Abstract: A system is provided for tracing end-to-end transactions. The system uses bytecode instrumentation and a dynamically injected agent to gather web server side tracing data, and a browser agent which is injected into browser content to instrument browser content and to capture tracing data about browser side activities. Requests sent during monitored browser activities are tagged with correlation data. On the web server side, this correlation information is transferred to tracing data that describes handling of the request. This tracing data is sent to an analysis server which creates tracing information which describes the server side execution of the transaction and which is tagged with the correlation data allowing the identification of the causing browser side activity.

Abstract: A system and method for the real-user capable monitoring of the rendering process of dynamically updated web pages is presented. The proposed approach deploys a browser agent to content loaded and displayed by a web browser which monitors resource load activities caused by the processing of the content by the browser and in-place content modifications caused by the executions of scripts and XHR communication by the browser. Those resource load and content modification activities affecting the visible area of the browser are identified and a point in time is calculated at which the visualization of the content for the visible area is complete. Further performance monitoring data describing the performance of the rendering process depending on the percentage of finished portions of the visible area over time is calculated. In addition, data describing the rendering process in detail may be captured by the browser agent which may be used for a later playback of the rendering process.

Abstract: A system and method for real-time discovery and monitoring of multidimensional topology models describing structural aspects of applications and of computing infrastructure used to execute those applications is disclosed. Different types of agents are deployed to the monitored application execution infrastructure dedicated to capture specific topological aspects of the monitored system. Virtualization agents detect and monitor the virtualization structure of virtualized hardware used in the execution infrastructure, operating system agents deployed to individual operating systems monitor resource utilization, performance and communication of processes executed by the operating system and transaction agents deployed to processes participating in the execution of transactions, providing end-to-end transaction trace and monitoring data describing individual transaction executions.

Abstract: A computer-implemented system is presented that enables automated testing of web applications operating within a web browser. The system is comprised of a recorder and a recorder interface. The recorder is configured to capture events received from a web page under test and operates to record the captured events in a test script, where the test script is defined in accordance with a scripting language. The recorder is implemented as a browser extension of the web browser. The recorder interface is configured to receive the test script from the recorder and transmit the test script from the computing device to a web portal hosted on a server located remotely from the computing device, where the test script is transmitted from the recorder interface to the web portal using web messaging.

Abstract: A system and method is disclosed for injecting in-process agents into processes executing self-contained, statically linked binaries that do not interact with a dynamic loader mechanism that identifies and resolves required libraries at run time. System calls directed to the execution of binaries in processes are intercepted and the targeted binary is analyzed to determine whether it is statically linked. In case a statically linked binary is identified, a proxy launcher process is started instead of the binary which starts the original binary as traceable child process. After the child process has loaded the original binary into its process memory, the memory image of the child process is copied to the launcher process and the child process is terminated. An agent is loaded into the launcher process to instruments the copied memory image.

Abstract: A system and method for the structured automation of the delivery and operation of software functionality is proposed. A declarative notation approach is used to describe automation sequences independently from concrete automation tools and services that may be used to execute the automation sequences. An automation service abstraction layer is introduced that hides concrete automation service characteristics from the declarative automation definition layer. The service abstraction layer enables a transparent change or update of concrete automation service without affecting automation sequences that use the corresponding service abstractions. For operation automation, the automation execution may be combined with causation-capable monitoring systems that both identifies critical changes of operating conditions for which automated remediation is indicated and corresponding root cause changes for those critical changes.

Abstract: A system and method for the estimation of the cardinality of large sets of transaction trace data is disclosed. The estimation is based on HyperLogLog data sketches that are capable to store cardinality relevant data of large sets with low and fixed memory requirements. The disclosure contains improvements to the known analysis methods for HyperLogLog data sketches that provide improved relative error behavior by eliminating a cardinality range dependent bias of the relative error. A new analysis method for HyperLogLog data structures is shown that uses maximum likelihood analysis methods on a Poisson based approximated probability model. In addition, a variant of the new analysis model is disclosed that uses multiple HyperLogLog data structured to directly provide estimation results for set operations like intersections or relative complement directly from the HyperLogLog input data.

