Capture, analysis, and visualization of concurrent system and network behavior of an application

• US 8,694,621 B2
• Filed: 08/16/2006
• Issued: 04/08/2014
• Est. Priority Date: 08/19/2005
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: Baron, Steven J., Malloy, Patrick J., Cohen, Alain J., Schneider, Marc I., Stocks, Cheryl D.
• Primary Examiner(s): Serrao, Ranodhi
• Assistant Examiner(s): Hussain, Farrukh
• Application Number:
  US11/505,176
• Publication Number:
  US 20070043861A1
• Time in Patent Office: 2,792 Days
• Field of Search: 709/223, 709/224, 709/225, 709/226, 709/231, 709/232, 709/248, 709/250
• US Class Current: 709/224
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A first capture system that captures network communication events related to an application, and a second capture system that captures internal processing events related to the application. A visualization system analyzes the data captured by each of the capture systems, synchronizes and correlates the data, and presents an integrated display of these communication and processing events. In a preferred embodiment, the communicated messages include an identifier of the application, and the processing components also associate an identifier of the application to each recorded processing event. To facilitate the integrated display of the events, the visualization system synchronizes the recorded communication and processing events to a common time base.

Claims

1. A system comprising:

a network capture system that is configured to capture communication events of an application on a network,

a tier capture system that is configured to capture processing events of the application on a node of the network, and

a visualization system that is configured to provide a synchronized display of the communication events and processing events of the application,

wherein each communication event includes information that facilitates identification of the application.

2. The system of claim 1, wherein

at least some of the communication events are recorded based on a first time base,

at least some of the processing events are recorded based on a second time base that differs from the first time base, and,

the visualization system is configured to determine a common time base and its relation to the first and second time bases.

3. The system of claim 1, wherein the processing events include application function calls within the application.

4. The system of claim 3, wherein the function calls include execution of classes, methods, or objects.

5. The system of claim 1, wherein the application includes instrumentation that is configured to provide a record of times associated with function calls within the application.

6. The system of claim 5, wherein the record of times associated with function calls includes a hierarchical record of the function calls.

7. The system of claim 5, wherein the instrumentation includes at least one of:

a Java Virtual Machine Profiling Interface (JVM PI),

a Java Virtual Machine Tool Interface (JVM TI), and

a .NET Profiling API.

8. The system of claim 5, wherein the instrumentation is configured to provide ancillary information that facilitates identification of the function calls, including at least one of:

an invoking URL, a user name, classes, methods, and SQL strings.

9. The system of claim 5, wherein the instrumentation is configured to be selectively enabled.

10. The system of claim 9, wherein the instrumentation is selectively enabled based on at least one of an invoking URL and a function name.

11. The system of claim 9, wherein the selective enabling is configured to limit at least one of a quantity and rate of the record of times associated with function calls.

12. The system of claim 5, wherein the record of times includes:

a first record that is stored as a temporary record of each record of time within a time interval, and

a second record that is stored based on selection criteria applied to the first record.

13. The system of claim 12, wherein the selection criteria includes exception criteria that is configured to distinguish between routine events and recordable events.

14. The system of claim 5, wherein the instrumentation is configured to trace the processing events across different threads of the application.

15. The system of claim 1, wherein the tier capture system includes:

a tier capture agent that is configured to determine times associated with function calls within the application, and

a tier capture filter that is configured to filter the times associated the function calls based on user definable preferences.

16. The system of claim 15, wherein

the user definable preferences include a mapping of one or more function calls to one or more function groups, and

the tier capture filter is configured to provide composite time parameters corresponding to each function group.

17. The system of claim 16, wherein

the user definable preferences include a mapping of one or more function groups to one or more upper-level function groups in a hierarchical manner, and

the tier capture filter is configured to provide other composite time parameters corresponding to at least one of the upper-level function groups, based on the composite time parameters corresponding to the function groups within the upper-level function groups.

18. The system of claim 1, wherein the network capture system includes

a network capture agent that is configured to determine times associated with communications to and from the node, and

a network capture filter that is configured to filter the times associated with the communications to identify communications associated with the application.

19. The system of claim 1, wherein the visualization system includes an analysis module that is configured to correlate the communication events and the processing events.

20. The system of claim 19, wherein the analysis module correlates the communication and processing events based on Internet Protocol (IP) addresses and ports.

21. The system of claim 19, wherein the analysis module correlates the communication and processing events based on corresponding send and receive communication events.

22. The system of claim 19, wherein the analysis module is configured to determine statistics related to the processing events.

