Correlating input and output requests between client and server components in a multi-tier application

• US 9,549,030 B2
• Filed: 02/03/2012
• Issued: 01/17/2017
• Est. Priority Date: 02/04/2011
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: Malloy, Patrick, Crosby, Peter Anthony, Meagher, Robert
• Primary Examiner(s): Murray, Daniel C
• Application Number:
  US13/365,484
• Publication Number:
  US 20120246287A1
• Time in Patent Office: 1,810 Days
• Field of Search: 709/223, 707/711
• US Class Current: 1/1
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

The present invention relates to correlating requests between a client and a server to a particular transaction. In one embodiment, transactions in a system of clients and servers are monitored and traced. From this information, a context comprising sets or groupings of transaction call sequences are determined. For example, a sequence of method calls on a client process is traced to a socket carrying data for transmission of a request message to a server. In response to this request message, the server then executes a set of method calls that can be correlated to the request message and the socket. This set of actions is considered part of a causally related grouping, and thus, associated together. In one embodiment, HTTP requests from a client may be comprise a unique custom header that is readily identified and traced. For other protocols, a client socket is associated with a corresponding server socket or to data received over a socket receive call.

Claims

1. A method of marking a transaction at a first node for correlation with a related transaction at a second node, said method comprising:

determining when a socket connection is opened by the first node for a communication destined to the second node;

assigning a connection ID to the socket connection;

emitting the connection ID responsive to a successful socket write action by the first node;

emitting, at offsets within the communication, respective markers for each of the offsets, wherein each offset corresponds to a number of bytes from a start of the socket connection; and

maintaining an index that is keyed on the markers and a timestamp indicating when each marker was created, wherein the markers correspond to checksum values.

2. The method of claim 1, further comprising emitting an amount of data sent and an amount data received for each socket connection.

3. The method of claim 1, wherein emitting the respective markers comprises emitting a checksum value calculated based on the offset.

4. The method of claim 1, wherein emitting the checksum value comprises emitting a Jenkins checksum value based on the offset.

5. The method of claim 1, wherein emitting the respective markers comprises emitting a checksum and the offset as a pair value.

6. A method for correlating communications between a first node and a second node for a transaction, said method comprising:

monitoring a plurality of method calls and a plurality of socket actions at the first and second nodes;

assigning a socket ID to each socket connection that is opened on the first and second nodes;

emitting, for each successful socket write action and each successful socket read action at the first and second nodes, the socket ID and respective marker corresponding to an offset within the connection, wherein each offset corresponds to a number of bytes from a start of the socket connection;

maintaining an index that is keyed on the markers and a timestamp indicating when each marker was created, wherein the markers correspond to checksum values; and

correlating the communications between the first and second nodes based on the socket ID and the respective markers.

7. The method of claim 6, wherein emitting the respective markers corresponding to an offset within the connection comprises emitting a checksum value calculated based on the offset.

8. The method of claim 6 further comprising emitting, for each successful socket write action, a local address, a remote address, a number of bytes sent, and a checksum value.

9. The method of claim 6, further comprising emitting, for each successful socket read action, a local address, a remote address, a number of bytes received, and a checksum value.

10. The method of claim 6, further comprising recording each of the plurality of method calls and their corresponding emissions to a database.

11. The method of claim 6, further comprising maintaining an index that is keyed on identifiers for the first and second nodes, an identifier for each process associated with the method calls, and an identifier for the socket connection.

12. The method of claim 6, wherein correlating the communications between the first and second nodes based on the socket ID and the respective markers comprises a lookup for socket calls matching the socket ID and a corresponding range of markers.

13. The method of claim 6, wherein correlating the communications between the first and second nodes based on the socket ID and the respective markers comprises a lookup for socket calls matching the socket ID and a corresponding range of checksum values calculated for offsets within the communications.

