Abstract: A system that utilizes a plurality of time series of metric data to more accurately detect anomalies and model and predict metric values. Streams of time series metric data are processed to generate a set of independent metrics. In some instances, the present system may automatically analyze thousands of real-time streams. Advanced machine learning and statistical techniques are used to automatically find anomalies and outliers from the independent metrics by learning latent and hidden patterns in the metrics. The trends of each metric may also be analyzed and the trends for each characteristic may be learned. The system can automatically detect latent and hidden patterns of metrics including weekly, daily, holiday and other application specific patterns. Anomaly detection is important to maintaining system health and predicted values are important for customers to monitor and make planning and decisions in a principled and quantitative way.

Abstract: A system for naming a process being monitored that handles a requesting a framework such as a .NET framework. The process may be implemented by a .NET application framework within an IIS web server. The naming system allows for user readable names which are more than just numbers or indexes. The naming system is configured from a single location rather than from multiple locations, making it much easier to configure, change and update.

Abstract: The present technology utilizes agents to monitor and report data from Java virtual machines (JVM) to a controller as part of application performance monitoring. When a JVM is loaded, code defining an interface for agents is loaded as well. A determination may be made as to whether the loaded agent implements the interface defined at the JVM. If the loaded agent does not implement the interface, for example if it is missing one or more methods defined by the interface, the agent class may be modified to define the missing methods. The modification to the agent class may be made after compilation but before the class is loaded into the JVM.

Abstract: A dynamic service module is embedded in an agent and able to add functionality to the agent. The service module may manage .jar files for execution by the agent. The service module may receive the .jar files, provide them to an agent for execution, and may perform other functions. The agent may perform obfuscation in order to translate the .jar files into a modified version which may be more compatible with a particular agent. Once execution of the .jar file is complete, the agent may remove the .jar file as well as all trace of the .jar file. For example, the agent may remove byte code instrumentation that was installed as a result of the .jar file.

Abstract: A dynamic monitoring process begins with configuring a start and end method to be monitored. The dynamic monitoring process may intercept both the start and end methods as and when the loader is initiated or at runtime to dynamically attach and detach the instrumentation. A loader may then be modified to call a library method upon detection of the start method. The library method may serve as a notification to the start of the method and causes a reflector to retrieve information from the incoming request. The incoming information may include data from which a business transaction name may be determined. The business transaction name is then associated with the monitoring of the particular request. When an exit call is detected, a call may be made to the library for a method which invokes a decorator. The decorator may insert business transaction name and other data into the outgoing call.

Abstract: A system monitors applications and network flows used during the business transaction to determine distributed business transaction anomalies caused at least in part by network performance issues. A network flow associated with a business transaction is monitored by a network agent. The network agent may capture packets, analyze the packets and other network data to determine one or more baselines, and dynamically compare subsequent network flow performance to those baselines to determine an anomaly. When an anomaly in a network flow is detected, this information may be provided to a user along with other data regarding a business transaction that is utilizing the network flow. Concurrently with the network agent monitoring, application agents may monitor one or more applications performing the business transaction. The present system reports performance data for a business transaction in terms of application performance and network performance, all in the context of a distributed business transaction.

Abstract: Asynchronous handoffs between threads and other software components may be automatically detected, and the corresponding working objects may be tracked. The system may report monitoring information for an overall transaction that includes the original request and corresponding asynchronous requests. Automatically detecting asynchronous requests may include instrumenting a virtual machine, such as a Java Virtual Machine (JVM), to detect the creation of thread handoff objects and the object and/or thread execution. Thread handoff objects may automatically tracked, tracked based on data learned over time, tracked based on user input, and otherwise configured. In some embodiments, after detecting the creation of a thread handoff object, an identification of the object of the call may be identified as being tracked in another server or application.

Abstract: Asynchronous operations associated with a request such as synchronous threads, runnable elements, callable elements, and other invokable objects are tracked to determine the metrics about the request and operations. The present technology tracks the start and end of each asynchronous operation and maintains a counter which tracks the currently executing asynchronous operations. By monitoring the request, the start and end of each asynchronous operation associated with the request, and the number of asynchronous operations currently executing, the present technology may identify the end of a request by identifying when the last asynchronous operation associated with the request ends. In some instances, the present technology identifies the end of a request when a counter which tracks the number of asynchronous operations executing reaches a value of zero after the first asynchronous operation has already begun.

Abstract: A system monitors a network or web application provided by one or more distributed applications and provides data for each and every method instance in an efficient low-cost manner. Agents may monitor the performance of the distributed application by the web services and report monitoring data as runtime data to the remote server, for example a controller. The controller may analyze the data to identify one or more performance issues or “hot spot” methods based on current or past performance, functionality, content, or business relevancy. Instructions and/or configuration information may be transmitted by the controller to the agents that correspond to a particular business transaction portion associated with a hot spot. The portions are then monitored to collect data associated with the hot spot and the hot spot data is reported back to the controller.

Abstract: A network-based collaborative problem solving space is provided for managing alerts. The virtual collaboration space provide a virtual space for viewing streaming time series data, generating alerts for time series data, and viewing triggered alerts based on a threshold associated with the generated alert. Alert generation and triggering is automatically tracked within an event log, with particular event log entries associated with the alert generation and the triggering of an alert. When an alert is triggered, a link to the event log entry associated with generating the alert is provided. By reviewing the alert generation and surrounding event log entries, users of the virtual collaboration space may gain context as to the motivations for generating the original alert and thereby better understand whether the triggering of the alert is a serious issue.