23. The system of claim 22, wherein the analysis module is configured to determine the statistics corresponding to a hierarchical organization of the processing events, to facilitate display of the statistics at multiple levels of detail.

24. The system of claim 19, wherein the visualization system includes a graphical user interface.

25. The system of claim 24, wherein the graphical user interface is configured to display a timing diagram that illustrates associations between the communication and processing events.

26. The system of claim 24, wherein the graphical user interface is configured to display statistics related to the processing events.

27. The system of claim 26, wherein the graphical user interface is configured to facilitate display of the statistics at multiple levels of detail.

28. The system of claim 24, wherein the graphical user interface is configured to facilitate selective display of information related to the communication and processing events.

29. The system of claim 28, wherein the selective display includes a user selectable arrangement for sorting the communication and processing events.

30. The system of claim 29, wherein the selective display includes a Gantt-type display of the processing events.

31. The system of claim 28, wherein the selective display includes display of information at select levels of detail.

32. The system of claim 24, wherein the graphical user interface is configured to provide information associated with the processing events using a plurality of coordinated panels that include:

a first panel that identifies the events,

a second panel that provides statistics related to the events, and

a third panel that provides a graphic display of occurrences of the events over time.

33. A method for execution on a plurality of machines on a communication network, comprising:

capturing communication events of an application on the network,

capturing processing events of the application on a node of the network, and

providing a synchronized display of the communication events and processing events of the application,

wherein each communication event includes information that facilitates identification of the application.

34. The method of claim 33, wherein

at least some of the communication events are recorded based on a first time base,

at least some of the processing events are recorded based on a second time base that differs from the first time base, and,

the method includes determining a common time base and its relation to the first and second time bases.

35. The method of claim 33, wherein capturing the processing events includes providing a record of times associated with function calls within the application.

36. The method of claim 35, including selectively enabling capturing of the processing events.

37. The method of claim 36, wherein the selective enabling is based on at least one of an invoking URL and a function name.

38. The method of claim 36, wherein the selective enabling is configured to limit at least one of a quantity and rate of the record of times associated with function calls.

39. The method of claim 35, including tracing the processing events across different threads of the application.

40. The method of claim 33, wherein capturing the processing events includes:

determining times associated with function calls within the application, and

filtering the times associated the function calls based on user definable preferences.

41. The method of claim 40, wherein

the user definable preferences include a mapping of one or more function calls to one or more function groups, and

the filtering provides composite time parameters corresponding to each function group.

42. The method of claim 33, wherein

capturing the communication events includes:

determining times associated with communications to and from the node, and

filtering the times associated with the communications to identify communications associated with the application.

43. The method of claim 33, including correlating the communication events and the processing events.

44. The method of claim 33, including correlating the communication events and the processing events based on at least one of:

Internet Protocol (IP) addresses and ports, and

corresponding send and receive communication events.

45. The method of claim 33, including determining statistics related to the processing events.

46. The method of claim 33, including determining statistics corresponding to a hierarchical organization of the processing events, to facilitate display of the statistics at multiple levels of detail.

47. The method of claim 33, including displaying a timing diagram that illustrates associations between the communication and processing events.

48. The method of claim 47, including displaying statistics related to the processing events.

49. The method of claim 48, including providing a graphical user interface to facilitate display of the statistics at multiple levels of detail.

50. The method of claim 49, including selectively displaying information related to the communication and processing events.

51. The method of claim 50, wherein selectively displaying includes sorting the communication and processing events based on a user'"'"'s preference.

52. The method of claim 48, including displaying the processing events in a Gantt-type format.

53. The method of claim 48, including displaying information related to the processing events at select levels of detail.

54. The method of claim 48. including providing information associated with the processing events using a plurality of coordinated panels that include:

a first panel that identifies the events,

a second panel that provides statistics related to the events, and

a third panel that provides a graphic display of occurrences of the events over time.

55. A non-transitory computer-readable medium that includes a computer program that, when executed by a processor, is configured to cause the processor to:

capture communication events of an application on a network,

capture processing events of the application on a node of the network, and

provide a synchronized display of the communication events and processing events of the application,

wherein each communication event includes information that facilitates identification of the application.

56. The medium of claim 55, wherein capturing the processing events includes determining times associated with function calls within the application.

57. The medium of claim 56, wherein the computer program is configured to cause the processor to determine statistics corresponding to a hierarchical organization of the processing events, to facilitate display of the statistics at multiple levels of detail.

58. The medium of claim 56, wherein the computer program is configured to cause the processor to display a timing diagram that illustrates associations between the communication and processing events.

59. The medium of claim 56, wherein the computer program is configured to cause the processor to selectively display information related to the communication and processing event.