Abstract: Automation solutions for event logging and debugging on KUBERNETES are disclosed. A system for providing no-instrumentation telemetry for a distributed application cluster includes at least one processor for executing computer-executable instructions stored in a memory. The instructions, when executed, instruct the at least one processor to provide an edge module configured to deploy a Berkeley Packet Filter (BPF) probe and a corresponding BPF program in the computing environment. The BPF probe is triggered based on an event associated with a distributed application running in a user space of the computing environment. Data associated with the event is captured in a kernel space of the computing environment via the BPF program. The captured data is transferred from the kernel space of the computing environment to the user space of the computing environment.

Abstract: High-throughput BPF map manipulations with uprobes are disclosed. A method for manipulating a Berkeley Packet Filter (BPF) map comprises running a user program in a user space of a computing environment. The user program includes a trigger function. A corresponding kernel BPF probe is installed by the user program on the trigger function. The kernel BPF probe is triggered by reaching a memory address of the trigger function in the user space. The trigger function includes one or more arguments that the BPF map agent interprets as operation parameters. The BPF map agent performs one or more operations to manipulate a BPF map in the kernel space based on the operation parameters.

Abstract: A monitoring system presents metrics or event data by monitoring state information of a computing system. In an embodiment, the monitoring system includes one or more processors that receive state information from an agent executing on the computing system. The state information describes a component of the computing system. In response to receiving the state information, the monitoring system generates aggregate state information based on the state information and prior state information previously received from the agent. The state information and prior state information may correspond to the same time period. The monitoring system generates subscribed state information from the aggregate state information. The subscribed state information is a subset of the aggregate state information selected using instructions of a client. The monitoring system sends the subscribed state information to the client to cause an update in a user interface presented by the client.

Abstract: A production environment monitoring system notes when problems or issues arise in a computer-based production environment. A noted problem or issue can trigger an escalation policy that calls for notifying an individual identified in the escalation policy to ask the individual to resolve or mitigate the problem or issue. The notification sent to the individual identified in the escalation policy also includes information about one or more individuals that are knowledgeable about the problem or issue that triggered the escalation policy and that may be able to provide assistance in resolving or mitigating the problem or issue.

Abstract: A system provides for tail-based sampling of span data at the trace level. The system may include a circuitry, such as one or more servers, that execute applications, agents, and a trace manager. The agents generate span data of operations performed by the applications. The trace manager receives the span data from the agents, and groups the operations defined by the span data into traces. The trace manager determines a selected subset of the traces for span data sampling and an unselected subset of the traces excluded from the span data sampling by comparing one or more trace characteristics of the traces with one or more trace criteria. The trace manager discards unselected span data of the unselected subset of the traces and provide selected span data of the selected subset of the traces to a monitoring system via a network.

Abstract: A distributed database receives an instruction to read or write data. The instruction includes a key. The database includes a key space defined by attoshards. An attoshard is a segment of key space having a size, in keys, proportional to a total number of nodes in the database. The attoshard includes keys for cluster segments at predefined positions in the attoshard. Each cluster segment corresponds to one cluster. A node of the database hashes the key to generate a token. The node performs a modulo operation on the token using the total number of nodes in the database to compute a remainder value. The node determines a cluster segment of an attoshard based on a position in the attoshard defined by the remainder value. The node determines a cluster for the instruction based on the cluster segment and executes the instruction at the determined cluster.

Abstract: An agent executed by a computer identifies a critical path of a transaction in a web application. The transaction includes a plurality of methods each representing an operation of the application and asynchronously executed by a server between a beginning of the transaction and an end of the transaction. The agent receives metrics for the transaction, which include identifiers of each executed method and specify relationships between the transaction methods. Based on the received metrics, the agent identifies a method completed at the end of the transaction. Based on the relationships between the methods, the agent determines one or more other methods preceding the identified method in the transaction and affecting a duration of the transaction. The determined methods and the method completed at the end of the transaction are identified as a critical path. Identifiers of the methods on the critical path are sent for display to a user.

Abstract: A system retrieves cluster data for a cluster including one or more nodes and one or more pods. The system displays, on a visual interface, a cluster visualization based on the retrieved cluster data. The cluster visualization includes, for each of the one or more nodes, a node spoke graphical element. Each node spoke graphical element includes a pod region indicating pods of the node and a health region indicating one or more health metrics of the node. A particular pod of the one or more pods in the cluster data is represented in the cluster visualization by a pod graphical element at the pod region of a node graphical element of a node corresponding to the particular pod. A graphical feature of the pod graphical element is indicative of at least one of one or more health metrics of the particular pod and one or more health metrics of a pod element within the particular pod.

Abstract: By monitoring requests to and from components of an application, an application analysis engine generates an inter-component graph for an application that identifies how the various components in the application are connected. When a performance issue is detected in association with the application, a traversal module traverses the inter-component graph to determine the possible execution paths that may have been the cause of the detected issue. The traversal module transmits requests to the correlation module to compare the metrics time series of the different components in the execution path with the detected issue. The correlation module compares metrics time series with the issue metric to identify correlations between execution patterns. The results of the correlation may be presented in a report that visually identify the root cause of the detected issues.

Abstract: A monitoring system presents metrics or event data by monitoring state information of a computing system. In an embodiment, the monitoring system includes one or more processors that receive state information from an agent executing on the computing system. The state information describes a component of the computing system. In response to receiving the state information, the monitoring system generates aggregate state information based on the state information and prior state information previously received from the agent. The state information and prior state information may correspond to the same time period. The monitoring system generates subscribed state information from the aggregate state information. The subscribed state information is a subset of the aggregate state information selected using instructions of a client. The monitoring system sends the subscribed state information to the client to cause an update in a user interface presented by the client.

