Performance and security management of applications deployed in hosted computing environments

• US 9,432,270 B2
• Filed: 07/30/2013
• Issued: 08/30/2016
• Est. Priority Date: 07/30/2013
• Status: Active Grant

• Current Assignee: Sysdig
• Original Assignee: Draios Inc.
• Inventors: Degioanni, Loris
• Primary Examiner(s): Eskandarnia, Arvin
• Application Number:
  US13/953,970
• Publication Number:
  US 20150039745A1
• Time in Patent Office: 1,127 Days
• Field of Search: 709/224, 709/223, 709/202, 709/203, 709/206
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Systems and methods for performance and security management of the computing infrastructure that supports an application deployed in a hosted computing environment are described. In one embodiment, for example, a system comprises agents installed on hosts. The agents capture and record system events from operating systems on the hosts that result from application component processes executing on the hosts. The system further includes a collection and analysis engine that obtains captured and recorded system events from the agents, identifies captured and recorded system events that pertain to an application transaction, and produces, from the identified system events, metric data reflecting quantity of computing resources used by the application component processes to process the application transaction. The system also includes a web dashboard that presents the metric data to a user, for example, on a web page.

Claims

1. A data processing system comprising:

a plurality of agents installed on a plurality of hosts, the plurality of agents configured for capturing and recording system events from operating systems on the hosts, the system events resulting from a plurality of application component processes executing on the operating systems on the plurality of hosts;

one or more computers having at least a processor and memory and including a collection and analysis engine that is configured to obtain captured and recorded system events from the plurality of agents, to identify captured and recorded system events that pertain to a distributed application transaction, and to produce, from the identified captured and recorded system events that pertain to the distributed application transaction, metric data reflecting quantity of computing resources used by the plurality of application component processes executing on the operating systems on the plurality of hosts to process the distributed application transaction; and

one or more computers having at least a processor and memory and including a web dashboard that is configured to present the metric data to a user.

2. The system of claim 1, wherein the plurality of agents are configured to capture system events from the operating systems on the hosts by intercepting system calls to the operating systems from the plurality of application component processes.

3. The system of claim 1, wherein each host of the plurality of hosts is a computing device or a virtual machine instance.

4. The system of claim 1, wherein the distributed application transaction corresponds to when a HyperText Transfer Protocol (HTTP) or a Secure HyperText Transfer Protocol (HTTPS) request is received at a web server host of the plurality of hosts and when the web server hosts completes sending of a HTTP or HTTPS response to the HTTP or HTTPS request.

5. The system of claim 1, wherein the web dashboard is configured to present the metric data on a web page.

6. The system of claim 1, wherein the metric data presented to the user by the web dashboard indicates, for each of the application component processes, a quantity of a particular computing resource used by the application component processes to process the distributed application transaction.

7. The system of claim 6, wherein the particular computing resource is disk, network, or CPU.

8. The system of claim 1, wherein each of the application component processes execute functionality of one of a plurality of application components;

and wherein the metric data presented by the web dashboard indicates, for each of the application components, a quantity of a particular computing resource used by the application component to process the distributed application transaction.

9. The system of claim 8, wherein each application component of the plurality of application components is one of a web server, an application server, and a database server.

10. The system of claim 1, wherein the metric data presented by the web dashboard indicates time spent by the application component processes using the computing resources to process the distributed application transaction.

11. The system of claim 1, wherein the plurality of agents are configured to associate additional contextual information with a captured system event by querying one or more system state tables and/or querying an operating system interface using information from the captured system event.

12. The system of claim 11, wherein the operating system interface is a proc file system on a UNIX or UNIX-like operating system.

13. A method comprising:

a plurality of agents installed on a plurality of hosts capturing and recording system events from operating systems on the hosts, the system events resulting from a plurality of application component processes executing on the operating systems on the plurality of hosts;

one or more computers having at least a processor and memory and including a collection and analysis engine obtaining captured and recorded system events from the plurality of agents, identifying captured and recorded system events that pertain to a distributed application transaction, and producing, from the identified captured and recorded system events that pertain to the distributed application transaction, metric data reflecting quantity of computing resources used by the plurality of application component processes executing on the operating systems on the plurality of hosts to process the distributed application transaction; and

one or more computers having at least a processor and memory and including a web dashboard presenting the metric data to a user.

14. The method of claim 13, further comprising the plurality of agents capturing system events from the operating systems on the hosts by intercepting system calls to the operating systems from the plurality of application component processes.

15. The method of claim 13, wherein each host of the plurality of hosts is a computing device or a virtual machine instance.

16. The method of claim 13, wherein the distributed application transaction corresponds to when a HyperText Transfer Protocol (HTTP) or a Secure HyperText Transfer Protocol (HTTPS) request is received at a web server host of the plurality of hosts and when the web server hosts completes sending of a HTTP or HTTPS response to the HTTP or HTTPS request.

17. The method of claim 13, wherein the web dashboard presents the metric data to the user on a web page.

18. The method of claim 13, wherein the metric data presented to the user by the web dashboard indicates, for each of the application component processes, a quantity of a particular computing resource used by the application component processes to process the distributed application transaction.

19. The method of claim 17, wherein the particular computing resource is disk, network, or CPU.

20. The method of claim 13, wherein each of the application component processes execute functionality of one of a plurality of application components;

and wherein the metric data presented to the user by the web dashboard indicates, for each of the application components, a quantity of a particular computing resource used by the application component to process the distributed application transaction.

21. The method of claim 20, wherein each application component of the plurality of application components is one of a web server, an application server, and a database server.

22. The method of claim 13, wherein the metric data presented to the user by the web dashboard indicates time spent by the application component processes using the computing resources to process the distributed application transaction.

23. The method of claim 13, further comprising the plurality of agents associating additional contextual information with a captured system event by querying one or more system state tables and/or querying an operating system interface using information from the captured system event.

24. The method of claim 23, wherein the operating system interface is a proc file system on a UNIX or UNIX-like operating system.