Patent ID: 8260907

Claim:
A method of collecting data processing system status information, comprising: passively monitoring network communications with the data processing system and observing transactions from the passively monitored network communications, the transactions include application level request/response pairs associated with the data processing system, the passively monitoring and observing comprises: filtering packets to discard packets for a first set of one or more application level protocols and keep packets for a second set of one or more application level protocols, assembling packets kept in the filtering into flows, parsing flows for transaction content, demarcating the transactions in the flows, accessing user identification information in a login transaction, accessing session identification information in the login transaction, associating the session identification with the user identification; analyzing the transactions observed from the passively monitored network communications to determine if the transactions comply with a quality standard; accessing a particular transaction, other than the login transaction, that includes the session identification and does not include the user identification information; using the session identification from the particular transaction to identify the user identification for the particular transaction based on the associating of the session identification with the user identification; creating quality event messages for transactions that do not comply with the quality standard; correlating like quality event messages; determining whether the correlated like quality event messages as an aggregate meet a predefined service quality condition; generating a trigger if the correlated like quality event messages as an aggregate meet the predefined service quality condition; determining to generate the trigger in response to a problem transaction not complying with the quality standard without correlating a quality event message for the problem transaction if a user identification for the problem transaction is predetermined to require immediate action; collecting a set of data processing system status information only in response to the generation of the trigger; and storing the set of collected data processing system status information.