Dynamic baseline determination for distributed transaction

• US 9,893,963 B2
• Filed: 10/31/2015
• Issued: 02/13/2018
• Est. Priority Date: 09/10/2009
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Bansal, Jyoti, Sunkara, Bhaskar
• Primary Examiner(s): Mejia, Anthony
• Application Number:
  US14/929,269
• Publication Number:
  US 20160050136A1
• Time in Patent Office: 836 Days
• Field of Search: 709224
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

The present technology may determine an anomaly in a portion of a distributed business application. Data can automatically be captured and analyzed for the portion of the application associated with the anomaly. By automatically capturing data for just the portion associated with the anomaly, the present technology reduces the resource and time requirements associated with other code-based solutions for monitoring transactions. A method for performing a diagnostic session for a request may begin with initiating collection of diagnostic data associated with a request. An application thread on each of two or more servers may be sampled. The application threads may be associated with the same business transaction and the business transaction may be associated with the request. The diagnostic data may be stored.

Claims

1. A method for monitoring a distributed application, the method comprising:

receiving, at a machine in a network, runtime data associated with one or more distributed business transactions associated with the distributed application;

monitoring, on the machine, the one or more distributed business transactions of the distributed application based on the runtime data;

determining, by the machine, a performance baseline for handling a request by the distributed application to perform the one or more business transaction based on the runtime data;

setting diagnostic parameters for implementing a diagnostic session for the one or more distributed business transactions;

based on an occurrence of an anomaly as compared to the determined performance baseline, triggering the diagnostic session to collect diagnostic data based on the diagnostic parameters;

receiving diagnostic data for the diagnostic session implemented using the diagnostic parameters for the one or more distributed business transactions;

associating an identifier with the anomaly; and

generating a flow map of the one or more distributed business transactions that includes a map of applications or virtual machines that make up the one or more distributed business transactions associated with the diagnostic session triggered by the anomaly.

2. The method of claim 1, including:

receiving business transaction name information; and

receiving call chain information.

3. The method of claim 1, including displaying with the flow map, a status of the anomaly, a duration of the anomaly, and a name of the distributed business transaction.

4. The method of claim 1, including displaying with the flow map, a relationship between the applications or virtual machines that make up the distributed business transaction.

5. The method of claim 1, including generating a call graph.

6. The method of claim 5, including displaying with the call graph, a name of a corresponding application called and a time at which the called application executed.

7. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform operations for monitoring a distributed application, the operations including:

receiving runtime data associated with one or more distributed business transactions associated with the distributed application;

monitoring the one or more distributed business transactions of the distributed application based on the runtime data;

determining a performance baseline for handling a request by the distributed application to perform the one or more business transaction based on the runtime data;

setting diagnostic parameters for implementing a diagnostic session for the one or more distributed business transactions;

based on an occurrence of an anomaly as compared to the determined performance baseline, triggering the diagnostic session to collect diagnostic data based on the diagnostic parameters;

receiving diagnostic data for the diagnostic session implemented using the diagnostic parameters for the one or more distributed business transactions;

associating an identifier with the anomaly; and

generating a flow map of the one or more distributed business transactions that includes a map of applications or virtual machines that make up the one or more distributed business transactions associated with the diagnostic session triggered by the anomaly.

8. The non-transitory computer readable storage medium of claim 7, wherein the operations include:

receiving business transaction name information; and

receiving call chain information.

9. The non-transitory computer readable storage medium of claim 7, wherein the operations include displaying with the flow map, a status of the anomaly, a duration of the anomaly, and a name of the distributed business transaction.

10. The non-transitory computer readable storage medium of claim 7, wherein the operations include displaying with the flow map, a relationship between the applications or virtual machines that make up the distributed business transaction.

11. The non-transitory computer readable storage medium of claim 7, wherein the operations include generating a call graph.

12. The non-transitory computer readable storage medium of claim 11, wherein the operations include displaying with the call graph, a name of a corresponding application called and a time at which the called application executed.

13. An apparatus for monitoring a distributed application, comprising:

a processor configured to execute a process; and

a memory configured to store program instructions which contain the process executable by the processor, the process configured to;

receive runtime data associated with one or more distributed business transactions associated with the distributed application;

monitor the one or more distributed business transactions of the distributed application based on the runtime data;

determine a performance baseline for handling a request by the distributed application to perform the one or more business transaction based on the runtime data;

set diagnostic parameters for implementing a diagnostic session for the one or more distributed business transactions;

based on an occurrence of an anomaly as compared to the determined performance baseline, trigger the diagnostic session to collect diagnostic data based on the diagnostic parameters;

receive diagnostic data for the diagnostic session implemented using the diagnostic parameters for the one or more distributed business transactions;

associate an identifier with the anomaly; and

generate a flow map of the one or more distributed business transactions that includes a map of applications or virtual machines that make up the one or more distributed business transactions associated with the diagnostic session triggered by the anomaly.

14. The apparatus of claim 13, wherein the process is configured to:

receive business transaction name information; and

receive call chain information.

15. The apparatus of claim 13, wherein the process is configured to:

display with the flow map, a status of the anomaly, a duration of the anomaly, and a name of the distributed business transaction.

16. The apparatus of claim 13, wherein the process is configured to:

display with the flow map, a relationship between the applications or virtual machines that make up the distributed business transaction.

17. The apparatus of claim 13, wherein the process is configured to:

generating a call graph.

18. The apparatus of claim 13, wherein the process is configured to:

display with the call graph, a name of a corresponding application called and a time at which the called application executed.