Performance and security management of applications deployed in hosted computing environments

• US 9,954,740 B2
• Filed: 07/29/2016
• Issued: 04/24/2018
• Est. Priority Date: 07/30/2013
• Status: Active Grant

• Current Assignee: Sysdig
• Original Assignee: Draios Inc.
• Inventors: Degioanni, Loris
• Primary Examiner(s): Eskandarnia, Arvin
• Application Number:
  US15/224,226
• Publication Number:
  US 20160337199A1
• Time in Patent Office: 634 Days
• Field of Search: 709224
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Systems and methods for performance and security management of the computing infrastructure that supports an application deployed in a hosted computing environment are described. In one embodiment, for example, a system comprises agents installed on hosts. The agents capture and record system events from operating systems on the hosts that result from application component processes executing on the hosts. The system further includes a collection and analysis engine that obtains captured and recorded system events from the agents, identifies captured and recorded system events that pertain to an application transaction, and produces, from the identified system events, metric data reflecting quantity of computing resources used by the application component processes to process the application transaction. The system also includes a web dashboard that presents the metric data to a user, for example, on a web page.

Claims

1. A data tracking system comprising:

a plurality of hosts, each host including one or more agents of a plurality of agents to capture and record system events from operating systems on the plurality of hosts, the system events resulting from a plurality of application component processes executing on the operating systems on the plurality of hosts;

one or more processors;

one or more storage media storing instructions which, when executed by the one or more processors, cause;

determining that a set of captured and recorded system events from the plurality of agents pertain to a distributed application;

reconstructing, from the set of the captured and recorded system events that pertain to the distributed application, metric data reflecting quantity of computing resources used by the plurality of application component processes executing on the operating systems on the plurality of hosts to process requests by the distributed application; and

displaying on a web dashboard the metric data to a user.

2. The system of claim 1, wherein the set of captured and recorded system events include system events executed in response to one or more distributed application transactions that pertain to the distributed application.

3. The system of claim 1, wherein the computing resources used by the plurality of application component processes include at least one of network data and file exchange, creation or removal of processes, library loading, or user impersonation.

4. The system of claim 1, wherein the one or more storage media storing instructions which, when executed by the one or more processors, further cause:

sorting, in a chronological order, the set of captured and recorded system events to be displayed on the web dashboard.

5. The system of claim 1, wherein the plurality of agents are configured to capture system events from the operating systems on the hosts by intercepting system calls to the operating systems from the plurality of application component processes.

6. The system of claim 1, wherein each host of the plurality of hosts is a computing device or a virtual machine instance.

7. The system of claim 1, wherein the distributed application includes a request corresponding to when a HyperText Transfer Protocol (HTTP) or a Secure HyperText Transfer Protocol (HTTPS) request is received at a web server host of the plurality of hosts and when the web server host completes sending of a HTTP or HTTPS response to the HTTP or HTTPS request.

8. The system of claim 1, wherein the distributed application includes a request corresponding to when a database query request is received at a database server host of the plurality of hosts and when the database server host completes sending of a database query response to the database query request.

9. The system of claim 1, wherein the web dashboard is configured to present the metric data on a web page.

10. The system of claim 1, wherein each of the application component processes execute functionality of one of a plurality of application components;

and wherein the metric data presented by the web dashboard indicates, for each of the application components, a quantity of a particular computing resource used by the application component to process the requests from the distributed application.

11. The system of claim 10, wherein each application component of the plurality of application components is one of a web server, an application server, and a database server.

12. The system of claim 1, wherein the metric data presented by the web dashboard indicates time spent by the application component processes using the computing resources to process the requests from the distributed application.

13. The system of claim 1, wherein the plurality of agents are configured to associate additional contextual information with a captured system event by querying one or more system state tables and/or querying an operating system interface using information from the captured system event.

14. A method comprising:

executing a plurality of hosts, each host including one or more agents of a plurality of agents to capture and record system events from operating systems on the plurality of hosts, the system events resulting from a plurality of application component processes executing on the operating systems on the plurality of hosts;

determining that a set of captured and recorded system events from the plurality of agents pertain to a distributed application;

reconstructing, from the set of the captured and recorded system events that pertain to the distributed application, metric data reflecting quantity of computing resources used by the plurality of application component processes executing on the operating systems on the plurality of hosts to process requests by the distributed application; and

displaying on a web dashboard the metric data to a user.

15. The method of claim 14, wherein the set of captured and recorded system events include system events executed in response to one or more distributed application transactions that pertain to the distributed application.

16. The method of claim 14, wherein the computing resources used by the plurality of application component processes include at least one of network data and file exchange, creation or removal of processes, library loading, or user impersonation.

17. The method of claim 14, further comprising:

sorting, in a chronological order, the set of captured and recorded system events to be displayed on the web dashboard.

18. One or more storage media storing instructions which, when executed by one or more processors, cause:

executing a plurality of hosts, each host including one or more agents of a plurality of agents to capture and record system events from operating systems on the plurality of hosts, the system events resulting from a plurality of application component processes executing on the operating systems on the plurality of hosts;

determining that a set of captured and recorded system events from the plurality of agents pertain to a distributed application;

reconstructing, from the set of the captured and recorded system events that pertain to the distributed application, metric data reflecting quantity of computing resources used by the plurality of application component processes executing on the operating systems on the plurality of hosts to process requests by the distributed application; and

displaying on a web dashboard the metric data to a user.

19. The one or more storage media storing instructions of claim 18, wherein the plurality of agents are configured to capture system events from the operating systems on the hosts by intercepting system calls to the operating systems from the plurality of application component processes.

20. The one or more storage media storing instructions of claim 18, wherein each host of the plurality of hosts is a computing device or a virtual machine instance.