Abstract: Embodiments of the invention relate to identifying sources of memory leaks. In an embodiment, an agent collects information related to object allocations and de-allocations in accordance with a sampling period, and, based on the relationship between object allocations and de-allocations, the agent analyzes the data and reports the results. Other embodiments are also disclosed.

Abstract: Anomalous behavior in a distributed system is automatically detected. Metrics are gathered for transactions, subsystems and/or components of the subsystems. The metrics can identify response times, error counts and/or CPU loads, for instance. Baseline metrics and associated deviation ranges are automatically determined and can be periodically updated. Metrics from specific transactions are compared to the baseline metrics to determine if an anomaly has occurred. A drill down approach can be used so that metrics for a subsystem are not examined unless the metrics for an associated transaction indicate an anomaly. Further, metrics for a component, application which includes one or more components, or process which includes one or more applications, are not examined unless the metrics for an associated subsystem indicate an anomaly. Multiple subsystems can report the metrics to a central manager, which can correlate the metrics to transactions using transaction identifiers or other transaction context data.

Abstract: A near out-of-memory condition in a memory space is detected by creating softly reachable objects which are garbage collected when the memory space is becoming full. The softly reachable objects are objects that can be cleared at the discretion of the garbage collector when heap memory is running low. An agent process of an application can create soft reference objects which reference the softly reachable objects, and periodically poll the soft reference objects to determine if the softly reachable objects have been cleared. If they have been cleared, the agent reports to the application so that a graceful shutdown of the application can be initiated. A report can also be sent to a user interface or other output device. Additional information regarding the memory space can be gained by using softly reachable objects of different sizes and/or ages. Further, a wait period for the polling can be set adaptively.

Abstract: An application is monitored to identify different execution paths, e.g., sequences of invoked components, which occur due to the receipt of messages by the application. Similarities between the execution paths are determined based on a distance algorithm, in one approach, and execution paths which are similar are assigned to a common group. Additionally, application runtime data such as response times is obtained for the execution paths and aggregated for the group. The messages can also be grouped based on the grouping of the execution paths. Further, a representative execution path can be determined for each execution path group for comparison to subsequent execution paths. A representative message can similarly be determined for each message group. Results can be reported which include a group identifier, representative message, representative execution path, count, and aggregated runtime data.

Abstract: Messages which are provided to an application are monitored. Similarities between the messages are determined based on a distance algorithm, in one approach, and messages which are similar are assigned to a common group. For example, the messages may be HTTP messages which include a URL, HTTP header parameters and/or HTTP post parameters. The messages are parsed to derive a string which is used in the distance calculations. Additionally, application runtime data such as response times is obtained and aggregated for the group. Further, a representative message can be determined for each group for comparison to subsequent messages. Results can be reported which include a group identifier, representative message, count and aggregated runtime data.

Abstract: Deviation of an expected error rate for a backend server invoked by an application to process a request is used to characterize the backend server health. Performance data generated in response to monitoring application execution is processed to select backend error rate data. The selected data is processed to predict future values of a time series associated with backend error rates. The predicted error rate values are compared to actual error rate values in the time series to determine a deviation from the predicted value. Deviation information for the time series data of error rates is then reported to a user through an interface in a simplified manner.

Abstract: Deviation of expected response times is used to characterize the health of one or more backend machines invoked by an application to process a request. Performance data generated in response to monitoring application execution is processed to select backend response time data. The selected data is processed to predict future values of a time series associated with backend response time. The predicted response time values are compared to actual response time values in the time series to determine a deviation from the predicted value. Deviation information for the time series data of response times is then reported to a user through an interface in a simple manner.