Correlating status information generated in a computer network

• US 8,812,586 B1
• Filed: 02/15/2011
• Issued: 08/19/2014
• Est. Priority Date: 02/15/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Kulkarni, Rahul S., Sahasranaman, Vivek, Jain, Rohit, Shenoy, Vittaldas Sachin, Risbood, Pankaj, Sarda, Parag Kacharulal
• Primary Examiner(s): Chriss, Andrew
• Assistant Examiner(s): PEREZ, JOSE L
• Application Number:
  US13/027,872
• Time in Patent Office: 1,281 Days
• Field of Search: 709/203, 709223-226, 718/100, 718/102, 718/105
• US Class Current: 709/203
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In general, the subject matter described in this specification can be embodied in methods, systems, and program products for correlating status information generated in a computer network. A computing system receives, for each particular computer server or application program in a group of computer servers and application programs that are executing on the computer servers, information that identifies statuses of the particular computer server or application program at a plurality of times. The computing system generates, using the information received, network signatures that each represent statuses of the computer servers and application programs in the group for a particular time, the network signatures being for multiple times. The computer system stores the network signatures along with data that identifies relationships, for each of the multiple times, between (i) application programs and the computer servers on which they were executing, and (ii) application programs that were in communication with each other.

Claims

1. A computer-implemented method for correlating status information generated in a computer network by computer servers and application programs, the method comprising:

receiving, by a computing system and for each particular computer server in a group of computer servers, server status information that identifies a status of the particular computer server at each of various times;

receiving, by the computing system and for each particular application program in a group of application programs that are executing on various ones of the computer servers in the group of computer servers, application status information that identifies a status of the particular application program at each of various times;

generating, by the computing system, a network signature for each of multiple times in order to generate multiple network signatures for the multiple times, wherein each particular network signature of the multiple network signatures identifies, for a respective one of the multiple times a status of each of the computer servers in the group of computer servers and a status of each of the application programs in the group of application programs, wherein generating the multiple network signatures uses (i) the server status information received for each particular computer server in the group of computer servers, and (ii) the application status information received for each particular application program in the group of application programs; and

associating, by the computing system, each particular network signature of the multiple network signatures with data that identifies relationships, at a corresponding one of the multiple times, between (i) which application programs in the group of application programs were executing on which computer servers in the group of computer servers at the corresponding one of the multiple times, and (ii) which of the application programs in the group of application programs were in communication with each other at the corresponding one of the multiple times, wherein a first network signature of the multiple network signatures is associated with data that identifies relationships at a first time of the multiple times and a second network signature of the multiple network signatures is associated with data that identifies relationships at a second time of the multiple times.

2. The method of claim 1, wherein:

for each particular computer server in the group of computer servers, the various times for which the server status information identifies the status of the particular computer server, is indicated by a plurality of corresponding time stamps that were generated by the particular computer server and that were sent for receipt by the computing system along with the server status information; and

for each particular application program in the group of application programs, the various times for which the application status information identifies the status of the particular application program is indicated by a collection of corresponding time stamps that were generated by a computer server on which the particular application program is executing and that were sent for receipt by the computing system along with the application status information.

3. The method of claim 2, wherein generating the network signature for each of the multiple times in order to generate the multiple network signatures includes synchronizing time stamps that were received from multiple of the computer servers in the group of computer servers and multiple of the application programs in the group of application programs, wherein the multiple of the computer servers and the multiple of the application programs did not generate the respective time stamps synchronously with each other.

4. The method of claim 2, wherein generating the network signature for each of the multiple times in order to generate the multiple network signatures includes generating network signatures at periodic time intervals, and wherein portions of the received server status information for each particular computer server in the group of computer servers and portions of the received application status information for each particular application program in the group of application programs is not received from all of the computer servers in the group of computer servers and all of the application programs in the group of application programs at periodic time intervals.