14. A method for correlating a transaction recorded at two or more nodes, comprising:

monitoring a plurality of method calls and a plurality of socket actions for transactions at each of the two or more nodes;

associating a socket with each socket connection that is opened;

for each successful socket connection, emitting the socket, a local address, and a remote address;

for each successful socket write action, emitting the socket, a current output stream offset, a number of bytes sent, and on selected fixed boundaries and at the end of a socket connection a checksum value, wherein each offset corresponds to a number of bytes from a start of the socket connection;

for each successful socket read action, emitting the socket, a current input stream offset, a number of bytes received, and on selected fixed boundaries and at the end of a socket connection, a checksum value;

associating each emission with at least one of the plurality of method calls;

recording information about each of the plurality of method calls and their corresponding emissions;

maintaining an index that is keyed on checksum values and a timestamp indicating when each checksum value was created; and

identifying a correlation between at least two of the plurality of method calls based on the recorded information.

15. The method of claim 14, wherein identifying the correlation comprises determining a relation between at least two of the plurality of method calls based on a heuristic matching of the emitted checksums.

16. The method of claim 14, wherein identifying the correlation comprises determining a relation between at least two of the plurality of method calls based on a heuristic matching of custom headers.

17. The method of claim 14, further comprising displaying transactions related to correlated method calls as a single transaction to a user.

18. The method of claim 17, wherein displaying transactions related to correlated method calls as a single transaction to a user comprises displaying the single transaction with method calls that span between the first and second nodes.

19. A first node configured to mark a transaction for correlation with a related transaction at a second node, said first node comprising:

a memory comprising executable program code; and

a processor configured by the executable program code to determine when a socket connection is opened by the client for a communication destined to the second node, assign a connection ID to the socket connection, emit the connection ID responsive to a successful socket write action by the first node, emit, at offsets within the communication, respective markers for each of the offsets, wherein each offset corresponds to a number of bytes from a start of the socket connection, and maintain an index that is keyed on the markers and a timestamp indicating when each marker was created, wherein the markers correspond to checksum values.

20. The first node of claim 19, wherein the processor is configured to emit an amount of data sent and an amount data received for each socket connection.

21. The first node of claim 19, wherein the processor is configured to emit a checksum value calculated based on the offset.

22. The first node of claim 19, wherein the processor is configured to emit a Jenkins checksum value based on the offset.

23. The first node of claim 19, wherein the processor is configured to emit a checksum and the offset as a pair value.

24. A system configured to correlate communications between a first node and a second node for a transaction of an application running over a network, said system comprising:

a communications interface coupled to the network and configured to receive trace information from at least the first and second nodes;

a processor;

a non-transitory computer-readable medium having computer-readable instructions executable by a computer such that, when executing said instructions, a computer will perform a computer-implemented method for correlating communications between a first node and a second node for a transaction of an application running over a network, the method comprising;

monitoring a plurality of method calls and a plurality of socket actions for transactions at each of the two or more nodes,

associating a socket ID with each socket connection that is opened,

wherein for each successful socket connection, the socket ID, a local address, and a remote address has been emitted by the first and second nodes,

wherein for each successful socket write action, the socket ID, a current output stream offset, a number of bytes sent, and on selected fixed boundaries and at the end of a socket connection a checksum value has been emitted by the first and second nodes, wherein each offset corresponds to a number of bytes from a start of the socket connection, wherein for each successful socket read action, the socket ID, a current input stream offset, a number of bytes received, and on selected fixed boundaries and at the end of a socket connection, a checksum value, has been emitted by the first and second nodes,

associating each emission with at least one of the plurality of method calls, record information about each of the plurality of method calls and their corresponding emissions,

maintaining an index that is keyed on checksum values and a timestamp indicating when each checksum value was created, and

identifying a correlation between at least two of the plurality of method calls based on the recorded information.

25. The system of claim 24, wherein the processor is configured to determine a relation between at least two of the plurality of method calls based on a heuristic matching of the emitted checksums.

26. The system of claim 24, wherein the processor is configured to determine a relation between at least two of the plurality of method calls based on a heuristic matching of custom headers.

27. The system of claim 24, wherein the processor is configured to provide information for displaying transactions related to correlated method calls as a single transaction to a user.

28. The system of claim 27, wherein the processor is configured to provide information for displaying the single transaction with method calls that span between the first and second nodes.