Abstract: In one aspect, a system for recommending a field name in data is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations. The operations performed include: receive a user selection from choices of data; convert the selected data into a searchable format; receive a user selection of a portion of the selected data; apply heuristics to the portion; and recommend a field name and a field type based on the heuristics applied to the portion.

Abstract: In one aspect, a system for controlling domain name service (DNS) caching is disclosed, the system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform various operations. The various operations include maintain a hard cache on a local disk that includes a file of DNS entries that persists and available for access by an application after a reboot of a Java Virtual Machine (JVM) system running the application; populate a runtime positive soft cache with the entries from the hard cache, wherein the positive soft cache represents DNS entries assumed to be successful for resolving DNS client calls from the application that persists until the reboot of the JVM system running the application; and load entries into the runtime positive soft cache populated from the hard cache in response to an application making DNS client calls.

Abstract: In one aspect, a system for intelligent monitoring of a network device in a monitored environment includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: capture network device application data for monitored application, capture network device resource data, generate model for transmitting performance data with minimum overhead based on captured network device resource data, and transmit data based on the model.

Abstract: In one aspect, a system for automatic application repair by a network device agent in a monitored environment includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: capture network device application data for a monitored application, the network device performing a function other than computing, analyze the captured data to detect a performance issue, identify a remedy associated with training data that corresponds to the captured data, and automatically applying the remedy to the network device.

Abstract: In one aspect, a system for performing graph searches in an SQL style query for monitored data includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive, by a controller in communication with agents installed at machines connected over a network, monitored data regarding applications running over the machines; identify performance issues from the received monitored data; provide an interactive user interface to enable creation of a query for the monitored data and the identified performance issues; receive input associated with a new query including a SELECT clause, a FROM clause, and a WHEREIN clause; create the new query based on the received input; convert at least a portion of the new query to contain a graph traversal path entirely within the FROM clause; execute the new query; and return a result.

Abstract: In one aspect, a system for automatic detection of webpage loading at a web browser of a client device in a monitored environment is disclosed. The system includes: a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations. The operations include: detect start of loading of a webpage at the web browser of the client device in the monitored environment; set a dynamic watchdog repeating timer at a value; start the timer; recursively check for completion of the loading of the webpage; when determined that the loading of the webpage has completed, determine whether a Java script engine of the web browser loading the webpage is idle; and when determined that the Java script engine of the web browser loading the webpage is idle, stop the timer and generate a report of the webpage.

Abstract: In one aspect, a system for displaying an interactive unified monitoring flow map of a distributed system is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations.

Abstract: In one aspect, a system for displaying a visual topology of a monitored distributed system is disclosed. The system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive data associated with a monitored application performed over a distributed system of interconnected nodes of machines; identify nodes of interest and one or more chains of nodes connected to the nodes of interest from the interconnected nodes based on the received data; generate an interactive flow map of the interconnected nodes in the distributed system; provide a user interface for displaying the interactive flow map; and automatically display the interactive flow map through the provided user interface to visually distinguish the identified nodes of interest and the one or more chains of nodes connected to the nodes of interest from rest of the interconnected nodes.

Abstract: Application performance data and machine health are collected by a system. The system correlates the two data types to provide context as to how machine health affects the performance of an application. Performance data for an application, for example an application executing as part of a distributed business transaction, and health data for a machine which hosts the application are collected. The performance data and machine health data may be correlated for a particular period of time. The correlation may then be reported to a user. By viewing the correlation, a user may see when machine health was good and bad, and may identify the effects of the machine health on the performance of an application.

Abstract: Business transactions and the nodes processing the transactions may be monitored. Actions may be applied to one or more nodes when a performance issue is detected. A performance issue may relate to a metric associated with a transaction or node that processes the transaction. If a performance metric does not satisfy a health rule, the policy determines which action should be performed to correct the performance of the node. The corrective action may be applied to a node other than the node at which the performance metric is associated with. For example, if a performance metric for a first node does not satisfy a threshold, the corrective action may be applied to a second node. When a solution applied to a second node is found to correct the problem in first node, the solution may be applied to the other nodes experiencing the same problem.

Abstract: In one aspect, a machine learning system for performing predictive analytics on database wait events is disclosed. The machine learning system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive database wait event data indicative wait events associated with database calls running on a monitored database; receive database performance data indicative of performance of the monitored database; correlate the received database wait event data with the received database performance data to obtain a correlation result; predict a performance issue with the monitored database based on the correlation result; and provide a user interface to display the predicted performance issue.

