Methods and computer program products for monitoring and reporting network application performance

• US 8,700,765 B2
• Filed: 08/13/2010
• Issued: 04/15/2014
• Est. Priority Date: 08/14/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Blue Stripe Software, Inc.
• Inventors: Yumerefendi, Aydan R., Reynolds, Patrick A., Bley, John B.
• Primary Examiner(s): Fan, Hua
• Application Number:
  US12/855,828
• Publication Number:
  US 20110055388A1
• Time in Patent Office: 1,341 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/815 Virtual middleware or OS functionality using virtual machines to implement generic software techniques for error detection or fault masking G06F11/1484
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Provided are methods and computer program products for monitoring and reporting network application performance in a networked device. Methods may include collecting performance data corresponding to at least one application running on the networked device in substantially real time using at least one kernel space driver interface; generating multiple kernel level metrics and multiple user level metrics based on the collected performance data; aggregating the kernel level metrics and the user level metrics that were generated during a predefined time interval; and generating, responsive to aggregating the kernel level metrics and the user level metrics, an event incorporating the aggregated metrics.

Claims

1. A method for monitoring application performance in a networked device, the method comprising:

collecting performance data using at least one kernel space driver interface, the collected performance data corresponding to at least one application running on the networked device;

generating a plurality of kernel level metrics and/or a plurality of user level metrics based on the collected performance data;

generating, after generating the plurality of kernel level metrics, an event incorporating at least one of the plurality of kernel level metrics and at least one of the plurality of user level metrics; and

aggregating ones of the plurality of kernel level metrics and/or ones of the plurality of user level metrics that were generated during a predefined time interval,

wherein said collecting performance data, generating a plurality of kernel level metrics and/or a plurality of user level metrics, and generating an event comprise operations performed using at least one programmed computer processor circuit,

wherein the predefined time interval is in a range from about 1 second to about 60 seconds; and

wherein collecting performance data comprises;

collecting a first portion of performance data from an operating system internal kernel interface that provides an interface between a network protocol and a network protocol client;

and collecting a second portion of performance data from an application oriented system call interface to a transport network stack.

2. A method according to claim 1,

wherein the event incorporates aggregated metrics generated during the predefined time interval.

3. A method according to claim 1, wherein the at least one application comprises a plurality of applications,

wherein the method further comprises aggregating ones of the plurality of kernel level metrics and/or ones of the plurality of user level metrics that correspond to a specified one of the plurality of applications, and

wherein the event incorporates aggregated metrics corresponding to the specified one of the plurality of applications.

4. A method according to claim 1, wherein the at least one application comprises a plurality of applications, wherein the method further comprises aggregating the first portion and the second portion of performance data, the first portion and second portion corresponding to a specified one of the plurality of applications, and wherein the event incorporates aggregated performance data corresponding to the specified one of the plurality of applications.

5. A method according to claim 1, wherein the method further comprises processing the collected performance data to remove redundant portions thereof and/or to reconcile inconsistent data therein.

6. A method according to claim 1, wherein the collected performance data indicates detection of network link establishment, detection of extant network links, detection of network link failure, detection of network link termination, detection of network port binding, detection of extant bound network ports, detection of network port unbinding, detection of pending reads, detection of completed reads, detection of stalled reads, network bytes sent, network bytes received, process identification, process start time, process exit time, local Internet Protocol (IP) address, local port, remote IP address, and/or remote port.

7. A method according to claim 1, wherein respective ones of the plurality of kernel level metrics include server response time, read wait time, number of pending reads, number of completed reads, average read wait time, number of stalled reads, number of completed responses, total read wait time, total bytes sent, total response time, and/or number of responses.

8. A method according to claim 1, wherein respective ones of the plurality of user level metrics include aggregate central processing unit percentage, aggregate memory percentage, total network bytes sent, total network bytes received, number of page faults, number of pages input, number of pages output, queue length, number of bytes read from logical disk, number of bytes written to logical disk, number of completed read requests on logical disk, number of completed write requests on logical disk, total read wait times, and/or total write wait times.

9. A method according to claim 1, wherein the collected performance data includes an Internet Protocol (IP) address, and wherein the method further comprises:

performing a reverse Domain Name System (DNS) lookup of the IP address to determine a DNS name associated with the IP address; and

incorporating the determined DNS name in the generated event.

10. A computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to collect performance data using at least one kernel space driver interface, the collected performance data corresponding to at least one application running on the networked device;

computer readable program code configured to generate a plurality of kernel level metrics and/or a plurality of user level metrics based on the collected performance data;

computer readable program code configured to generate an event incorporating at least one of the plurality of kernel level metrics and at least one of the plurality of user level metrics; and

computer readable program code configured to aggregate ones of the plurality of kernel level metrics and/or ones of the plurality of user level metrics that were generated during a predefined time interval,

wherein the predefined time interval is in a range from about 1 second to about 60 seconds; and

wherein the computer readable program code configured to collect performance data comprises;

computer readable program code configured to collect a first portion of performance data from an operating system internal kernel interface that provides an interface between a network protocol and a network protocol client; and

computer readable program code configured to-collect a second portion of performance data from an application oriented system call interface to a transport network stack.

11. A computer program product according to claim 10,

wherein the computer readable program code configured to generate an event comprises computer readable program code configured to incorporate aggregated metrics generated during the predefined time interval.

12. A computer program product according to claim 10, wherein the at least one application comprises a plurality of applications,

wherein the computer program product further comprises computer readable program code configured to aggregate ones of the plurality of kernel level metrics and/or ones of the plurality of user level metrics that correspond to a specified one of the plurality of applications, and

wherein the computer readable program code configured to generate an event comprises computer readable program code configured to incorporate aggregated metrics corresponding to the specified one of the plurality of applications.

13. A computer program product according to claim 10, wherein the at least one application comprises a plurality of applications,

wherein the computer program product further comprises computer readable program code configured to aggregate the first portion and the second portion of performance data, the first portion and second portion corresponding to a specified one of the plurality of applications, and

wherein the computer readable program code configured to generate an event comprises computer readable program code configured to incorporate aggregated performance data corresponding to the specified one of the plurality of applications.

14. A computer program product according to claim 10, further comprising computer readable program code configured to process the collected performance data to remove redundant portions thereof and/or reconcile inconsistent data therein.

15. A computer program product according to claim 10, wherein the computer readable program code configured to collect performance data is configured to collect data indicating detection of network link establishment, detection of extant network links, detection of network link failure, detection of network link termination, detection of network port binding, detection of extant bound network ports, detection of network port unbinding, detection of pending reads, detection of completed reads, detection of stalled reads, determination of bytes sent, determination of bytes received, identification of a process, determination of process start time, determination of process exit time, identification of a local IP address, identification of a local port, identification of a remote IP address, and/or identification of a remote port.

16. A computer program product according to claim 10, wherein the computer readable program code configured to generate a plurality of kernel level metrics and/or a plurality of user level metrics is configured to generate kernel level metrics related to performance data server response time, read wait time, number of pending reads, number of completed reads, average read wait time, number of stalled reads, number of completed responses, total read wait time, total bytes sent, total response time, and/or number of responses.

17. A computer program product according to claim 10, wherein the computer readable program code configured to generate a plurality of kernel level metrics and/or a plurality of user level metrics is configured to generate user level metrics related to aggregate central processing unit percentage, aggregate memory percentage, total network bytes sent, total network bytes received, number of page faults, number of pages input, number of pages output, queue length, number of bytes read from a logical disk, number of bytes written to a logical disk, number of completed read requests on a logical disk, number of completed write requests on a logical disk, total read wait times, and/or total write wait times.