5. The method of claim 1, wherein generating the network signature for each of the multiple times in order to generate the multiple network signatures for the multiple times includes generating a plurality of the multiple network signatures using (i) a single status from the application status information received for a first application program from the group of application programs, and (ii) a plurality of statuses from the application status information received for a second application program from the group of application programs;

wherein the single status is included in each of the plurality of the multiple network signatures without the computing system having received an updated status from the first application program for each of the plurality of multiple network signatures, and the plurality of statuses are included in the plurality of the multiple network signatures due to the computing system having received an updated status from the second application program for each of the plurality of multiple network signatures.

6. The method of claim 1, further comprising detecting, during a monitoring of the multiple network signatures as they are generated, an anomaly in the generated multiple network signatures, by identifying that one or more of the multiple network signatures does not conform to established normal behavior of the computer servers in the group of computer servers and the application programs in the group of application programs.

7. The method of claim 6, wherein the anomaly is determined to represent an operational failure of an anomalous computer server from the group of computer servers;

and

further comprising preventing the anomalous computer server from affecting operation of a first computer server by transferring requests by the first computer server that were intended for receipt by the anomalous computer server to a second computer server or application program.

8. The method of claim 7, further comprising preventing the anomalous computer server from affecting operation of a third computer server by transferring subsequent requests by the third computer server that were intended for receipt by the first computer server to a fourth computer server.

9. The method of claim 1, wherein each of the multiple network signatures includes the data that identifies the relationships for the corresponding one of the multiple times.

10. The method of claim 9, further comprising analyzing the multiple network signatures with a machine learning system to determine that a predicted anomaly in operation of a specific computer server from the group of computer servers or application program from the group of application programs is likely to occur in the future.

11. The method of claim 10, further comprising providing to the machine learning system, to train the machine learning system before determining that the anomaly is likely to occur:

(i) multiple previous anomalies in operation of computer servers from the group of computer servers and in operation of application programs from the group of application programs, and

(ii) network signatures for times that correspond to the multiple previous anomalies, including for each individual one of the network signatures for the times that correspond to the multiple previous anomalies (a) the status of each of the computer servers in the group of computer servers, (b) the status of each of the application programs in the group of application programs, and (c) the data that identifies the relationships at the corresponding time.

12. The method of claim 11, further comprising, in order to avoid the predicted anomaly, reconfiguring the relationships between (i) which application programs in the group of application programs are executing on which computer servers in the group of computer servers, and (ii) which of the application programs in the group of application programs are communication with each other.

13. The method of claim 12, wherein reconfiguring the relationships includes transferring execution of a first application program in the group of application programs from a first computer server in the group of computer servers to a second computer server in the group of computer servers.

14. The method of claim 13, wherein:

the first computer server was predicted by the machine learning system to be a source of the predicted anomaly that is likely to occur in the future.

15. The method of claim 11, further comprising bringing more computer servers online to avoid occurrence of the predicted anomaly that is likely to occur in the future.

16. A system comprising:

one or more processors; and

one or more computer-readable devices including instructions that, when executed by the one or more processors, cause performance of operations that comprise;

receiving, by a computing system and for each particular computer server in a group of computer servers, server status information that identifies a status of the particular computer server at each of various times;

receiving, by the computing system and for each particular application program in a group of application programs that are executing on various ones of the computer servers in the group of computer servers, application status information that identifies a status of the particular application program at each of various times;

generating, by the computing system, a network signature for each of multiple times in order to generate multiple network signatures for the multiple times, wherein each particular network signature of the multiple network signatures identifies, for a respective one of the multiple times a status of each of the computer servers in the group of computer servers and a status of each of the application programs in the group of application programs, wherein generating the multiple network signatures uses (i) the server status information received for each particular computer server in the group of computer servers, and (ii) the application status information received for each particular application program in the group of application programs; and

associating, by the computing system, each particular network signature of the multiple network signatures with data that identifies relationships, at a corresponding one of the multiple times, between (i) which application programs in the group of application programs were executing on which computer servers in the group of computer servers at the corresponding one of the multiple times, and (ii) which of the application programs in the group of application programs were in communication with each other at the corresponding one of the multiple times, wherein a first network signature of the multiple network signatures is associated with data that identifies relationships at a first time of the multiple times and a second network signature of the multiple network signatures is associated with data that identifies relationships at a second time of the multiple times.