Abstract: A system and method is disclosed that analyzes a set of historic transaction traces to identify an optimized set of transaction clusters with the highest transaction frequency. The transaction clusters are defined according to multiple parameters describing the execution context of the analyzed transactions. The transaction clusters are described by coordinates in a multidimensional, hierarchical classification space. Descriptive statistical data is extracted from historic transactions corresponding to previously identified transaction clusters and stored as reference data. Transaction trace data from currently executed transactions is analyzed to find a best matching historic transaction cluster. The current transaction traces are grouped according to their corresponding historic transaction cluster.

Abstract: A system and method for tracing individual transactions on method call granularity is disclosed. The system uses instrumentation based transaction tracing mechanisms to enhance thread call stack sampling mechanisms by a) only sampling threads executing monitored transactions while execution is ongoing b) tagging sampled call stacks with a transaction id for correlation of sampled call stacks with instrumentation bases tracing data. The combination of instrumentation based tracing with thread call stack sampling reduces sampling generated overhead by only sampling relevant thread, and reduces instrumentation generated overhead because it allows reducing instrumentation.

Abstract: A transaction monitoring and tracing system which combines transactional performance monitoring aspects with infrastructure performance and utilization measures, like e.g. used memory or CPU load of transaction executing computing infrastructure. The system uses two types of agents deployed to the monitored system, a transaction and process agent, which is deployed to a process executing monitored transactions, and a host agent, which is deployed to a computer system executing processes monitored by a transaction and process agent. The transaction and process agent provides transaction tracing and process infrastructure measurements, the host agent provides host or operating system infrastructure measurements. All three types of measurements are tagged by the corresponding agent in a way that allows a later correlation of corresponding tracing and measurement data by an external monitoring node.

Abstract: A performance management system is provided that measures end user performance in a distributed computing environment. The system detects DOM updates caused by browser side activities, and identifies resource load requests introduced by a DOM update that request resource from third party sources. For such resource load requests, resource sensors are installed which detect the point in time when loading the resource was finished. This allows to measure load time for individual resource load requests requesting third party resources, and to assign the tracing and performance monitoring data describing those resource load requests to the tracing and performance monitoring data describing the browser side transaction execution that caused the third party resource loads.

Abstract: A system and method for real-time discovery and monitoring of multidimensional topology models describing structural aspects of applications and of computing infrastructure used to execute those applications is disclosed. Different types of agents are deployed to the monitored application execution infrastructure dedicated to capture specific topological aspects of the monitored system. Virtualization agents detect and monitor the virtualization structure of virtualized hardware used in the execution infrastructure, operating system agents deployed to individual operating systems monitor resource utilization, performance and communication of processes executed by the operating system and transaction agents deployed to processes participating in the execution of transactions, providing end-to-end transaction trace and monitoring data describing individual transaction executions.

Abstract: A system and method for tracing individual transactions on method call granularity is disclosed. The system uses instrumentation based transaction tracing mechanisms to enhance thread call stack sampling mechanisms by a) only sampling threads executing monitored transactions while execution is ongoing b) tagging sampled call stacks with a transaction id for correlation of sampled call stacks with instrumentation bases tracing data. The combination of instrumentation based tracing with thread call stack sampling reduces sampling generated overhead by only sampling relevant thread, and reduces instrumentation generated overhead because it allows reducing instrumentation.

Abstract: Method and system, comprising: capturing a plurality of secure communications between the first application and the second application; grouping the plurality of communications into one or more streams, each stream representing a network connection; and processing the one or more streams in parallel to create a plurality of transactions.

Abstract: A method and system for detection of completeness of tracing data describing globally distributed, synchronous and asynchronous transaction in real time is presented. Monitored transactions may be executed on different computers systems, connected via computer networks with different and fluctuating latencies, and timing systems of the computers systems may be subject to different time drifts. The system and method may be implemented by different, multiple collector nodes responsible for collecting and forwarding transaction tracing data to a monitoring node, responsible for correlating transaction tracing data. Collector nodes and monitoring node may reside on different computer systems, which may be connected via computer networks with different and fluctuating latencies, and timing systems of the computers systems may be subject to different time drifts.

Abstract: Systems and methods comprising a context analyzer configured to associate one or more Hypertext Transfer Protocol (HTTP) transactions, an extensible document parser configured to parse a document included in the one or more HTTP transactions; and a library of parser additions used by the context analyzer to generate context-full replay instructions.

Abstract: Methods and Systems for non-intrusive real-time analysis of secure communications between a first application and a second application, wherein the first and second applications communicate through a communication channel. A plurality of secure communications between the first application and the second application is non-intrusively and securely captured. The plurality of communications is processed to process communications from a physical layer to a network layer. The plurality of communications is grouped into a plurality of streams and connection meta information is added to each stream, wherein each stream represents a single network connection. A plurality of transactions is created from the communications included in the plurality of streams, wherein a stream within the plurality of streams is encrypted, and the encrypted stream is decrypted.

Abstract: Systems and methods comprising a context analyzer configured to associate one or more Hypertext Transfer Protocol (HTTP) transactions, an extensible document parser configured to parse a document included in the one or more HTTP transactions; and a library of parser additions used by the context analyzer to generate context-full replay instructions.

