Application centric network experience monitoring

A system determines the performance of a network within the context of an application using that network. Network data is collected and correlated with an application that uses the network as well as a distributed transaction implemented by the application. The collected network data is culled, and the remaining data is rolled up into one or more metrics. The metrics, selected network data, and other data are reported in the context of the application that implements part of the distributed transaction. In this manner, specific network performance and architecture data is reported along with application context information.

BACKGROUND

The World Wide Web has expanded to provide numerous web services to consumers. The web services may be provided by a web application which uses multiple services and applications to handle a transaction. The applications may be distributed over several machines, making the topology of the machines that provide the service more difficult to track and monitor.

Monitoring a web application helps to provide insight regarding bottle necks in communication, communication failures and other information regarding performance of the services that provide the web application. Most application monitoring tools provide a standard report regarding application performance. Though the typical report may be helpful for most users, it may not provide the particular information that an administrator wants to know.

In particular, application performance management (APM) systems typically only monitor the performance of an application. The APM systems usually do not provide performance details of a particular network over which an application executes. If network information is provided, it is typically only the time that the transaction spends on the network—there is no context or other data regarding the network. What is needed is an APM system that provides application-specific network performance details.

SUMMARY

The present technology determines the performance of a network within the context of an application using that network. Network data is collected and correlated with an application that uses the network as well as a distributed transaction implemented by the application. The collected network data is culled, and the remaining data is rolled up into one or more metrics. The metrics, selected network data, and other data are reported in the context of the application that implements part of the distributed transaction. In this manner, specific network performance and architecture data is reported along with application context information.

An embodiment may include a method for correlating application performance data and network performance data for a distributed transaction. Application data may be collected by a first module installed on a first machine, such that the application data is collected during execution of an application. The application may be one of a plurality of applications on one or more machines that implement a distributed transaction. Network data may be collected for a network by a second module installed on the first machine, such that the network data is collected during execution of the application while implementing a portion of the distributed transaction over the network. The application data and the network data may be correlated using distributed transaction information. The correlated application data and the network data may be reported from a remote server.

An embodiment may include a system for reporting data. The system may include a processor, memory, and one or more modules stored in memory and executable by the processor. When executed, the modules may collect application data by a first module installed on a first machine, the application data collected during execution of an application, the application one of a plurality of applications on one or more machines that implement a distributed transaction, collect network data for a network by a second module installed on the first machine, the network data collected during execution of the application while implementing a portion of the distributed transaction over the network, correlate the application data and the network data using distributed transaction information, and report the correlated application data and the network data from a remote server.

DETAILED DESCRIPTION

The present technology determines the performance of a network within the context of an application using that network. Network data is collected and correlated with an application that uses the network as well as a distributed transaction implemented by the application. The collected network data is culled, and the remaining data is rolled up into one or more metrics. The metrics, selected network data, and other data are reported in the context of the application that implements part of the distributed transaction. In this manner, specific network performance and architecture data is reported along with application context information.

To provide application context to the network data, business transaction informant is provided to a module, such as an agent, that collects the network data. The network agent receives the distributed transaction information along with an identification of what network data to associate it with. The network agent collects network data, such as network flow group data, and identifies the network group data associated with the distributed transaction information. The network agent then generates metrics from the identified network group data, and transmits the metrics, the associated distributed transaction information, and optionally other data, such as the network group flow data, to a remote controller. The remote controller receives the data from the network agent, receives application metric data from other agents, and correlates the network flow group metrics and application metric data using the distributed transaction information. The controller may report the performance of the application along with network performance data and architecture information to the user for a particular application.

Correlating and reporting application and network performance data together brings relevant network level infrastructure visibility that directly correlates to application performance. The present monitoring is performed from a consumer point of view on a consumer machine, rather than from the point of view of some point on the network, which would not provide an entirely accurate picture of what is occurring from the point of view of the consumer. In some instances, the network monitoring system may be implemented on servers providing the application that executes over the network, and monitors network degradation to determine if the network degradation affects an application.

FIG. 1is a block diagram of a system for correlating an application and network performance data. System100ofFIG. 1includes client device105and192, mobile device115, network120, network server125, application servers130,140,150and160, asynchronous network machine170, data stores180and185, controller190, and data collection server195.

Client device105may include network browser110and be implemented as a computing device, such as for example a laptop, desktop, workstation, or some other computing device. Network browser110may be a client application for viewing content provided by an application server, such as application server130via network server125over network120.

