Integrating traffic monitoring data and application runtime data

• US 8,656,006 B2
• Filed: 12/04/2006
• Issued: 02/18/2014
• Est. Priority Date: 05/11/2006
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Cobb, Jeffrey R., O'Sullivan, Patrick C., Thio, Ling
• Primary Examiner(s): Choudhury, Azizul
• Assistant Examiner(s): FORMAN, JAMES Q
• Application Number:
  US11/566,454
• Publication Number:
  US 20070266149A1
• Time in Patent Office: 2,633 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5083 wherein the managed service relates to web hosting
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Information is obtained from an application monitoring system which monitors the execution of an application and a traffic monitoring system which monitors traffic between clients and the application. The clients interact with the application to perform transactions or other tasks. Traffic monitoring data, such as information regarding defects and incidents, and application runtime data, such as traces of invoked application components, can be integrated in an output such as an interface to provide an enhanced understanding of system performance. Related traffic monitoring data and application runtime data can be linked by a request-response pair identifier associated with a request provided to the application and a response provided by the application.

Claims

1. A method, comprising:

at a traffic monitoring system;

generating traffic monitoring data by monitoring traffic between a client device and an application server as the client device interacts with an application executing on the application server, the monitoring of the traffic comprises observing the traffic at an intermediate point in a route traversed by the traffic, between the client device and the application server, the client device interacts with the application by sending a request to the application during a session, and the monitoring of the traffic comprises obtaining an identifier of the session from the request;

at an application monitoring system associated with the application server, monitoring execution of an instrumented component of the application while the application executes to prepare a response to the request, assigning a request-response pair identifier to the response, and indexing the request-response pair identifier to application runtime data which is generated from the execution of the instrumented component;

sending the response to the client device, the response comprises the identifier of the session and the request-response pair identifier;

at the traffic monitoring system, detecting the request-response pair identifier and the identifier of the session in the response, associating the request-response pair identifier with the request based on the identifier of the session in the response, and indexing the request-response pair identifier to a corresponding portion of the traffic monitoring data; and

using the request-response pair identifier, providing an output which comprises the corresponding portion of the traffic monitoring data and the application runtime data which is generated from the execution of the instrumented component.

2. The method of claim 1, further comprising:

comparing the monitored traffic to a set of definitions to determine one or more of the definitions that correspond to the monitored traffic, the output which comprises the traffic monitoring data identifies the one or more of the definitions that correspond to the monitored traffic.

3. The method of claim 2, wherein:

the definitions comprise a URL for a web page.

4. The method of claim 2, wherein:

the definitions identify at least one of defects or incidents.

5. The method of claim 2, wherein:

the definitions identify transaction components.

6. The method of claim 2, wherein:

the definitions comprise at least one of an HTTP post parameter, a cookie parameter and a query parameter, the query parameter comprises a name/value pair that appears in an HTTP request line after a first “

?”

character.

7. The method of claim 1, wherein:

the application runtime data which is generated from the execution of the instrumented component comprises a trace which identifies a name of the instrumented component and an execution time of the instrumented component.

8. The method of claim 1, wherein:

the traffic monitoring data comprises at least one of defect data or incident data.

9. The method of claim 1, wherein:

the intermediate point is at a router or switch, and a firewall is between the application server and the intermediate point.

10. The method of claim 1, further comprising:

receiving a data request from an interface host, the data request comprises the request-response pair identifier; and

using the request-response pair identifier in the data request as a filtering criterion to selectively output at least one of;

the corresponding portion of the traffic monitoring data or the application runtime data which is generated from the execution of the instrumented component.

11. The method of claim 1, wherein:

the identifier of the session comprises a session cookie.

12. The method of claim 1, wherein:

the instrumented component comprises at least one of a servlet, a Java Server Page, an Enterprise Java Bean, a Java Database Connectivity component or a .NET component.

13. The method of claim 1, wherein:

the monitoring of the execution of the instrumented component of the application comprises monitoring at least one of bytecode or intermediate language code of the application.

14. The method of claim 1, wherein:

the component comprises a servlet; and

the response comprises a name of the servlet.

15. The method of claim 14, wherein:

the response comprises a response time of the servlet.

