Correlating performance degradation of applications to specific changes made to applications

• US 9,766,962 B2
• Filed: 06/07/2012
• Issued: 09/19/2017
• Est. Priority Date: 06/07/2012
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Dvir, Eran, Margalit, Adar, Mazursky, Aner, Paz, Hilik
• Primary Examiner(s): Pollack, Melvin H
• Assistant Examiner(s): Gebre, Messeret F
• Application Number:
  US13/491,329
• Publication Number:
  US 20130332594A1
• Time in Patent Office: 1,930 Days
• Field of Search: 709224
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/32 with visual or acoustical indication of the functioning of the machine
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 2201/835 Timestamp
• CPC Class Codes: G06F 2209/508 Monitor

Abstract

An application monitoring infrastructure enables application configuration changes on multiple machines across multiple OS types to be tracked, and correlated to performance degradation and outages by receiving change event data associated with change events occurring at each computer in the computer system, each change event data including an identifier for the associated change event, a path to a data container that was changed, a time stamp representative of when the data container was changed, an identifier for an application that is affected by the change to the data container, and the time stamp representative of when the monitored data container was changed, determining a time at which correlation is to be carried out and a target application for which correlation is to be carried out, and identifying change events associated with the target application that have time stamps that are within a predetermined proximity to the determined time.

Claims

1. A method for correlating changes in performance of applications deployed in a computer system to changes made to the applications, wherein each of the applications is associated with one of a plurality of monitoring templates and each of the monitoring templates specifies paths of files and folders to be monitored for the associated application, said method comprising:

receiving and storing change event data associated with file change events and folder change events occurring at each computer in the computer system, each file change event data being associated with a file having a path that is specified in one of the monitoring templates, and including an identifier for the associated file change event, a path to a file that was changed, a time stamp representative of when the file was changed, and an identifier for an application that is affected by the change to the file, and each folder change event data being associated with a folder having a path that is specified in one of the monitoring templates, and including an identifier for the associated folder change event, a path to a folder that was changed, a time stamp representative of when the folder was changed, and an identifier for an application that is affected by the change to the folder;

determining a time at which correlation is to be carried out and a target application for which correlation is to be carried out; and

searching the stored change event data to identify one or more change event data associated with the target application and having time stamps that are within a predetermined proximity to the determined time.

2. The method of claim 1, further comprising:

receiving an input made into a user interface that displays a time history of performance metrics of the target application,

wherein the time at which correlation is to be carried out is determined from the input.

3. The method of claim 2, further comprising:

displaying a list of items each describing one of the identified change events.

4. The method of claim 3, wherein at least one of the items describe that a text file was changed.

5. The method of claim 4, wherein the path to the text file that was changed references an archive file.

6. The method of claim 3, wherein at least one of the items describe that a binary file was changed.

7. The method of claim 6, wherein the path to the binary file that was changed references an archive file.

8. The method of claim 3, further comprising:

receiving a selection of one of the identified change events; and

instructing a computer that issued the selected change event to undo the change associated with the change event.

9. The method of claim 8, wherein said instructing includes the step of:

transmitting the identifier for the selected change event to the computer.

10. The method of claim 1, wherein data representative of a changed version of a text file is a diff file and data representative of a changed version of a binary file is a hash.

11. A non-transitory computer readable storage medium comprising instructions for causing a computer system to carry out a method for correlating changes in performance of applications deployed in a computer system to changes made to the applications, wherein each of the applications is associated with one of a plurality of monitoring templates and each of the monitoring templates specifies paths of files and folders to be monitored for the associated application, said method comprising:

receiving and storing change event data associated with file change events and folder change events occurring at each computer in the computer system, each file change event data being associated with a file having a path that is specified in one of the monitoring templates, and including an identifier for the associated file change event, a path to a file that was changed, a time stamp representative of when the file was changed, and an identifier for an application that is affected by the change to the file, and each folder change event data being associated with a folder having a path that is specified in one of the monitoring templates, and including an identifier for the associated folder change event, a path to a folder that was changed, a time stamp representative of when the folder was changed, and an identifier for an application that is affected by the change to the folder;

determining a time at which correlation is to be carried out and a target application for which correlation is to be carried out; and

searching the stored change event data to identify one or more change event data associated with the target application and having time stamps that are within a predetermined proximity to the determined time.

12. The non-transitory computer readable storage medium of claim 11, the method further comprising:

receiving an input made into a user interface that displays a time history of performance metrics of the target application,

wherein the time at which correlation is to be carried out is determined from the input.

13. The non-transitory computer readable storage medium of claim 12, the method further comprising:

displaying a list of items each describing one of the identified change events.

14. The non-transitory computer readable storage medium of claim 13, wherein at least one of the items describe that a text file was changed.

15. The non-transitory computer readable storage medium of claim 14, wherein the path to the text file that was changed references an archive file.

16. The non-transitory computer readable storage medium of claim 13, wherein at least one of the items describe that a binary file was changed.

17. The non-transitory computer readable storage medium of claim 16, wherein the path to the binary file that was changed references an archive file.

18. An application monitoring system comprising:

a physical central monitoring server including hardware; and

a plurality of monitored machines, each of which communicates change event data associated with file change events and folder change events occurring therein to the central monitoring server, the monitored machines having applications running therein that are monitored by the central monitoring server,

wherein each of the applications is associated with one of a plurality of monitoring templates and each of the monitoring templates specifies paths of files and folders to be monitored for the associated application,

wherein each file change event data is associated with a file having a path that is specified in one of the monitoring templates, and includes an identifier for the associated file change event, a path to a file that was changed, a time stamp representative of when the file was changed, and an identifier for an application that is affected by the change to the file,

wherein each folder change event data is associated with a folder having a path that is specified in one of the monitoring templates, and including an identifier for the associated folder change event, a path to a folder that was changed, a time stamp representative of when the folder was changed, and an identifier for an application that is affected by the change to the folder, and

wherein the change event data is generated by the monitored machines based on one or more of the monitoring templates.

19. The system of claim 18, wherein the monitored machines are physical machines.

20. The system of claim 18, wherein the monitored machines are virtual machines executed on physical machines.