Network aware distributed business transaction anomaly detection

Patent metadata

Field	Value
Publication number	US-10212063-B2
Application number	US-201615390416-A
Country	US
Kind code	B2
Filing date	Dec 23, 2016
Priority date	Oct 30, 2015
Publication date	Feb 19, 2019
Grant date	Feb 19, 2019

Abstract

A system monitors applications and network flows used during the business transaction to determine distributed business transaction anomalies caused at least in part by network performance issues. A network flow associated with a business transaction is monitored by a network agent. The network agent may capture packets, analyze the packets and other network data to determine one or more baselines, and dynamically compare subsequent network flow performance to those baselines to determine an anomaly. When an anomaly in a network flow is detected, this information may be provided to a user along with other data regarding a business transaction that is utilizing the network flow. Concurrently with the network agent monitoring, application agents may monitor one or more applications performing the business transaction. The present system reports performance data for a business transaction in terms of application performance and network performance, all in the context of a distributed business transaction.

First claim

What is claimed is:

1. A method for monitoring a distributed business transaction over a plurality of machines and at least one network, comprising:
monitoring, by an application agent running on a host device in the at least one network, one or more applications running on the plurality of machines that process requests and perform one or more functions that make up the distributed business transaction to generate application data;
monitoring, by a network agent running on the host device in the at least one network, one or more sockets that are used to process one or more communications among the plurality of machines as part of the distributed business transaction by intercepting and performing packet capture on one or more packets from the one or more sockets to generate network flow data;
detecting, by the application agent, an application anomaly within at least one of the one or more monitored applications based on a performance baseline of the one or more application established by the application agent;
based on the detecting of the application anomaly, transmitting, by the application agent, a query to a plurality of network agents including the network agent to determine whether at least one of the plurality of network agents has detected a network flow anomaly, wherein the query includes one or more parameters that specify to the plurality of network agents which of the one or more communications to analyze to identify the network flow anomaly, and wherein the network flow anomaly is determined by the plurality of network agents based on a performance baseline of network flow established by the plurality of network agents;
based on the query, receiving, by the application agent, a detected network flow anomaly that is associated with the one or more communications specified by the one or more parameters;
transmitting, by the application agent, the detected application anomaly and the detected network flow anomaly to a controller device;
receiving, by the application agent and from the controller device, business transaction data associated with the distributed business transaction, wherein the business transaction data is indicative of a correlation between the detected application anomaly and the detected network flow anomaly, and wherein the correlation is based on stitching portions of data received from different agents into a plurality of groups of data associated with the distributed business transaction that identify the detected application anomaly as being affected by the detected network flow anomaly; and
receiving, by the application agent and from the controller device, a snapshot that displays the business transaction data on a web-based interface, the snapshot illustrating the plurality of machines associated with the detected application anomaly and performance of a network flow among the plurality of machines for the distributed business transaction, wherein the detected application anomaly is shown as being dependent on the performance of the network flow.

2. The method of claim 1 , wherein the query includes business transaction context Information, and wherein the network flow anomaly is determined by the plurality of network agents based on the business transaction context information.

3. The method of claim 1 , wherein the monitoring, by the application agent, the one or more applications includes collecting metrics associated with performance of the one or more applications on the plurality of machines that process the distributed business transaction.

4. The method of claim 1 , wherein the monitoring, by the network agent, the one or more sockets that are used to process the communications among the plurality of machines as part of the distributed business transaction includes collecting metrics associated with performance of a given network flow between the plurality of machines that process the distributed business transaction.

5. The method of claim 1 , wherein the correlation is further based on a grouping of the application data and the network flow data by matching address locations in the data received from the different agents.

6. The method of claim 1 , including providing a call graph that displays the correlated detected application anomaly and the detected network flow anomaly associated with the distributed business transaction.

7. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to cause operations for monitoring a distributed business transaction, including:
monitoring, by an application agent running on a host device in at least one network, one or more applications running on a plurality of machines that process requests and perform one or more functions that make up the distributed business transaction to generate application data;
monitoring, by a network agent running on the host device in the at least one network, one or more sockets that are used to process one or more communications among the plurality of machines as part of the distributed business transaction by intercepting and performing packet capture on one or more packets from the one or more sockets to generate network flow data;
detecting, by the application agent, an application anomaly within at least one of the one or more monitored applications based on a performance baseline of the one or more applications established by the application agent;
based on the detecting of the application anomaly, transmitting, by the application agent, a query to a plurality of network agents including the network agent to determine whether at least one of the plurality of network agents has detected a network flow anomaly, wherein the query includes one or more parameters that specify to the plurality of network agents which of the one or more communications to analyze to identify the network flow anomaly, and wherein the network flow anomaly is determined by the plurality of network agents based on a performance baseline of network flow established by the plurality of network agents;
based on the query, receiving, by the application agent, a detected network flow anomaly that is associated with the one or more communications specified by the one or more parameters;
transmitting, by the application agent, the detected application anomaly and the detected network flow anomaly to a controller device;
receiving, by the application agent and from the controller device, business transaction data associated with the distributed business transaction, wherein the business transaction data is indicative of a correlation between the detected application anomaly and the detected network flow anomaly, and wherein the correlation is based on stitching portions of data received from different agents into a plurality of groups of data associated with the distributed business transaction that identify the detected application anomaly as being affected by the detected network flow anomaly; and
receiving, by the application agent and from the controller device, a snapshot that displays the business transaction data on a web-based interface, the snapshot illustrating the plurality of machines associated with the detected application anomaly and performance of a network flow among the plurality of machines for the distributed business transaction, wherein the detected application anomaly is shown as being dependent on the performance of the network flow.

8. The non-transitory computer readable storage medium of claim 7 , wherein the query includes business transaction context information, and wherein the network flow anomaly is determined by the of plurality of network agents based on the business transaction context information.

9. The non-transitory computer readable storage

Assignees

• Appdynamics Llc
• Cisco Tech Inc

Inventors

• Nataraj Harish
• Chandel Ajay
• Kaligotla Prakash
• Kondapalli Naveen

Classifications

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• H04L43/087

  Jitter · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L43/0888

  Throughput · CPC title