Automatic correlation of service level agreement and operating level agreement

• US 8,578,017 B2
• Filed: 12/13/2006
• Issued: 11/05/2013
• Est. Priority Date: 05/11/2006
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Cobb, Jeffrey R., Thio, Ling, Zuzga, Brian
• Primary Examiner(s): NGUYEN, PHUOC H
• Application Number:
  US11/610,409
• Publication Number:
  US 20070263541A1
• Time in Patent Office: 2,519 Days
• Field of Search: 709/224, 709/203, 709/217, 709/219, 709/223, 709/238
• US Class Current: 709/224
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/12 Network monitoring probes

Abstract

Data collected during runtime and associated with a service level agreement and operating level agreement for a network service are automatically correlated together. A network monitoring system monitors the network service during runtime to determine SLA and OLA violations. An SLA is tested against traffic monitoring data derived from monitoring traffic between a network service system and one or more users of the system. An OLA is tested against application runtime data generated from monitoring a transaction occurring between an application server and a backend or other internal entity of the network service system. The data collected during runtime can be correlated using a hierarchy based on business transactions or in some other manner. Because the traffic monitoring data and application runtime data are organized using a similar data hierarchy, the traffic monitoring data corresponding to an SLA may be correlated to the application runtime data corresponding to the same business transaction and one or more OLAs.

Claims

1. A computer-implemented method, comprising:

collecting traffic monitoring data over a period of time by monitoring traffic between a client device and an application which runs at an application server, wherein the traffic comprises a request from the client device to the application server, the application responds to the request by communicating a response to the client device, the response comprises a request-response pair identifier of the request and the response;

comparing the traffic monitoring data to a set of service level thresholds;

based on the comparing, identifying a portion of the traffic monitoring data which violates a service level threshold of the set of service level thresholds;

determining a first transaction which is associated with the portion of the traffic monitoring data;

collecting application runtime data of the application over the period of time by monitoring execution of the application;

comparing the application runtime data to a set of operating level thresholds; and

automatically correlating the portion of the traffic monitoring data to a portion of the application runtime data, wherein the automatically correlating comprises using the request-response pair identifier to identify the portion of the application runtime data as being associated with the first transaction and classifying the traffic monitoring data and the application runtime data according to a set of transaction definitions.

2. The computer-implemented method of claim 1, wherein the first transaction is determined by comparing the traffic to a set of definitions to identify one of the definitions that correspond to the first transaction.

3. The computer-implemented method of claim 2, wherein the set of definitions identify transaction components of transactions comprising the first transaction.

4. The computer-implemented method of claim 1, further comprising:

generating traffic monitoring data by monitoring traffic between the classifying the traffic into transactions comprising the first transaction.

5. The computer-implemented method of claim 4, wherein the comparing traffic monitoring data to the set of service level thresholds comprises:

identifying traffic monitoring data to compare with the set of service level thresholds; and

classifying the identified traffic monitoring data as a transaction which matches a service level threshold transaction.

6. The computer-implemented method of claim 1, wherein:

the portion of the application runtime data is generated by the application when the application executes in response to the portion of the traffic monitoring data.

7. The computer-implemented method of claim 1, wherein the set of operating level thresholds corresponds to a transaction initiated by the application in response to a network server.

8. The computer-implemented method of claim 1, wherein:

the portion of the application runtime data is identified as being associated with the first transaction when the portion of the application runtime data matches a same transaction definition of the set of transaction definitions as the portion of the traffic monitoring data.

9. The computer-implemented method of claim 1, wherein:

said the automatically correlating comprises retrieving the request-response pair identifier from the response, and the using the request-response pair identifier is responsive to the retrieving.

10. The computer-implemented method of claim 1, wherein the automatically correlating comprises:

organizing the traffic monitoring data and the application runtime data using a common hierarchy.

11. The computer-implemented method of claim 1, wherein:

the application communicates with a back end device when the application executes, and the set of operating level thresholds is applied to communications between the application and the back end device.

12. The computer-implemented method of claim 1, wherein:

the application is a particular application among multiple applications which communicate with a back end device when the multiple applications execute; and

the portion of the traffic monitoring data is automatically correlated with the particular application.

13. The computer-implemented method of claim 1, wherein:

the first transaction is determined to be associated with the portion of the traffic monitoring data by determining that the first transaction is associated with the service level threshold which is violated.

14. The computer-implemented method of claim 1, wherein:

the portion of the application runtime data is identified as being associated with the first transaction by determining that one of the operating level thresholds is associated with the first transaction, and determining that the portion of the application runtime data is associated with the one of the operating level thresholds.

15. The computer-implemented method of claim 1, further comprising:

indexing the application runtime data to the request-response pair identifier to provide indexed application runtime data, the using the request-response pair identifier comprises accessing the indexed application runtime data.

16. The computer-implemented method of claim 1, wherein:

the response comprises an IP address of the application server; and

the automatically correlating the portion of the traffic monitoring data to the portion of the application runtime data uses the IP address to identify the portion of the application runtime data as being associated with the first transaction.

17. The computer-implemented method of claim 1, wherein:

the response comprises a name of an agent associated with the application; and

the automatically correlating the portion of the traffic monitoring data to the portion of the application runtime data uses the name of the agent to identify the portion of the application runtime data as being associated with the first transaction.