Network browser110may include agent112. Agent112may be installed on network browser110and/or client105as a network browser add-on, downloading the application to the server, or in some other manner. Agent112may be executed to monitor network browser110, the operation system of client105, and any other application, API, or other component of client105. Agent112may determine network browser navigation timing metrics, access browser cookies, monitor code, and transmit data to data collection160, controller190, or another device. Agent112may perform other operations related to monitoring a request or a network at client105as discussed herein.

Mobile device115is connected to network120and may be implemented as a portable device suitable for sending and receiving content over a network, such as for example a mobile phone, smart phone, tablet computer, or other portable device. Both client device105and mobile device115may include hardware and/or software configured to access a web service provided by network server125.

Mobile device115may include network browser117and an agent119. Agent119may reside in and/or communicate with network browser117, as well as communicate with other applications, an operating system, APIs and other hardware and software on mobile device115. Agent119may have similar functionality as that described herein for agent112on client105, and may repot data to data collection server160and/or controller190.

Network120may facilitate communication of data between different servers, devices and machines of system100(some connections shown with lines to network120, some not shown). The network may be implemented as a private network, public network, intranet, the Internet, a cellular network, Wi-Fi network, VoIP network, or a combination of one or more of these networks. The network120may include one or more machines such as load balance machines and other machines.

Network server125is connected to network120and may receive and process requests received over network120. Network server125may be implemented as one or more servers implementing a network service, and may be implemented on the same machine as application server130. When network120is the Internet, network server125may be implemented as a web server. Network server125and application server130may be implemented on separate or the same server or machine.

Application server130communicates with network server125, application servers140and150, and controller190. Application server130may also communicate with other machines and devices (not illustrated inFIG. 1). Application server130may host an application or portions of a distributed application. The host application132may be in one of many platforms, such as including a Java, PHP, .NET, Node.JS, be implemented as a Java virtual machine, or include some other host type. Application server130may also include one or more agents134(i.e. “modules”), including a language agent, machine agent, and network agent, and other software modules. Application server130may be implemented as one server or multiple servers as illustrated inFIG. 1.

Application132and other software on application server130may be instrumented using byte code insertion, or byte code instrumentation (BCI), to modify the object code of the application or other software. The instrumented object code may include code used to detect calls received by application132, calls sent by application132, and communicate with agent134during execution of the application. BCI may also be used to monitor one or more sockets of the application and/or application server in order to monitor the socket and capture packets coming over the socket.

In some embodiments, server130may include applications and/or code other than a virtual machine. For example, server130may include Java code, .NET code, PHP code, Ruby code, C code or other code to implement applications and process requests received from a remote source.

Agents134on application server130may be installed, downloaded, embedded, or otherwise provided on application server130. For example, agents134may be provided in server130by instrumentation of object code, downloading the agents to the server, or in some other manner. Agents134may be executed to monitor application server130, monitor code running in a or a virtual machine132(or other program language, such as a PHP, .NET, or C program), machine resources, network layer data, and communicate with byte instrumented code on application server130and one or more applications on application server130.

Each of agents134,144,154and164may include one or more agents, such as a language agents, machine agents, and network agents. A language agent may be a type of agent that is suitable to run on a particular host. Examples of language agents include a JAVA agent, .Net agent, PHP agent, and other agents. The machine agent may collect data from a particular machine on which it is installed. A network agent may capture network information, such as data collected from a socket. Agents are discussed in more detail below with respect toFIG. 2.

Agent134may detect operations such as receiving calls and sending requests by application server130, resource usage, and incoming packets. Agent134may receive data, process the data, for example by aggregating data into metrics, and transmit the data and/or metrics to controller190. Agent134may perform other operations related to monitoring applications and application server130as discussed herein. For example, agent134may identify other applications, share business transaction data, aggregate detected runtime data, and other operations.

An agent may operate to monitor a node, tier or nodes or other entity. A node may be a software program or a hardware component (memory, processor, and so on). A tier of nodes may include a plurality of nodes which may process a similar business transaction, may be located on the same server, may be associated with each other in some other way, or may not be associated with each other.

Agent134may create a request identifier for a request received by server130(for example, a request received by a client105or115associated with a user or another source). The request identifier may be sent to client105or mobile device115, whichever device sent the request. In embodiments, the request identifier may be created when a data is collected and analyzed for a particular business transaction. Additional information regarding collecting data for analysis is discussed in U.S. patent application no. U.S. patent application Ser. No. 12/878,919, titled “Monitoring Distributed Web Application Transactions,” filed on Sep. 9, 2010, U.S. Pat. No. 8,938,533, titled “Automatic Capture of Diagnostic Data Based on Transaction Behavior Learning,” filed on Jul. 22, 2011, and U.S. patent application Ser. No. 13/365,171, titled “Automatic Capture of Detailed Analysis Information for Web Application Outliers with Very Low Overhead,” filed on Feb. 2, 2012, the disclosures of which are incorporated herein by reference.

