Monitoring services and service consumers

• US 8,625,757 B1
• Filed: 06/24/2011
• Issued: 01/07/2014
• Est. Priority Date: 06/24/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Kozolchyk, Jonathan, Karpov, Alexandre, McAdams, Darin Keith, Ding, Peter S, Fielding, Jeffrey J
• Primary Examiner(s): Tran, Quoc D
• Application Number:
  US13/168,747
• Time in Patent Office: 928 Days
• Field of Search: 379/112.03, 379/112.05, 379/112.06, 705/10
• US Class Current: 379/112.06
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/51 for resellers, retailers or service providers
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/60 based on actual use of network resources
• CPC Class Codes: H04M 15/61 based on the service used

Abstract

A monitoring service may receive, from a plurality of service providers, log information pertaining to access calls made by service consumers to services or APIs provided by the service providers. The monitoring service aggregates and analyzes the log information for use in monitoring performance of the services, identifying anomalies, and the like. In some instances, the monitoring service may identify multiple services that are behaviorally interrelated based on at least one performance metric, and may group these services together into service groups for monitoring purposes. A service relationship model may be generated for each of the service groups that predicts how each service will behave relative to the other services in the service group. The monitoring service may monitor performance and use of the services based, at least in part, on the one or more service groups and the service relationship model for each group.

Claims

1. One or more computer-readable media storing computer-executable instructions that, when executed, cause one or more processors to perform operations comprising:

receiving from a plurality of service providers, service consumer access information relating to service consumer calls made during a first period of time to a plurality of application programming interfaces (APIs) provided by the plurality of service providers;

grouping the APIs into one or more service groups based, at least in part, on determining that the APIs in each service group have at least one performance metric that is interrelated to the at least one performance metric of other APIs that are members of the service group;

generating a service relationship model for each service group based, at least in part, on observed behavior of the members of the service group with respect to one another for the at least one performance metric, the service relationship model predicting relative behaviors of members of the service group with respect to one another for the at least one performance metric;

receiving from a plurality of service providers, service consumer access information relating to service consumer calls made over a subsequent period of time to the APIs provided by the service providers; and

monitoring performance of the APIs based, at least in part, on the one or more service groups and the service relationship model for each service group.

2. The one or more computer-readable media as recited in claim 1, wherein the at least one performance metric comprises at least one of:

call volume of each API in the service group as a function of time;

or

latency of each API in the service group as a function of time.

3. The one or more computer-readable media as recited in claim 1, the operations further comprising:

determining that a first value related to the at least one performance metric for a first API in a first service group has changed;

determining that a second value related to the at least one performance metric for a second API in the first service group has not changed in a manner predicted by the service relationship model for the first service group; and

generating an alert based, at least in part, on failure of the APIs in the first service group to behave in accordance with the service relationship model for the first service group.

4. The one or more computer-readable media as recited in claim 1, the operations further comprising:

providing an agent to each service provider of the plurality of service providers; and

receiving, from the agents, log information relating to the service consumer calls to one or more of the APIs provided by each service provider.

5. The one or more computer-readable media as recited in claim 4, the operations further comprising aggregating the log information received from the agents at periodic intervals to determine for a particular interval a plurality of the performance metrics related to the service consumer calls to the plurality of APIs provided by the plurality of service providers.

6. A method comprising:

grouping, by a computing device, based at least in part on performance information received over a first period of time, services of a plurality of services into one or more service groups, wherein individual service groups comprise a subset of the services determined to be interrelated with respect to a corresponding performance metric; and

monitoring, over a second period of time, performance of the services within a particular one of the service groups with respect to other services in the particular service group for the corresponding performance metric.

7. The method as recited in claim 6, further comprising:

generating a service relationship model corresponding to the particular service group, the service relationship model predicting relative behaviors of members of the particular service group with respect to one another for the performance metric; and

applying the service relationship model for the particular service group when monitoring the behavior of the services in the particular service group.

8. The method as recited in claim 6, wherein the performance metric is a volume of calls received by individual services from service consumers.

9. The method as recited in claim 6, wherein the performance metric is a response time for responding to calls received by individual services from service consumers.

10. The method as recited in claim 6, further comprising:

receiving, from the plurality of services, log information relating to service consumer calls to the plurality of services; and

aggregating the log information at periodic intervals to generate aggregated log information for the plurality of services, the aggregated log information including the performance metric for the plurality of services, the performance metric related to the service consumer calls to the plurality of services.

11. The method as recited in claim 10, further comprising determining from the aggregated log information which service consumer of a plurality of service consumers is a top contributor to the performance metric.

12. The method as recited in claim 10, further comprising displaying at least a portion of the aggregated log information in a user interface.

13. The method as recited in claim 6, further comprising generating an alert based, at least in part, on failure of the services in the particular service group to behave with respect to one another in accordance with a prediction of behavior for the services in the particular service group.

14. The method as recited in claim 13, further comprising:

identifying a service consumer that is a cause, at least in part, of failure of the services in the particular service group to behave in accordance with the prediction; and

blocking access of the service consumer to at least one service in the particular service group.

15. The method as recited in claim 13, further comprising:

determining that a particular service of the services in the particular service group is a cause, at least in part, of failure of the services in the particular service group to behave in accordance with the prediction; and

slowing access of one or more service consumers to the particular service.

16. One or more computing devices comprising:

one or more processors;

one or more computer-readable media coupled to the one or more processors;

one or more modules maintained on the one or more computer-readable media and which, when executed by the one or more processors, cause the one or more processors to;

receive, over a first period of time, log information related to calls made by service consumers to a plurality of services;

identify, based at least in part on the log information, a plurality of service groups, wherein individual ones of the service groups include a respective subset of the services, wherein the services in a particular subset are determined to have a performance-related interrelationship with one another based, at least in part, on at least one performance metric; and

monitor, over a second period of time, relative performance of the services within the particular subset of the services corresponding to a respective one of the service groups.

17. The one or more computing devices as recited in claim 16, wherein the one or more modules are further executed to generate a service relationship model corresponding to the respective service group of the plurality of service groups, the service relationship model predicting behavior of the subset of the services in the corresponding respective service group with respect to one another for the at least one performance metric.

18. The one or more computing devices as recited in claim 17, wherein the one or more modules are further executed to periodically update at least one of the plurality of service groups or the corresponding service relationship model as services are changed or new services are added to the plurality of services.

19. The one or more computing devices as recited in claim 17, wherein the one or more modules are further executed to identify an anomaly in the calls to a particular service based, at least in part, on determining that behavior of the particular service is not in accordance with the service relationship model for the service group including the particular service.

20. The one or more computing devices as recited in claim 19, wherein the one or more modules are further executed to identify a particular service consumer as a top contributor to the anomaly.

21. The one or more computing devices as recited in claim 20, further comprising a user interface maintained on the computer-readable media and executed on the one or more processors to provide a remedial action control for blocking access of the particular service consumer to the particular service.