Abstract: In one aspect, a system for automatic application repair by a network device agent in a monitored environment includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: capture network device application data for a monitored application, the network device performing a function other than computing, analyze the captured data to detect a performance issue, identify a remedy associated with training data that corresponds to the captured data, and automatically applying the remedy to the network device.

Abstract: In one aspect, a system for controlling domain name service (DNS) caching is disclosed, the system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform various operations. The various operations include maintain a hard cache on a local disk that includes a file of DNS entries that persists and available for access by an application after a reboot of a Java Virtual Machine (JVM) system running the application; populate a runtime positive soft cache with the entries from the hard cache, wherein the positive soft cache represents DNS entries assumed to be successful for resolving DNS client calls from the application that persists until the reboot of the JVM system running the application; and load entries into the runtime positive soft cache populated from the hard cache in response to an application making DNS client calls.

Abstract: In one aspect, a system for exposing application metrics on the fly is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform various operations. The operations include initialize a Java managed object for Java Management Extension (JMX); attach the initialized Java managed object to a repository for Java managed objects accessible by applications; create a fixed reference to an attributes field in the attached Java managed object; provide the created fixed reference to the repository after initialization of the Java managed object; save the fixed reference; describe an attribute to be created; and create a new attribute in the Java managed object.

Abstract: In one aspect, a system for recommending a field name in data is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations. The operations performed include: receive a user selection from choices of data; convert the selected data into a searchable format; receive a user selection of a portion of the selected data; apply heuristics to the portion; and recommend a field name and a field type based on the heuristics applied to the portion.

Abstract: In one aspect, a system for intelligent monitoring of a network device in a monitored environment includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: capture network device application data for monitored application, capture network device resource data, generate model for transmitting performance data with minimum overhead based on captured network device resource data, and transmit data based on the model.

Abstract: In one aspect, a system for performing graph searches in an SQL style query for monitored data includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive, by a controller in communication with agents installed at machines connected over a network, monitored data regarding applications running over the machines; identify performance issues from the received monitored data; provide an interactive user interface to enable creation of a query for the monitored data and the identified performance issues; receive input associated with a new query including a SELECT clause, a FROM clause, and a WHEREIN clause; create the new query based on the received input; convert at least a portion of the new query to contain a graph traversal path entirely within the FROM clause; execute the new query; and return a result.

Abstract: In one aspect, a system for dynamically recycling a pool of Docker containers is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations. The operations include operations to manage for multiple accounts, monitored data received from agents installed at machines connected over a network, wherein the managed monitored data are associated with applications running over the machines for the multiple accounts; generate a model to estimates a Docker container pool capacity that can service the multiple accounts; receive performance alert action requests associated with the managed monitored data for at least a subset of the multiple accounts; based on the model, dynamically allocate a number of Docker containers in the pool that satisfies the estimated capacity; and update the model by performing simulations that uses additional data of Docker container usage.

Abstract: In one aspect, a system for displaying an interactive unified monitoring flow map of a distributed system is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations.

Abstract: A system for performing mid-method instrumentation includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: obtain bytecode representation of an application; identify a method in the bytecode including a beginning and an end of the method; identify lines of bytecode between the beginning and the end of the identified method; identify one or more of the lines of bytecode between the beginning and the end of the method to instrument with one or more interceptors; during runtime of the application, instrument the identified one or more of the lines of bytecode between the beginning and the end of the identified method by apply the one or more interceptors; and during the runtime of the application, receive information associated with the instrumented one or more lines of bytecode between the beginning and the end of the method.

Abstract: In one aspect, a system for correlating application performance data with hardware performance data vis heat maps is disclosed. The system includes: a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations. The operations include: receive data associated with monitored applications and hardware; identify application performance data and hardware performance data from the received data; generate interactive heat maps of the application performance data and interactive heat maps of the hardware performance data; provide a user interface for displaying the generated heat maps; and display, through the user interface, the generated heat maps of the application performance data and the generated heat maps of the hardware performance data using a common time scale.

Abstract: In one aspect, a system for automatic detection of webpage loading at a web browser of a client device in a monitored environment is disclosed. The system includes: a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations. The operations include: detect start of loading of a webpage at the web browser of the client device in the monitored environment; set a dynamic watchdog repeating timer at a value; start the timer; recursively check for completion of the loading of the webpage; when determined that the loading of the webpage has completed, determine whether a Java script engine of the web browser loading the webpage is idle; and when determined that the Java script engine of the web browser loading the webpage is idle, stop the timer and generate a report of the webpage.