Each of application servers140,150and160may include an application and agents. Each application may run on the corresponding application server. Each of applications142,152and162on application servers140-160may operate similarly to application132and perform at least a portion of a distributed business transaction. Agents144,154and164may monitor applications142-162, collect and process data at runtime, and communicate with controller190. The applications132,142,152and162may communicate with each other as part of performing a distributed transaction. In particular each application may call any application or method of another virtual machine.

Asynchronous network machine170may engage in asynchronous communications with one or more application servers, such as application server150and160. For example, application server150may transmit several calls or messages to an asynchronous network machine. Rather than communicate back to application server150, the asynchronous network machine may process the messages and eventually provide a response, such as a processed message, to application server160. Because there is no return message from the asynchronous network machine to application server150, the communications between them are asynchronous.

Data stores180and185may each be accessed by application servers such as application server150. Data store185may also be accessed by application server150. Each of data stores180and185may store data, process data, and return queries received from an application server. Each of data stores180and185may or may not include an agent.

Controller190may control and manage monitoring of business transactions distributed over application servers130-160. In some embodiments, controller190may receive application data, including data associated with monitoring client requests at client105and mobile device115, from data collection server160. In some embodiments, controller190may receive application monitoring data and network data from each of agents112,119,134,144and154. Controller190may associate portions of business transaction data, communicate with agents to configure collection of data, and provide performance data and reporting through an interface. The interface may be viewed as a web-based interface viewable by client device192, which may be a mobile device, client device, or any other platform for viewing an interface provided by controller190. In some embodiments, a client device192may directly communicate with controller190to view an interface for monitoring data.

Client device192may include any computing device, including a mobile device or a client computer such as a desktop, work station or other computing device. Client computer192may communicate with controller190to create and view a custom interface. In some embodiments, controller190provides an interface for creating and viewing the custom interface as content page, e.g. a web page, which may be provided to and rendered through a network browser application on client device192.

Applications132,142,152and162may be any of several types of applications. Examples of applications that may implement applications132-162include a Java, PHP, .Net, Node.JS, and other applications.

FIG. 2is a block diagram of a host which implements a standalone network agent. Host250may be implemented as a virtual machine, or an application of some type, such as a PHP application, or any other node capable of being monitored by an agent. Host250includes language agent220, network agent230, and machine agent240. Language agent220may be an agent suitable to instrument or modify, collect data from, and reside on a host. The host may be a Java, PHP, .Net, Node.JS, or other type of platform. Language agent220may collect flow data as well as data associated with the execution of a particular application. The language agent may instrument the lowest level of the application to gather the flow data. The flow data may indicate which tier is communicating which with which tier and on which port. In some instances, the flow data collected from the language agent includes a source IP, a source port, a destination IP, and a destination port. The language agent may report the application data and call chain data to a controller. The language agent may report the collected flow data associated with a particular application to network agent230.

Network agent230may be a standalone agent that resides on the host and collects network flow group data. The network flow group data may include a source IP, destination port, destination IP, and protocol information for network flow received by an application on which network agent230is installed. The network agent230may collect data by intercepting and performing packet capture on packets coming in from a one or more sockets. The network agent may receive flow data from a language agent that is associated with applications to be monitored. For flows in the flow group data that match flow data provided by the language agent, the network agent rolls up the flow data to determine metrics such as TCP throughput, TCP loss, latency and bandwidth. The network agent may then reports the metrics, flow group data, and call chain data to a controller. The network agent230may also make system calls at an application server to determine system information, such as for example a host status check, a network status check, socket status, and other information.

A machine agent240may reside on the host250and collect information regarding the machine which implements the host. A machine agent may collect and generate metrics from information such as processor usage, memory usage, and other hardware information.

Each of the language agent220, network agent230, and machine agent240may report data to the controller210. Controller210may be implemented as a remote server that communicates with agents220-240. The controller210may receive metrics call chain data and other data, correlate the received data as part of a distributed transaction, and report the correlated data in the context of a distributed application implemented by one or more monitored applications and occurring over one or more monitored networks. The controller may provide reports, one or more user interfaces, and other information for a user.