Abstract: A system and method is presented that installs an agent on a computer system that monitors the start of processes by the computer system and that identifies the start of processes that perform container management activities, like starting and stopping container environments. On start of a container manager process, the agent starts a container manager agent that establishes a monitoring connection to the container manager process. The container manager agent monitors activities performed by the container manager process to detect the start of new container environments by the container manager process. On detection of a container start, the container manager agent manipulates the container configuration in a way that a process type specific in-process agent is automatically injected into processes started inside the container.

Abstract: A system and method is disclosed for the automated identification of causal relationships between a selected set of trigger events and observed abnormal conditions in a monitored computer system. On the detection of a trigger event, a focused, recursive search for recorded abnormalities in reported measurement data, topological changes or transaction load is started to identify operating conditions that explain the trigger event. The system also receives topology data from deployed agents which is used to create and maintain a topological model of the monitored system. The topological model is used to restrict the search for causal explanations of the trigger event to elements of that have a connection or interact with the element on which the trigger event occurred. This assures that only monitoring data of elements is considered that are potentially involved in the causal chain of events that led to the trigger event.

Abstract: A system and method is disclosed that provides fail-save, scalable and clustered correlation of transaction trace data. The transaction trace data is provided by a set of agents injected into application processes and processed by a set of clustered correlation servers. Each agent monitors parts of transaction executions performed by the application process into which it is injected. The agents generate transaction trace data fragments describing the transaction execution part and report those transaction trace data fragments to the correlation cluster. Routing of transaction trace data from agents to correlation servers is performed in a way that transaction data fragments describing a specific transaction are received by one correlation server regardless of the agent sending it. Intermediate nodes may be used to server as proxy between agents and the correlation server cluster to further improve the availability and failure tolerance of the monitoring system.

Abstract: A system and method for the distributed analysis of high frequency transaction trace data to constantly categorize incoming transaction data, identify relevant transaction categories, create per-category statistical reference and current data and perform statistical tests to identify transaction categories showing overall statistically relevant performance anomalies. The relevant transaction category detection considers both the relative transaction frequency of categories compared to the overall transaction frequency and the temporal stability of a transaction category over an observation duration. The statistical data generated for the anomaly tests contains next to data describing the overall performance of transactions of a category also data describing the transaction execution context, like the number of concurrently executed transactions or transaction load during an observation period.

Abstract: A system and method is disclosed for identifying and evaluating the business relevant impact of observed operating anomalies of monitored components of computing environments like data centers or cloud computing environments. The disclosed technology uses end-to-end transaction trace, availability and resource utilization data in combination with topology data received from agents deployed to the monitored computing environment. An abnormal operating condition is localized within a topological model of the monitored environment and has a defined temporal extent. On detection of an anomaly, affected transaction traces are selected that used the topology entity on which the anomaly was observed while the anomaly existed. Those transactions are then traced backwards, until a topology entity is reached that represents an entry point of monitored system.

Abstract: A system and method for the real-user capable monitoring of the rendering process of dynamically updated web pages is presented. The proposed approach deploys a browser agent to content loaded and displayed by a web browser which monitors resource load activities caused by the processing of the content by the browser and in-place content modifications caused by the executions of scripts and XHR communication by the browser. Those resource load and content modification activities affecting the visible area of the browser are identified and a point in time is calculated at which the visualization of the content for the visible area is complete. Further performance monitoring data describing the performance of the rendering process depending on the percentage of finished portions of the visible area over time is calculated. In addition, data describing the rendering process in detail may be captured by the browser agent which may be used for a later playback of the rendering process.