Abstract: Business transactions and the nodes processing the transactions are monitored and actions are applied to one or more nodes when a performance issue is detected. A performance issue may relate to a metric associated with a transaction or node that processes the transaction. If a performance metric determined from data captured by monitoring does not satisfy a health rule, the policy determines which action should be performed to correct the performance of the node. When a problem is detected for multiple nodes, the present technology may address a subset of the multiple nodes rather than apply an action to each node experiencing the problem. When a solution is found to correct the problem with the subset of nodes, the solution may be applied to the other nodes experiencing the same problem.

Abstract: The present technology monitors a web application provided by one or more services. A service may be provided by applications. The monitoring system provides end-to-end business transaction visibility, identifies performance issues quickly and has dynamical scaling capability across monitored systems including cloud systems, virtual systems and physical infrastructures. In instances, a request may be received from a remote application. The request may be associated with a distributed transaction. Data associated with the request may be detected. A distributed transaction identifier may be generated for a distributed transaction based on the data associated with the request.

Abstract: A system monitors a network or web application provided by one or more distributed applications and provides data for each and every method instance in an efficient low-cost manner. The web application may be provided by one or more web services each implemented as a virtual machine or one or more applications implemented on a virtual machine. Agents may be installed on one or more servers at an application level, virtual machine level, or other level. The agent may identify one or more hot spot methods based on current or past performance, functionality, content, or business relevancy. Based on learning techniques, efficient monitoring, and resource management, the present system may capture data for and provide analysis information for outliers of a web application with very low overhead.

Abstract: A system for naming a process being monitored that handles a requesting a framework such as a .NET framework. The process may be implemented by a .NET application framework within an IIS web server. The naming system allows for user readable names which are more than just numbers or indexes. The naming system is configured from a single location rather than from multiple locations, making it much easier to configure, change and update.

Abstract: Business transactions and the nodes processing the transactions are monitored and actions are applied to one or more nodes when a performance issue is detected. A performance issue may relate to a metric associated with a transaction or node that processes the transaction. If a performance metric determined from data captured by monitoring does not satisfy a health rule, the policy determines which action should be performed to correct the performance of the node. When a problem is detected for multiple nodes, the present technology may address a subset of the multiple nodes rather than apply an action to each node experiencing the problem. When a solution is found to correct the problem with the subset of nodes, the solution may be applied to the other nodes experiencing the same problem.

Abstract: The present technology may determine an anomaly in a portion of a distributed business application. Data can automatically be captured and analyzed for the portion of the application associated with the anomaly. By automatically capturing data for just the portion associated with the anomaly, the present technology reduces the resource and time requirements associated with other code-based solutions for monitoring transactions. A method for performing a diagnostic session for a request may begin with initiating collection of diagnostic data associated with a request. An application thread on each of two or more servers may be sampled. The application threads may be associated with the same business transaction and the business transaction may be associated with the request. The diagnostic data may be stored.

Abstract: The present technology monitors a web application provided by one or more services. A service may be provided by applications. The monitoring system provides end-to-end business transaction visibility, identifies performance issues quickly and has dynamical scaling capability across monitored systems including cloud systems, virtual systems and physical infrastructures. In instances, a request may be received from a remote application. The request may be associated with a distributed transaction. Data associated with the request may be detected. A distributed transaction identifier may be generated for a distributed transaction based on the data associated with the request.

Abstract: A system that utilizes a plurality of time series of metric data to more accurately detect anomalies and model and predict metric values. Streams of time series metric data are processed to generate a set of independent metrics. In some instances, the present system may automatically analyze thousands of real-time streams. Advanced machine learning and statistical techniques are used to automatically find anomalies and outliers from the independent metrics by learning latent and hidden patterns in the metrics. The trends of each metric may also be analyzed and the trends for each characteristic may be learned. The system can automatically detect latent and hidden patterns of metrics including weekly, daily, holiday and other application specific patterns. Anomaly detection is important to maintaining system health and predicted values are important for customers to monitor and make planning and decisions in a principled and quantitative way.

Abstract: A system monitors a network or web application provided by one or more distributed applications and provides data for each and every method instance in an efficient low-cost manner. The web application may be provided by one or more web services each implemented as a virtual machine or one or more applications implemented on a virtual machine. Agents may be installed on one or more servers at an application level, virtual machine level, or other level. The agent may identify one or more hot spot methods based on current or past performance, functionality, content, or business relevancy. Based on learning techniques, efficient monitoring, and resource management, the present system may capture data for and provide analysis information for outliers of a web application with very low overhead.

Abstract: A distributed transaction is traced to determine how it is handled by applications which process the distributed transaction at least in part without threads. To trace the transaction, the business transaction may be named based on the application framework that handles the transaction. The tracing occurs in application frameworks which do not include multiple threads for handling transactions, such as for example a PHP application framework. The present technology may detect the framework and framework calls, and then generate a name for a business transaction based on the detected information. The business transaction may then be named based on the loaded application framework.