Abstract: The presented enhancement of a rule based instrumentation system taking object oriented inheritance relationships into account is directed to the detection and extraction to inheritance relationships relevant for the instrumentation process. Relevant inheritance relationships which have an impact on the instrumentation process and typically only represent a small fraction of the complete inheritance relationships of a monitored application. The small size of the relevant inheritance relationships allows, for example to prepare it in advance and ship it as part of a monitoring application or to transmit inheritance information between different local instrumentation engines being part of a distributed instrumentation system.

Abstract: A transaction monitoring and tracing system which combines transactional performance monitoring aspects with infrastructure performance and utilization measures, like e.g. used memory or CPU load of transaction executing computing infrastructure. The system uses two types of agents deployed to the monitored system, a transaction and process agent, which is deployed to a process executing monitored transactions, and a host agent, which is deployed to a computer system executing processes monitored by a transaction and process agent. The transaction and process agent provides transaction tracing and process infrastructure measurements, the host agent provides host or operating system infrastructure measurements. All three types of measurements are tagged by the corresponding agent in a way that allows a later correlation of corresponding tracing and measurement data by an external monitoring node.

Abstract: A combined transaction execution monitoring, transaction classification and transaction execution performance anomaly detection system is disclosed. The system receives and analyzes transaction tracing data which may be provided by monitoring agents deployed to transaction executing entities like processes. In a first classification stage, parameters are extracted from received transaction tracing data, and the transaction tracing data is tagged with the extracted classification data. A subsequent measure extraction stage analyzes the classified transaction tracing data and creates corresponding measurements which are tagged with the transaction classifier. A following statistical analysis process maintains statistical data describing the long term statistical behavior of classified measures as a baseline, and also calculates corresponding statistical data describing the current statistical behavior of the classified measures.

Abstract: A performance monitoring and management system is provided for monitoring both server side and network side performance parameters of individual distributed transactions. The system uses correlation data which is transferred over a computer network to identify corresponding sender/receiver parts of a distributed transaction. Both server side tracing data and correlation data is transferred to an external correlation and monitoring server that creates per transaction end-to-end tracing data. Network probes are installed in the network infrastructures which monitor network conditions, like e.g. data transferred. Those network probes are configured in a way to identify and extract the correlation data used by the monitoring system and to tag created network measurements with this correlation data. Those tagged network measurements are then used to augment the per transaction end-to-end tracing data with corresponding network measurements.

Abstract: A monitoring system uses existing tracing data describing individual distributed transactions to determine if a recorded thread communication performed by the monitored transactions is internal to a monitored application or whether the recorded thread communication is an outgoing communication. Thread communications which are sent and received by threads that are monitored by the monitoring system are considered to be internal communications. Thread communications for which only the sending thread is monitored are considered to be outgoing communications. The determination process analyzes client side tracing data of the recorded thread communication and determines whether corresponding server side tracing data is available. If no corresponding server side tracing data is available, the thread communication is considered to be an outgoing communications. Examples of thread communications include HTTP requests, web service calls, and remote method invocations.

Abstract: A performance management system is provided that measures end user performance in a distributed computing environment. The system detects DOM updates caused by browser side activities, and identifies resource load requests introduced by a DOM update that request resource from third party sources. For such resource load requests, resource sensors are installed which detect the point in time when loading the resource was finished. This allows to measure load time for individual resource load requests requesting third party resources, and to assign the tracing and performance monitoring data describing those resource load requests to the tracing and performance monitoring data describing the browser side transaction execution that caused the third party resource loads.

Abstract: The present invention relates to a method and apparatus for providing automatic context management for simulating virtual users for testing and monitoring web applications, including those web applications that execute code on the client side, without requiring the actual execution of client side web application code or the execution of the client within the testing, monitoring, or simulation tool. Simulation tools with automatic context management according to the present invention can record and replay context-full scripts that do not require manual customization and are capable of handling state information even for web applications that execute code on the client side. These scripts are able to realistically mimic complex web application transactions on the network HTTP layer.

Abstract: Methods and systems for out-of-application bytecode instrumentation and performance monitoring of applications, such as globally-distributed applications, decouple (1) acquiring measurements through sensor execution at applications; (2) instrumenting application bytecode with sensor bytecode and buffering and sending measurements at collector nodes; and (3) controlling instrumentation and correlating measurements at a central monitoring node. Collector nodes and applications may employ secured, high bandwidth network connections (e.g., a typical LAN connection). Collector nodes and the central monitoring node may employ non-secured, lower-bandwidth network connections (e.g., a typical WAN connection) and may use encryption and/or compression without burdening the monitored application. Multiple parallel instrumentation engines in collector nodes eliminate the possible instrumentation bottleneck presented by one centralized instrumentation engine in a single server.

Abstract: A recorder, comprising: a context analyzer configured to associate HTTP transactions of a web application with a web session, wherein the web application executes code on the client side; an extensible document parser configured to parse a document included in the HTTP transactions; a library of parser additions used by the context analyzer to generate a context-full replay instruction; and a script generator configured to record a script including the context-full replay instruction in order to recreate the HTTP transactions in order to simulate use of the web application by a user.