Abstract: A system and method for the distributed analysis of high frequency transaction trace data to constantly categorize incoming transaction data, identify relevant transaction categories, create per-category statistical reference and current data and perform statistical tests to identify transaction categories showing overall statistically relevant performance anomalies. The relevant transaction category detection considers both the relative transaction frequency of categories compared to the overall transaction frequency and the temporal stability of a transaction category over an observation duration. The statistical data generated for the anomaly tests contains next to data describing the overall performance of transactions of a category also data describing the transaction execution context, like the number of concurrently executed transactions or transaction load during an observation period.

Abstract: A combined transaction execution monitoring, transaction classification and transaction execution performance anomaly detection system is disclosed. The system receives and analyzes transaction tracing data which may be provided by monitoring agents deployed to transaction executing entities like processes. In a first classification stage, parameters are extracted from received transaction tracing data, and the transaction tracing data is tagged with the extracted classification data. A subsequent measure extraction stage analyzes the classified transaction tracing data and creates corresponding measurements which are tagged with the transaction classifier. A following statistical analysis process maintains statistical data describing the long term statistical behavior of classified measures as a baseline, and also calculates corresponding statistical data describing the current statistical behavior of the classified measures.

Abstract: A system and method for the creation of locality sensitive hash signatures using weighted feature sets is disclosed. The disclosed methodology takes advantage of discretization mechanisms commonly used in computer systems to model the influence of the feature weights on the calculated hash signature. Pseudo random numbers required for the signature calculation are created in ascending order, which enables the signature generation mechanism to identify and avoid the unnecessary creation of pseudo random numbers to improve the performance of the signature calculation process. Further, hierarchic, tree-search like algorithms are used during the processing of signature weights to further decrease the number of required random numbers. The features of the Poisson Process model, like its ability to provide random numbers in ascending order and the split- and mergeability of Poisson Processes are used to further improve the performance of the signature calculation process.

Abstract: A system and method for automatic instrumentation of mobile applications is presented. Mobile applications are typically executed in mobile runtime environments or operating system that is restricted compared to their conventional counterparts. Those restrictions include features that allow one to examine and modify code of application during the runtime of the application. Those features that are used by instrumentation based monitoring systems dedicated for conventional applications are thus not available for the instrumentation of mobile application. The system and method allow automatic instrumentation in a static way, either by persistently placing instrumentation code into mobile applications or by persistently adapting mobile applications in a way to perform a static instrumentation on application startup.

Abstract: A system and method for the efficient monitoring of memory allocations performed during the executing code is presented. The proposed approach analyzes the code to build a control flow graph that describes all possible execution sequences of the code. Individual execution paths are identified by an analysis of the control path and memory allocation counters representing the memory allocations of each execution path are placed in the code. The memory allocation counters provide next to data describing memory allocations also execution frequency data of execution paths. The execution frequency data is used to identify the path with the highest execution frequency. The position of the memory allocation counters is further adapted with the optimization goal that the path with the highest execution frequency triggers the least number of memory allocation counter increments.

Abstract: A system and method is disclosed that installs an agent on a computer system that is configured to be automatically started at startup of the computer system and that is also configured to detect the startup of processes on the computer system. The agent determines the capabilities to monitor process starts that available on the computer systems and installs an appropriate process start monitoring procedure. The installed process start monitoring procedure detects the start of a process, installs a core agent into the execution context of the started process and manipulates the start sequence of the started process to initialize and start the core agent. On startup, the core agent analyzes the execution context of the started process to identify the type of application executed by the started process, and injects a special agent matching the identified type into the started process to perform application level monitoring.

Abstract: A computer-implemented system is provided that enables synthetic testing of web applications using monitoring agents instrumented in web content. A playback engine is configured to receive a test script for testing a given web page and initiates loading of the given web page by a web browser. A monitoring agent has a tag embedded into a document object model of the given web page and is a script defined in accordance with the scripting language. During playback of the test script by the playback agent, the monitoring agent determines a performance metric for the given web page. A wait agent has a tag embedded into the markup language of the given web page. During building of the document object model for the given web page, operates to inject the tag for the monitoring agent into the document object model for the given web page.