Abstract:
Method and apparatus for continuous collection and correlation of application transactions across multiple tiers of an N-tier application employs an application monitoring appliance that observes application data and stores transactions and statistics. A reporting server aggregates and correlates monitored data from the application monitoring appliance and provides access via a web browser for viewing by a network engineer.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS  
       [0001]    This application claims priority of U.S. provisional patent application 61/149,656, filed Feb. 3, 2009. 
     
    
     BACKGROUND OF THE INVENTION  
       [0002]    This invention relates to networking, and more particularly to method and apparatus of the monitoring and analysis of network traffic. 
         [0003]    With reference to  FIG. 1 , in computer networks, an N-tier architecture is an application architecture in which different computing functionality is distributed among two or more separate computers in a distributed network. 
         [0004]    There may be multiple computers in each tier of the architecture. N implies any number such as 2-tier or 3-tier. An N-tier architecture could comprise any number of tiers. 
         [0005]    The most commonly used N-tier architecture is for a 3-tier application where a user&#39;s computer provides the user-interface, an application server provides the business logic, and a database server provides data storage. 4-tier architectures are also quite common. A 4-tier application is similar to the 3-tier application with the addition of a web server which provides load balancing and security functionality. 
         [0006]    In the configuration of  FIG. 1 , plural remote user blocks  12  are connected to a wide area network WAN  14 , through router  16 , firewall  18 , load balancer  20  and switch  22 , which may interface with multiple web servers  24 . A firewall  26  and switch  28  provide interface between the web servers and application servers  30 . Switch  32  interfaces between application servers  30  and database servers  34 . 
         [0007]    When a user accesses the front tier of an n-tier application several application transactions occur. One or more transactions could occur between each tier. See  FIG. 2 . 
         [0008]    In  FIG. 2 , an example diagram of an N-tier application transaction flow, a user is submitting a payment, represented by block  36 . HTTPS Request  38  is submitted to web server  24 ′, which submits an HTTP Request  40  to application server  30 ′. An SQL (Structured Query Language) exchange takes place between the server  30 ′ and an account information database  32 ′ maintained in a database server to update account information  44  and to update an audit log  46 . SQL exchange  48  between a database server and the application server returns information, which results in HTTP Response  50  from the application server  30 ′ to the web server  24 ′, and the web server communicates via HTTPS Response  52  to indicate payment received  54  to the user. 
         [0009]    Each component (or tier) which comprises an n-tier application communicates with other tiers by using a variety of protocols. When application performance and application content problems occur it is difficult to determine the cause of the problem because any component in the transaction chain may be the cause of the problem. 
         [0010]    Using traditional protocol analysis to troubleshoot problems in an n-tier environment is difficult, if not impossible, due to the large number of transactions that occur simultaneously between the tiers. 
       SUMMARY OF THE INVENTION  
       [0011]    In accordance with the invention, one or more application monitoring appliances observe application data across multiple tiers and determine performance statistics at certain time intervals and stores transaction data. A reporting server aggregates and correlates monitored data from one or more application monitoring appliances. 
         [0012]    In accordance with the invention, improved measurement and analysis of network traffic is enabled. 
         [0013]    Accordingly, it is an object of the present invention to provide an improved system and method of network analysis. 
         [0014]    It is a further object of the present invention to provide an improved network monitoring device for enabling enhanced troubleshooting of n-tier architectures. 
         [0015]    It is yet another object of the present invention to provide improved methods of network monitoring and analysis on n-tier architectures. 
         [0016]    Another object of the invention is to provide an improved method and apparatus for performing analysis of n-tier network traffic. 
         [0017]    The subject matter of the present invention is particularly pointed out and distinctly claimed in the concluding portion of this specification. However, both the organization and method of operation, together with further advantages and objects thereof, may best be understood by reference to the following description taken in connection with accompanying drawings wherein like reference characters refer to like elements. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS  
         [0018]      FIG. 1  is a block diagram of a typical n-tier application; 
           [0019]      FIG. 2  is an example diagram of an N-tier application transaction flow. 
           [0020]      FIG. 3  is a diagram of application monitoring architecture in accordance with the invention; 
           [0021]      FIG. 4  is an example transaction list. 
       