FIG. 3is a block diagram of a host that implements a plug-in network agent. Host350includes language agent320, network agent330, and machine agent340. Network agent330may be implemented as a plug-in module that is installed onto language agent320. The network agent330operates similarly to network agent230, but is installed in an agent rather than directly on the host.

FIG. 4is a block diagram of an open system interconnection module. The open systems interconnection model (OSI model) is a conceptual model that characterizes and standardizes the communication functions of a computing system. The seven layers of the model include a physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer. Language agents may collect data by monitoring an application layer. Network agents may collect data by monitoring a network layer, for example by monitoring a socket to collect the network layer data as it comes in over the socket. The different layers are monitored from a consumer device rather than the network in order to obtain the most accurate information from the point of view of the consumer.

FIG. 5is a block diagram of a data flow for an application and network performance monitoring system. The block diagram ofFIG. 5includes language agent510, network agent520, and controller530. Language agent510provides data to controller530and network agent520. Network agent520provides data to controller530. Language agent510receives application data from an application being monitored, application flow data from messages received by the application, and call chain data. Language agent510creates metrics from the application data and reports the application flow data and call chain data to the network agent520. Language agent510also reports the application data, application data metrics, and call chain data to the controller530. The application data and metrics are associated with a particular distributed transaction through the call chain data which specifies a particular sequence of machines that process a distributed transaction.

Network agent520receives network flow group data through packet capture performed while monitoring a socket. The network agent then generates metrics from the flow group data for flows that correspond to the application flow data received from the language agent510. Network agent520then reports the metrics as well as the flow group data associated with a particular application to the controller along with the call chain data. The controller receives the data from the language agent and network agent and correlates it together as a distributed transaction based on the call chain data associated with the distributed transaction.

FIG. 6is a method for providing a language agent in a monitoring system. First, application data and call chain data may be collected for an application that processes business transactions by a language agent at step610. The call chain data may include a series of machines and services that have previously processed an application transaction.

Network flow data is collected for selected applications by a language agent at step620. The network flow data may include a tuple of source IP, source port, destination IP, and destination port data. This data is collected as a time series of tuples by monitoring the deepest levels of an application by the language agent.

Network flow data and call chain data are provided to a network agent at step630. The network flow data and call chain data may be provided periodically, upon request of the network agent, or based on another event. The collected application data is an aggregated by the language agent at step640. The data may be aggregated into a series of metrics, such as response time, average time, and other data. Next, the aggregated application data and call chain data may be reported to a controller by the language agent at step650. The reported data is associated with a call chain, and is used to correlate with other reported data, such as network flow data and architecture data, at a controller.

FIG. 7is a method for providing a network agent in a monitoring system. Network flow group and network infrastructure data is collected by a network agent at step710. The data may be collected at a socket and includes network layer data such as source IP, destination port, destination IP, and protocol data. Application flow data and call chain data are received from a language agent by the network agent at step770. The call chain data and application flow data may be used by the network agent to identify flow group data for processing and reporting b to a controller y the network agent.

A subset of the network data collected by the network agent is identified at step730. The subset of flow group data that is collected corresponds to application flow data received by the network agent from the language agent. Hence, the network agent identifies flow group data received over a socket that matches flow data received from the language agent. Next, the identified network flow group data is aggregated into metrics by the network agent. Flow group data not matching the flow data is discarded, while matching flow group data is kept and rolled into one or more metrics by the network agent. The metrics may include TCP throughput, TCP packet loss, latency, bandwidth, and other metrics. After aggregating the metrics, the identified network flow group data and network infrastructure data, metrics, and call chain data may be reported to the controller by the network agent. The data may be reported periodically, in response to a request by a controller, or based on some other event.

FIG. 8is a method for providing a controller and a monitoring system. First, application data metrics and call chain data are received from a language agent by a controller at step810. Next, flow group data, flow group metrics and call chain data may be received from a network agent by the controller at step820. The application metrics and flow group metrics may then be correlated using the call chain data by the controller at step830. The correlated application data and network data may then be reported to a user by a controller at step840. Reporting the correlated application data is discussed in more detail below with respect toFIG. 9.

FIG. 9is a method for reporting correlated application data and network data. Application data and application infrastructure data is reported to a user at step910. The application data and infrastructure information may include an identification of the nodes, the application ID, and other information regarding an application. Network data and network infrastructure information may be reported at step920. The network infrastructure may include the nodes from which a message is sent and received, as well as any intermediary machines, such as a load balancer. Network metrics correlated with the application metrics may then be reported at step930. The metrics may include the performance of an application within the distributed transaction as well as the performance of the network that carried out the distributed transaction. An example of reporting network metrics correlated with application metrics is provided in the interface ofFIG. 10.