Abstract: In one aspect, a machine learning system for performing anomaly grouping is disclosed. The machine learning system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive stack traces associated with corresponding anomaly events; automatically generate initial rules for grouping the anomaly events responsive to the received stack traces; apply the generated initial rules to the anomaly events; receive additional stack traces, user input, or both; update the initial rules based on the received additional stack traces, user input, or both; organize the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules; and provide a user interface to display the one or more groups of anomaly events.

Abstract: In one aspect, a system for identifying a root cause of a performance issue in a monitored entity is disclosed. The system can detect a performance issue with the monitored entity running in a monitored environment of networked entities; receive a plurality of datatypes and associated data for each entity, the plurality of datatypes include metrics, events, logs, snapshots, and configurations; provide a dashboard user interface to display the datatypes and associated data for each entity as user selectable items; receive user input through the dashboard user interface that indicate a selection of two of the datatypes for performing correlation analysis; perform the correlation analysis using the received user selection of the two of the datatypes; identify a candidate root cause of the performance issue based on the correlation analysis; and display the identified candidate root cause through the dashboard user interface.

Abstract: Instead of processing a complex query having multiple interdependent levels of subqueries as-is, each level is processed to return results in subsets. Each level of subquery can be chunked or the results broken into subsets using pagination. The smaller subsets of the results are streamed back to the requestor and the next level of subquery to continue processing the complex query to substantially decrease the user's time to value when running a complex query by returning some immediate results for display which are refined and eventually converge on the full results as each chunked query runs.

Abstract: A system for providing adaptive metric pruning includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive, by a collector, metadata associated with the business transaction running in a monitored environment; train a machine learning system by providing training data and an anticipated result for the training data to the machine learning system to generate rules for retaining given metadata; predict a retention requirement for the received metadata by providing the received metadata to the machine learning system to apply the generated rules and generate a result for retaining the received metadata; and provide a user interface to display the generated result for retaining the received metadata including a recommendation on how to retain the received metadata according to the result for retaining the received metadata.

Abstract: A guided exploration is provided to enable a user to view relationships among different entities associated with a performance issue for a monitored entity. Entity relationship data is generated to describe how the different entities are related, and a dashboard user interface is provided to enable the user to view the generated entity relationship data. User input indicating a starting point for viewing the entity relationship data is received, and based on the received starting point, the generated entity relationship data is visually displayed to the user. The displayed entity relationship data is changed based on user input to enable the user to perform the guided exploration.

Abstract: An interface is provided for a user to create a custom dashboard for providing application performance data. The dashboard may be created from one or more widgets, such as graphs, charts, and other display components, and each widget may be individually configured with parameters. The dashboard may be configured to display data for one or more particular transactions, transaction types, or transactions that meet specified criteria. Once created, the dashboard may be shared through a website URL, e-mail, or other method.

Abstract: A system monitors asynchronous transactions over a different number of threads by capturing data and tracking transitions in the particular framework. Once an asynchronous method is called, the transition framework may be tracked while executing a asynchronous method call. Within a .NET framework, monitoring may include tracking a task object return, continuation method calls at the completion of a method, and tracking the continuation method as it executes other code. The asynchronous method may then be correlated within a business transaction using the returned task object data.

Abstract: A system uses agents to monitor a distributed business transaction as well as monitor changes in software configuration. An agent may detect a file load, such a class load, obtain portions of the file such as functions, and perform a hash on the byte code functions. A hash tree may then be constructed and compared to previous states of the system. The hash tree may be generated, for example, at each file loading detected, so that system states can be compared. Differences in hash trees are detected and the changes are reported to an administrator of the system that provides the distrusted business transaction.

Abstract: In one aspect, a system for pre-fetching performance data in a monitored environment is disclosed. The system can include a processor; a memory; and one or more modules stored in the memory. The one or more modules are executable by the processor to perform operations including: record queries that request for application performance data with latencies longer than a threshold; learn access patterns in the recorded queries with latencies longer than the threshold; pre-fetch and cache the application performance data requested by the recorded queries before the same recorded queries are requested next time; and provide the pre-fetched application performance data from the cache when the same recorded queries are requested next time.