    
    
     DETAILED DESCRIPTION  
       [0022]    The system according to a preferred embodiment of the present invention comprises a method and apparatus for passively monitoring network communication between application components. 
         [0023]    An Application Analysis Engine analyzes the communication to identify application transactions. Several pieces of information and statistics are recorded for each transaction including the time at which the transaction occurred, the application, protocol used, client IP address, server IP address, response time, number of bytes, number of packets, and many more. This information is stored in a database so that it can later be viewed by a network engineer. The network engineer can view the transactions in a time-sorted list and also the transaction details to troubleshoot applications problems across all tiers of the n-tier architecture. 
         [0024]    The invention comprises a system that is capable of identifying and recording application transactions between each tier of an N-tier application. 
         [0025]    This invention solves the troubleshooting problem by recording the application transactions between all of the tiers continuously and then storing those transactions in persistent storage so that they can viewed together in a time-correlated manner 
         [0026]    In accordance with the invention, referring to  FIG. 3 , a diagram of an application monitoring system deployment architecture in a 3 tier system, for example, an application monitoring appliance  60  monitors traffic between application users  62  and Tier  1 , traffic between Tier  1  ( 64 ) and Tier  2  ( 66 ) and traffic between Tier  2  ( 66 ) and Tier  3  ( 68 ). In the illustrated example the traffic is observed application data  70 ,  70 ′,  70 ″. The application monitoring appliance includes a data store  72  which in the illustrated embodiment, includes 1-minute performance statistics (statistics calculated at 1-minute intervals) and transactions data. 
         [0027]    Application transactions that are transmitted between the tiers of an n-tier application are observed by the Application Monitoring Appliance  60  (AMA). The AMA  60  continuously monitors application transactions and stores performance statistics and transactions in persistent data store  72  on the AMA  60 , which may comprise a hard disk or other suitable storage. Application transactions that occur between the tiers are stored simultaneously. 
         [0028]    When the stored transactions have consumed the available storage capacity the oldest transactions are removed in a first-in-first-out manner. The number of transactions which can be stored is dependent on the size of the data store  72  hard disk in the AMA  60 . Millions of transactions can be stored which is typically equivalent to several days of application activity. 
         [0029]    The application monitoring appliance provides data to a reporting server  74  (which also includes a data store  76 ), the reporting server aggregating and correlating monitored data from one or more application monitoring appliances. 
         [0030]    The reporting server may be accessed by a network engineer to view performance data via a web browser  78 . The Performance Reporting Server  74  (PRS) thereby provides a web-based, reporting user-interface that allows users to view the performance statistics and transactions in a web-browser. More than one AMA  60  may be deployed if necessary to sufficiently monitor the desired application transactions. 
         [0031]    The PRS  74  correlates and aggregates the data from all of the AMAs  60 . The PRS  74  allows the user to view the transactions, which may have been collected by multiple AMAs  60  at different observation points, in a time-correlated transaction list. An example transaction list is shown in  FIG. 4 . 
         [0032]    In  FIG. 4 , 7 example transactions are show listing Time of Day, Client, Server, Protocol, Transaction type, Request, Response, Packets (sub category Client and Server), etc. 
         [0033]    Accordingly, the system provides the ability for a network engineer to view transactions in a time sorted list, and to view transaction details, to assist in trouble shooting application problems across all tiers of the n-tier architecture. 
         [0034]    While a preferred embodiment of the present invention has been shown and described, it will be apparent to those skilled in the art that many changes and modifications may be made without departing from the invention in its broader aspects. The appended claims are therefore intended to cover all such changes and modifications as fall within the true spirit and scope of the invention.