16. A processor readable storage device comprising processor readable code embodied thereon for programming a processor to perform a method, the method comprising:

at a traffic monitoring system;

generating traffic monitoring data by monitoring traffic between a client device and an application server as the client device interacts with an application executing on the application server, the monitoring of the traffic comprises observing the traffic at an intermediate point in a route traversed by the traffic, the intermediate point is between the client device and the application server, the client device interacts with the application by sending a request to the application during a session, and the monitoring of the traffic comprises obtaining an identifier of the session from the request;

at an application monitoring system;

monitoring execution of an instrumented component of the application while the application executes to prepare a response to the request, assigning a request-response pair identifier to the response, and providing the request-response pair identifier indexed to application runtime data which is generated from the execution of the instrumented component, in a first data store;

sending the response with the request-response pair identifier to the client device, the response comprises the identifier of the session and the request-response pair identifier;

at the traffic monitoring system, detecting the request-response pair identifier and the identifier of the session in the response, associating the request-response pair identifier with the request based on the identifier of the session in the response, and providing the request-response pair identifier indexed to a corresponding portion of the traffic monitoring data in a second data store; and

using the request-response pair identifier, providing an output which comprises the corresponding portion of the traffic monitoring data and the application runtime data which is generated from the execution of the instrumented component.

17. The processor readable storage device of claim 16, wherein:

the application runtime data which is generated from the execution of the instrumented component comprises a trace identifying a name of the instrumented component and an execution time of the instrumented component.

18. The processor readable storage device of claim 16, wherein:

the monitoring comprises observing the traffic through a passive tap at the intermediate point.

19. The processor readable storage device of claim 16, wherein:

the monitoring comprises intercepting, copying and relaying the traffic at the intermediate point.

20. The processor readable storage device of claim 16, wherein the method performed further comprises:

comparing the monitored traffic to a set of definitions to determine one or more of the definitions that correspond to the monitored traffic, the traffic monitoring data identifying the one or more of the definitions that correspond to the monitored traffic.

21. The processor readable storage device of claim 20, wherein:

the definitions comprise a URL for a web page, an HTTP post parameter or a cookie parameter.

22. The processor readable storage device of claim 20, wherein:

the definitions comprise a query parameter, the query parameter comprises a name/value pair that appears in an HTTP request line after a first “

?”

character.

23. The processor readable storage device of claim 16, wherein the method performed further comprises:

receiving a data request from an interface host, the data request comprises the request-response pair identifier; and

using the request-response pair identifier in the data request as a filtering criterion to selectively output at least one of;

the application runtime data which is generated from the execution of the instrumented component, from the first data store, or the corresponding portion of the traffic monitoring data, from the second data store.

24. The processor readable storage device of claim 16, wherein:

the monitoring execution of the instrumented component comprises monitoring at least one of bytecode or intermediate language code of the application.

25. A monitoring system, comprising:

a storage device; and

a processor in communication with the storage device, the processor;

monitors traffic between a client device and an application server as the client device interacts with an application executing on the application server, where, to monitor the traffic, and to generate traffic monitoring data, the processor observes the traffic at an intermediate point in a route traversed by the traffic, the intermediate point is between the client device and the application server, and the client device interacts with the application by sending a request to the application during a session, the monitoring of the traffic comprises obtaining an identifier of the session from the request, and the application sends a response to the client device in response to the request;

monitors execution of an instrumented component of the application while the application executes to prepare the response;

generates application runtime data of the instrumented component;

assigns a unique request-response pair identifier to the response;

detects the request-response pair identifiers in the response;

indexes the request-response pair identifier to a corresponding portion of the traffic monitoring data;

indexes the request-response pair identifier to the application runtime data of the instrumented component; and

provides an output using the request-response pair identifier, the output which comprises the corresponding portion of the traffic monitoring data and the application runtime data of the instrumented component.

26. The monitoring system of claim 25, wherein:

the application runtime data of the instrumented component comprises a trace which identifies a name of the instrumented component and an execution time of the instrumented component.

27. The monitoring system of claim 25, wherein:

the processor, to monitor the execution of the instrumented component, monitors at least one of bytecode or intermediate language code of the application.