18. A processor readable storage device comprising processor readable code embodied on the processor readable storage devices, the processor readable code for programming a processor to perform a method comprising:

determining whether a portion of traffic monitoring data collected over a period of time satisfies a set of service level thresholds associated with a network transaction, the traffic monitoring data is collected by monitoring traffic between a client device and an application which runs at an application server, the traffic comprises a request sent from the client device to the application server and a corresponding response sent from the application server to the client device, the response comprises identifying data of the application server, and the monitoring comprises retrieving the identifying data of the application server;

accessing application runtime data associated with a set of operating level thresholds for a transaction initiated by the application, wherein the application runtime data is generated by monitoring execution of the application, the application runtime data is indexed to the identifying data, each application transaction is initiated by the network transaction and the accessing application runtime data comprises classifying the application runtime data according to a set of transaction definitions; and

automatically correlating the portion of traffic monitoring data and the application runtime data that correspond to a same network transaction using the application runtime data.

19. The processor readable storage device of claim 18, wherein the determining comprises:

identifying network transactions by comparing the traffic to the set of transaction definitions.

20. The processor readable storage device of claim 18, wherein the determining comprises:

comparing the traffic to transaction definitions and

generating traffic monitoring data that identifies a definition that matches the traffic.

21. The processor readable storage device of claim 18, wherein the identifying data of the application server comprises an identifier of an agent of the application server, the agent generates the application runtime data.

22. The processor readable storage device of claim 18, wherein the method performed further comprises:

reporting traffic monitoring data that did not satisfy the set of service level thresholds and reporting the application runtime data associated with the same network transaction as the reported traffic monitoring data.

23. The processor readable storage device of claim 18, wherein:

said the identifying data of the application server comprises a name of an agent associated with the application.

24. The processor readable storage device of claim 18, wherein:

said the identifying data of the application server comprises a class name of a servlet which is involved in generating the response.

25. The processor readable storage device of claim 18, wherein:

said the identifying data of the application server comprises an IP address of the application server.

26. The processor readable storage device of claim 18, wherein:

said the identifying data of the application server comprises an identifier of a request handler which is an entry point to the application.

27. A computer-implemented method, comprising:

configuring service level thresholds to be satisfied by traffic between a client and a network server, and a period of time over which to measure compliance to the service level thresholds, the service level thresholds are configured from a set of transaction definitions;

monitoring the traffic to provide traffic monitoring data;

configuring operating level thresholds to be satisfied by an application which responds to a request in the traffic from the client;

monitoring execution of the application to provide application runtime data;

classifying the traffic monitoring data and the application runtime data according to the set of transaction definitions;

triggering a violation event when one of the service level thresholds has not been satisfied by the network server over the period of time; and

in response to the violation event, automatically providing a portion of the traffic monitoring data which is associated with the violation event to a service level agreement manager, the service level agreement manager responding to the violation event by determining a business transaction associated with the portion of the traffic monitoring data, and automatically determining one of the operating level thresholds that corresponds to the business transaction.

28. The computer-implemented method of claim 27, wherein:

the operating level thresholds are configured from observed communications involving the application.

29. The computer-implemented method of claim 27, wherein:

the one of the service level thresholds that has not been satisfied is identified by comparing the service level thresholds to the traffic monitoring data.

30. A computer-implemented method, comprising:

accessing traffic monitoring data derived from monitoring network server traffic and associated with a set of service level thresholds, the network server traffic comprises requests sent from client devices to an application running at an application server, and corresponding responses sent from the application server to the client devices, the responses comprise identifying data of the application server, and the monitoring network server traffic comprises retrieving the identifying data from the responses;

identifying transaction information, comprising the identifying data from the responses, from the traffic monitoring data; and

using the identifying data to automatically access application runtime data generated from monitoring the application when the application processes the network server traffic, wherein the application runtime data is associated with the transaction information, the traffic monitoring data is classified by a transaction hierarchy and the application runtime data is organized into a hierarchy associated with business transactions.

31. The computer-implemented method of claim 30, wherein the identifying transaction information comprises:

comparing the traffic monitoring data to the set of service level thresholds to determine whether the service level thresholds are satisfied.

32. The computer-implemented method of claim 31, wherein the identifying transaction information comprises:

identifying transaction information from traffic monitoring data associated with one of the service level thresholds that is not satisfied.

33. The computer-implemented method of claim 30, wherein the identifying data comprises an IP address of the application server.

34. A computer-implemented method, comprising:

receiving requests at an application which executes on a network server, the requests are from clients over a period of time, the application processing the requests by sending corresponding requests from the application to a remote system, the remote system returning information to the application for responding to the requests, an agent associated with the application correlating the requests from the clients with the requests to the remote system, and the agent providing application runtime data relating to communications between the application and the network server for the period of time;

comparing the application runtime data to a set of operating level thresholds; and

responsive to the agent, classifying the application runtime data with the requests from the clients, the requests to the remote system, an identifier of the application and an identifier of the remote system.

35. The computer-implemented method of claim 34, further comprising:

tracing execution of the application which occurs in response to the requests from the clients, wherein the correlating and the classifying are responsive to the tracing.