (Gen Digital Inc.)
• Inventors: Urban, Mark, Hoareau, Christian, Lopez Perez, Daniel Jose, Arvin, Rene, Jackson, Simon Adrian, Sjoestroem, Martin Briand
• Primary Examiner(s): Pwu; Jeffrey
• Assistant Examiner(s): Baturay; Alicia
• Application Number:
  US11/027,744
• Time in Patent Office: 2,126 Days
• Field of Search: 709223-224, 709/226
• US Class Current: 709/223
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0864 Round trip delays

Abstract

Methods, apparatuses and systems directed to adaptive monitoring of network application performance. In one implementation, the present invention improves processes used by enterprises to track, manage, and troubleshoot performance of network applications across distributed networks. In one implementation, the present invention allows for a network application performance monitoring scheme that tracks end-to-end performance of selected network applications on a passive basis, while selectively engaging more invasive (synthetic) approaches to tracking performance and troubleshooting issues when needed.

Claims

1. A method for monitoring the performance of a network, comprising:

passively monitoring, at a network device disposed at the edge of a first network, the performance of a network application, wherein the passively monitored performance of the network application is the end-to-end performance of the network application between a first set of hosts connected to the first network and a second set of hosts connected to a second network, wherein the performance of the network application is passively monitored by recording, at the network device, packet arrival times for data flows associated with the network application between the first set of hosts and the second set of hosts, wherein the end-to-end performance of the network application is based on the time data packets spend in transit between the first set of hosts and the second set of hosts during respective transactions, and wherein the time is normalized based on the size of the packets in a given transaction;

repeatedly initiating, at the network device, synthetic transactions at a first predetermined transaction frequency with an intermediate system disposed proximal to the edge of the second network, wherein a third network interconnects the first and second networks, and wherein each synthetic transaction is initially configured with any combination of one or more of;

an interval parameter specifying a repetition interval for the synthetic transaction, a repeat parameter specifying a number of times to issue a request on a connection, an id parameter that uniquely identifying the synthetic transaction, or a url parameter that specifies the type of synthetic transaction to issue; and

in response to the end-to-end performance in the monitoring step crossing over a threshold performance value,

increasing the transaction frequency of the synthetic transactions from the first transaction frequency to a second increased transaction frequency based on one or more observations of the end-to-end performance of the network application;

monitoring the performance of the third network relative to the synthetic transactions transaction at the second increased transaction frequency; and

in response to the end-to-end performance in the monitoring step crossing below the threshold performance value, decreasing the transaction frequency of the synthetic transactions back to the first predetermined transaction frequency.

2. The method of claim 1 wherein at least one synthetic transaction comprises a request transmitted by the first network device, and a response transmitted by the intermediate network device.

3. The method of claim 2 wherein the request comprises an ECHO request.

4. A method, comprising:

at a network device disposed proximal to an edge of a first network,

repeatedly recording packet arrival times for data flows between a first set of hosts connected to the first network and a second set of hosts connected to a second network that are associated with a network application to monitor the end-to-end performance of the network application, wherein the end-to-end performance of the network application is based on the time data packets spend in transit between the first set of hosts and the second set of hosts during respective transactions, and wherein the time is normalized based on the size of the packets in a given transaction;

repeatedly initiating synthetic transactions to the second network at a frequency, wherein the frequency is a default frequency, and wherein each synthetic transaction is initially configured with any combination of one or more of;

an interval parameter specifying a repetition interval for the synthetic transaction, a repeat parameter specifying a number of times to issue a request on a connection, an id parameter that uniquely identifying the synthetic transaction, or a url parameter that specifies the type of synthetic transaction to issue;

computing a first network path metric for the network application based on recently recorded packet arrival times;

if the first network path metric is greater than a threshold value, then

increasing the frequency of the synthetic transactions based on observations of the network path metric;

repeatedly initiating the synthetic transactions to the second network at the increased frequency;

computing a second network path metric for the network application based on recently recorded packet arrival times; and

if the second network path metric is less than or equal to the threshold value, then decreasing the frequency of the synthetic transactions to the default frequency.

5. A system facilitating the monitoring of network application performance, comprising:

a network monitoring device disposed at the edge of a first network, wherein the first network includes at least a first host connected thereto;

an intermediate network device disposed at the edge of a second network, wherein the second network includes at least a second host connected thereto;

a third network interconnecting the first and second networks;

wherein the network monitoring device is operative to;

passively monitor the end-to-end performance of a network application involving the transmission of data flows between the first and second hosts by recording, at the network monitoring device, packet arrival times for data flows associated with the network application between a first set of hosts connected to the first network and a second set of hosts connected to a second network, wherein the end-to-end performance of the network application is based on the time data packets spend in transit between the first set of hosts and the second set of hosts during respective transactions, and wherein the time is normalized based on the size of the packets in a given transaction;

repeatedly initiate synthetic transactions at a first predetermined transaction frequency with the intermediate device, and wherein each synthetic transaction is initially configured with any combination of one or more of;

an interval parameter specifying a repetition interval for the synthetic transaction, a repeat parameter specifying a number of times to issue a request on a connection, an id parameter that uniquely identifying the synthetic transaction, or a url parameter that specifies the type of synthetic transaction to issue; and

if the end-to-end performance associated with the network application crosses over a threshold value,

increase the transaction frequency of the synthetic transactions with the intermediate network device from the first predetermined transaction frequency to a second increased transaction frequency based on one or more observations of the end-to-end performance of the network application;

monitor the performance of the third network relative to the synthetic transactions at the second increased transaction frequency; and

decrease, if the end-to-end performance associated with the network application crosses below the threshold value, the transaction frequency of the synthetic transactions back to the first predetermined transaction frequency.

6. The system of claim 5 wherein the intermediate network device is a network monitoring device.

7. The system of claim 5 wherein the intermediate network device is a router.

8. The system of claim 5 wherein at least one synthetic transaction comprises a request transmitted by the network monitoring device, and a response transmitted by the intermediate network device.

9. The system of claim 8 wherein the request comprises an ECHO request.

10. The system of claim 5 wherein the end-to-end performance of the network application is based on the total time between requests transmitted by the first host and corresponding responses received from the second host by the first host.

11. The system of claim 5 wherein the end-to-end performance of the network application is based on the time required for the first and second host to exchange a data packet.