Patent ID: 7891000

Claim:
A method of monitoring and reporting network activity of applications on a group of host computer systems, comprising: at a management computer system, providing network activity monitoring rules to the host computer systems, the network activity monitoring rules including rules for monitoring first and second network operations performed by the applications, each first network operation establishing a respective communications mechanism by which an application can engage in network communications with another computer system, each second network operation indicating that a respective communications exchange utilizing the communications mechanism has occurred between the application and the other computer system; wherein the network activity monitoring rules are used to detect ports that are enabled by the applications but are not in active use during a recent interval; in response to each host computer system of the group, (i) monitoring network activity of the applications residing on the host computer system in accordance with the network activity monitoring rules provided by the management computer system, (ii) storing local network activity data describing the monitored network activity of the applications in a local network activity data structure, and (iii) periodically uploading the local network activity data to the management computer system the management computer system, (i) receiving the local network activity data uploaded from each of the host computer systems of the group, (ii) utilizing the uploaded data from each of the host computer systems to periodically update a management database including network activity data for all the host computer systems of the group, (iii) in response to user request, generating a user-readable report from the management database showing the network activity of the applications of the host computers of the group, and (iv) in response to detecting the ports that are enabled by the applications but are not in active use during the recent interval, identifying a particular application from the applications to be de-activated; wherein the management computer system comprises one or more processors.