Abstract: In one aspect, a system for detecting uninstrumented code in a monitored environment is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations. The operations include: provide a user interface that displays an interactive dashboard of the monitored environment; display, through the user interface, a stack trace that includes lines of code that are uninstrumented; receive a selection of one of the lines of code in the displayed stack trace; display live introspective data on the selected line of code; receive input requesting the selected line of code to be instrumented and monitored; and instrument the requested line of code and removing from display of the lines of code that are uninstrumented.

Abstract: In one aspect, a system for displaying a visual topology of a monitored distributed system is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive data associated with a monitored application performed over a distributed system of interconnected nodes of machines; identify nodes of interest and one or more chains of nodes connected to the nodes of interest from the interconnected nodes based on the received data; generate an interactive flow map of the interconnected nodes in the distributed system; provide a user interface for displaying the interactive flow map; and automatically display the interactive flow map through the provided user interface to visually distinguish the identified nodes of interest and the one or more chains of nodes connected to the nodes of interest from rest of the interconnected nodes.

Abstract: In one aspect, a system for correlating application performance data with network performance data is disclosed. The system includes: a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations.

Abstract: Application performance data and machine health are collected by a system. The system correlates the two data types to provide context as to how machine health affects the performance of an application. Performance data for an application, for example an application executing as part of a distributed business transaction, and health data for a machine which hosts the application are collected. The performance data and machine health data may be correlated for a particular period of time. The correlation may then be reported to a user. By viewing the correlation, a user may see when machine health was good and bad, and may identify the effects of the machine health on the performance of an application.

Abstract: Business transactions and the nodes processing the transactions may be monitored. Actions may be applied to one or more nodes when a performance issue is detected. A performance issue may relate to a metric associated with a transaction or node that processes the transaction. If a performance metric does not satisfy a health rule, the policy determines which action should be performed to correct the performance of the node. The corrective action may be applied to a node other than the node at which the performance metric is associated with. For example, if a performance metric for a first node does not satisfy a threshold, the corrective action may be applied to a second node. When a solution applied to a second node is found to correct the problem in first node, the solution may be applied to the other nodes experiencing the same problem.

Abstract: In one aspect, a machine learning system for performing anomaly grouping is disclosed. The machine learning system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive stack traces associated with corresponding anomaly events; automatically generate initial rules for grouping the anomaly events responsive to the received stack traces; apply the generated initial rules to the anomaly events; receive additional stack traces, user input, or both; update the initial rules based on the received additional stack traces, user input, or both; organize the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules; and provide a user interface to display the one or more groups of anomaly events.

Abstract: In one aspect, a system for providing automated root cause analysis of a monitored business transaction is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform various operations. For example, a performance issue associated with the business transaction running in a monitored environment can be detected and automated root cause analysis can be provided to present to a user a chain of entities associated with detected performance issue. A score can be provided for each node of entity in the chain to indicate which node of entity is likelihood to be a root cause candidate for the performance issue.

Abstract: A guided exploration is provided to enable a user to view relationships among different entities associated with a performance issue for a monitored entity. Entity relationship data is generated to describe how the different entities are related, and a dashboard user interface is provided to enable the user to view the generated entity relationship data. User input indicating a starting point for viewing the entity relationship data is received, and based on the received starting point, the generated entity relationship data is visually displayed to the user. The displayed entity relationship data is changed based on user input to enable the user to perform the guided exploration.

Abstract: In one aspect, a system for identifying a root cause of a performance issue in a monitored entity is disclosed. The system can detect a performance issue with the monitored entity running in a monitored environment of networked entities; receive a plurality of datatypes and associated data for each entity, the plurality of datatypes include metrics, events, logs, snapshots, and configurations; provide a dashboard user interface to display the datatypes and associated data for each entity as user selectable items; receive user input through the dashboard user interface that indicate a selection of two of the datatypes for performing correlation analysis; perform the correlation analysis using the received user selection of the two of the datatypes; identify a candidate root cause of the performance issue based on the correlation analysis; and display the identified candidate root cause through the dashboard user interface.