Performing call stack sampling

• US 9,077,610 B2
• Filed: 11/04/2013
• Issued: 07/07/2015
• Est. Priority Date: 09/10/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: AppDynamics, Inc. (Cisco Systems, Inc.)
• Inventors: Bansal, Jyoti, Sunkara, Bhaskar
• Primary Examiner(s): Mejia, Anthony
• Application Number:
  US14/071,523
• Publication Number:
  US 20140068068A1
• Time in Patent Office: 610 Days
• Field of Search: 709/200, 709/224, 717/127, 718/101, 719/317
• US Class Current: 1/1
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

The present technology may determine an anomaly in a portion of a distributed business application. Data can automatically be captured and analyzed for the portion of the application associated with the anomaly. By automatically capturing data for just the portion associated with the anomaly, the present technology reduces the resource and time requirements associated with other code-based solutions for monitoring transactions. A method for sampling an application thread to monitor a request may begin with detecting a diagnostic event with respect to the processing of a request. A thread call stack associated with the request may be sampled in response to detecting the diagnostic event. A state of the call stack may be stored with timing information based on the sampling. The call stack state and timing information may be transmitted to a remote server.

Claims

1. A method for sampling an application thread to monitor a request, comprising:

monitoring a request at a server, the request part of a distributed business transaction;

detecting a diagnostic event with respect to the processing of the request;

sampling a thread call stack associated with the request in response to detecting the diagnostic event;

updating a thread snapshot based on a state of the call stack over time with timing information, the state of the call stack retrieved from sampling the thread call stack based on the sampling, the timing information associated with particular call stack state, the snapshot including a hierarchical representation of calls performed during the request and detected by sampling the call stack; and

transmitting the thread snapshot and timing information to a remote server.

2. The method of claim 1, wherein the diagnostic event includes an anomaly associated with the request.

3. The method of claim 1, wherein the diagnostic event includes a request by a user to collect diagnostic data.

4. The method of claim 1, further comprising:

detecting an outgoing call; and

sampling the thread call stack in response to detecting the outgoing call.

5. The method of claim 1, wherein the outgoing call is detected by bytecode instrumentation.

6. The method of claim 1, wherein the outgoing call is detected by code embedded into exit points within an application which makes the outgoing call.

7. The method of claim 1, wherein the thread sampling rate is adjusted after a set period of time.

8. The method of claim 7, wherein the sampling rate is adjusted based on the sampling results.

9. The method of claim 1, wherein the sampling results in a plurality of stored call stack states that indicate one or more methods that are called at different times as part of handling the request.

10. The method of claim 9, wherein a call graph of functions executed by an application thread is derived from the sampled call stack states.

11. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for sampling an application thread to monitor a request, the method comprising:

monitoring a request at a server, the request part of a distributed business transaction;

detecting a diagnostic event with respect to the processing of the request;

sampling a thread call stack associated with the request in response to detecting the diagnostic event;

updating a thread snapshot based on a state of the call stack over time with timing information, the state of the call stack retrieved from sampling the thread call stack based on the sampling, the timing information associated with particular call stack state the snapshot including a hierarchical representation of calls performed during the request and detected by sampling the call stack; and

transmitting the thread snapshot and timing information to a remote server.

12. The non-transitory computer readable storage medium of claim 11, wherein the diagnostic event includes an anomaly associated with the request.

13. The non-transitory computer readable storage medium of claim 11, wherein the diagnostic event includes a request by a user to collect diagnostic data.

14. The non-transitory computer readable storage medium of claim 11, the method further comprising:

detecting an outgoing call; and

sampling the thread call stack in response to detecting the outgoing call.

15. The non-transitory computer readable storage medium of claim 11, wherein the outgoing call is detected by bytecode instrumentation.

16. The non-transitory computer readable storage medium of claim 11, wherein the outgoing call is detected by code embedded into exit points within an application which makes the outgoing call.

17. The non-transitory computer readable storage medium of claim 11, wherein the thread sampling rate is adjusted after a set period of time.

18. The non-transitory computer readable storage medium of claim 17, wherein the sampling rate is adjusted based on the sampling results.

19. The non-transitory computer readable storage medium of claim 11, wherein the sampling results in a plurality of stored call stack states that indicate one or more methods that are called at different times as part of the handling the request.

20. The non-transitory computer readable storage medium of claim 19, wherein a call graph of functions executed by an application thread is derived from the sampled call stack states.

21. A system for monitoring a business transaction, comprising:

a first application server having memory; and

one or more modules stored in memory of the first application server and executable by a processor to monitor a request at a server, the request part of a distributed business transaction, detect a diagnostic event with respect to the processing of the request, sample thread call stack associated with the request in response to detecting the diagnostic event, update a thread snapshot based on a state of the call stack over time with timing information, the state of the call stack retrieved from sampling the thread call stack based on the sampling, the timing information associated with particular call stack state, the snapshot including a hierarchical representation of calls performed during the request and detected by sampling the call stack, and transmit the thread snapshot and timing information to a remote server.

22. The system of claim 21, wherein the diagnostic event includes an anomaly associated with the request.

23. The system of claim 21, wherein the diagnostic event includes a request by a user to collect diagnostic data.

24. The system of claim 21, the modules further executable to detect an outgoing call and sample the thread call stack in response to detecting the outgoing call.

25. The system of claim 21, wherein the outgoing call is detected by bytecode instrumentation.

26. The system of claim 21, wherein the outgoing call is detected by code embedded into exit points within an application which makes the outgoing call.

27. The system of claim 21, wherein the thread sampling rate is adjusted after a set period of time.

28. The method of claim 27, wherein the sampling rate is adjusted based on the sampling results.

29. The system of claim 21, wherein the sampling results in a plurality of stored call stack states that indicate one or more methods that are called at different times as part of handling the request.

30. The method of claim 29, wherein a call graph of functions executed by an application thread is derived from the sampled call stack states.