FIG. 10includes a first graphical interface1010which shows application data and metric information. Interface1010illustrates tier1in communication with tier2and tier3. The connection between tier1and tier2has metrics of 100 calls per minute and an average response time of 200 MS. The application metrics between tier1and tier3include an average of 25 calls per minute with an average response time of 400 MS for the application called between tier1and tier3.

Interface1020illustrates network infrastructure and metric information. Between tier1and tier2, the infrastructure of the network includes load balancer one. Between tier1and load balancer one, the metrics displayed are a 0% loss, a 20 MS FRTT, and a 20 MS RRTT. The network metrics between load balancer one and tier2also include a 0% loss, a 20 MS FRTT, and a 20 MS RRTT. The network metrics between tier1and load balancer two, which is determined to exist between tier1and tier3, include a 0% loss, a 20 MS FRTT, and a 20 MS RRTT. The network metrics between load balancer two and tier3include a 1% loss, a 20 MS FRTT, and a 20 MS RRTT. Because the percentage loss of data or packets between load balancer two and tier3is greater than an acceptable amount, the line representing the network path between load balancer two and tier3is highlighted as a thick FIGURE line than the other network paths. If a user were to select the particular network path associated with the 1% loss metric, the interface could provide the user with additional data associated with the particular flow from which the metrics were derived.

The application-based graphic1010and network-based graphic1020provide performance data for a particular distributed transaction, and are thereby correlated to each other. In particular, the application data and network data is provided for a portion of a distributed transaction that occurs between nodes1and nodes2and3.

FIG. 11is a block diagram of a system for implementing the present technology. System1100ofFIG. 11may be implemented in the contexts of the likes of client computer105and192, servers125,130,140,150, and160, machine170, data stores180and190, and controller190. The computing system1100ofFIG. 11includes one or more processors1110and memory1120. Main memory1120stores, in part, instructions and data for execution by processor1110. Main memory1120can store the executable code when in operation. The system1100ofFIG. 11further includes a mass storage device1130, portable storage medium drive(s)1140, output devices1150, user input devices1160, a graphics display1170, and peripheral devices1180.

The components shown inFIG. 11are depicted as being connected via a single bus1190. However, the components may be connected through one or more data transport means. For example, processor unit1110and main memory1120may be connected via a local microprocessor bus, and the mass storage device1130, peripheral device(s)1180, portable storage device1140, and display system1170may be connected via one or more input/output (I/O) buses.

Mass storage device1130, which may be implemented with a magnetic disk drive, an optical disk drive, a flash drive, or other device, is a non-volatile storage device for storing data and instructions for use by processor unit1110. Mass storage device1130can store the system software for implementing embodiments of the present invention for purposes of loading that software into main memory1120.

Portable storage device1140operates in conjunction with a portable non-volatile storage medium, such as a floppy disk, compact disk or Digital video disc, USB drive, memory card or stick, or other portable or removable memory, to input and output data and code to and from the computer system1100ofFIG. 11. The system software for implementing embodiments of the present invention may be stored on such a portable medium and input to the computer system1100via the portable storage device1140.

Input devices1160provide a portion of a user interface. Input devices1160may include an alpha-numeric keypad, such as a keyboard, for inputting alpha-numeric and other information, a pointing device such as a mouse, a trackball, stylus, cursor direction keys, microphone, touch-screen, accelerometer, and other input devices Additionally, the system1100as shown inFIG. 11includes output devices1150. Examples of suitable output devices include speakers, printers, network interfaces, and monitors.

Display system1170may include a liquid crystal display (LCD) or other suitable display device. Display system1170receives textual and graphical information, and processes the information for output to the display device. Display system1170may also receive input as a touch-screen.

Peripherals1180may include any type of computer support device to add additional functionality to the computer system. For example, peripheral device(s)1180may include a modem or a router, printer, and other device.

The system of1100may also include, in some implementations, antennas, radio transmitters and radio receivers1190. The antennas and radios may be implemented in devices such as smart phones, tablets, and other devices that may communicate wirelessly. The one or more antennas may operate at one or more radio frequencies suitable to send and receive data over cellular networks, Wi-Fi networks, commercial device networks such as a Bluetooth devices, and other radio frequency networks. The devices may include one or more radio transmitters and receivers for processing signals sent and received using the antennas.