Abstract: A series of graphical user interfaces allows a user to define rules for parsing unstructured and structured log data and generate an aggregate rule to identify events across multiple lines of one or more log files. A first graphical user interface allows a user to select a line from a log file under analysis, search for matching lines in the log file, define rules for parsing the log file, and tokenize attributes of the selected lines. A second user interface allows the user to aggregate defined rules so that messages may be correlated to identify events that occur across multiple lines.

Abstract: A system monitors an event loop executing on a host and determines causes for delays in tasks of the event loop. The system may include circuitry that receives, from an agent of the host, event loop data defining suspend and resume times of the tasks of the event loop executing on the host. The circuitry determines, based on the event loop data, event loop analysis data defining execution times for each of the tasks. The circuitry determines, based on the event loop analysis data, a cause of a delay in a task of the event loop as resulting from at least one of (i) a task delay in execution of the task or (ii) a loop delay in execution of another task of the event loop.

Abstract: Nodes on a token ring are rebalanced from an initial condition to a condition in which the load is optimally distributed based on a specified level of balance. Nodes are treated as electrically charged particles for purposes of the simulation and are assigned simulation values based on proportions between the size of the cluster, the computing power of the nodes, and the specified level of balance. A simulation module performs the rebalancing simulation by assigning the specified values to the particles and outputting, for each corresponding node, a token indicating the particle's final position and the position of the node on the token ring. The tokens are input to a redistribution module, which rebalances the cluster based on the generated tokens.

Abstract: A monitoring system using agents to dynamically collect state information at controllable intensity levels from components of systems. The system receives state information collected by an agent at a particular intensity level, and processes the state information to determine an updated intensity level for collecting state information by the agent, or by some other agent. The state information may include data indicating the performance of one or more components, such as process response times or other metrics. The intensity level for collecting further state information can be increased when, among other things, previously collected state information indicates more detailed monitoring for the component is appropriate. The intensity level for collecting further state information can be decreased when, among other things, previously collected state information indicates continued expected behavior.

Abstract: An application performance analyzer adapted to analyze the performance of one or more applications running on IT infrastructure, comprises: a data collection engine collecting performance metrics for one or more applications running on the IT infrastructure; an anomaly detection engine analyzing the performance metrics and detecting anomalies, i.e. performance metrics whose values deviate from historic values with a deviation that exceeds a predefined threshold; a correlation engine detecting dependencies between plural anomalies, and generating anomaly clusters, each anomaly cluster consisting of anomalies that are correlated through one or more of the dependencies; a ranking engine ranking anomalies within an anomaly cluster; and a source detection engine pinpointing a problem source from the lowest ranked anomaly in an anomaly cluster.

Abstract: Users of client devices can take any number of actions using applications of an application system to achieve an outcome. A monitoring system aggregates the interactions into a user interaction path. Over time, the monitoring system generates a large number of user interaction paths. The monitoring system analyzes the user interaction paths for correlation between interactions and outcomes. The monitoring system can correlate user interaction paths to generated interactions of a system interaction path. The monitoring system determines a correlation between interactions and outcomes by calculating a success factor based on an efficiency score and a prevalence score. The success factor is a measure correlation between a particular interaction of the application system and an outcome, the prevalence score is a measure of how often a particular interaction occurs, and the efficiency score is a measure of the application system performance for a particular interaction.

Abstract: A dynamic hash partition management scheme includes associating first partitions of a database with a first partition number, and second partitions of the database with a second partition number, associating first partitions of a database with a first partition number defining a total number of first partitions, and second partitions of the database with a second partition number defining a total number of second partitions. The method further includes, after receiving a request to insert a record in the database, determining an active partition number, and determining the first partition number as an active partition number. The method further includes determining a record key for the record, generating a partition identifier defining a partition of the first partitions using the record key and the active partition number, and inserting the record in the partition defined by the partition identifier.

Abstract: A monitoring system receives information from agents that monitors (e.g., unprivileged) containers, or applications in containers, executing across hosts to generate aggregated state information on a per-host basis. The system receives state information for each container, boot identifiers associated with the hosts of the container, and container identifiers. State information includes data describing the state of a container, or an application executing in the container. The boot identifier includes an identifier for a boot session of the host. The container identifier uniquely identifies each container. The monitoring system compares boot identifiers to determine containers that are co-located. If containers share a boot identifier, the monitoring system determines that the containers are co-located on the host that generated the boot identifier.

Abstract: Nodes on a token ring are rebalanced from an initial condition to a condition in which the load is optimally distributed based on a specified level of balance. Nodes are treated as electrically charged particles for purposes of the simulation and are assigned simulation values based on proportions between the size of the cluster, the computing power of the nodes, and the specified level of balance. A simulation module performs the rebalancing simulation by assigning the specified values to the particles and outputting, for each corresponding node, a token indicating the particle's final position and the position of the node on the token ring. The tokens are input to a redistribution module, which rebalances the cluster based on the generated tokens.

Abstract: A monitoring system using agents to dynamically collect state information at controllable intensity levels from components of systems. The system receives state information collected by an agent at a particular intensity level, and processes the state information to determine an updated intensity level for collecting state information by the agent, or by some other agent. The state information may include data indicating the performance of one or more components, such as process response times or other metrics. The intensity level for collecting further state information can be increased when, among other things, previously collected state information indicates more detailed monitoring for the component is appropriate. The intensity level for collecting further state information can be decreased when, among other things, previously collected state information indicates continued expected behavior.