Abstract: Provided are methods and computer program products for monitoring the performance of network applications executing within operating-system-level virtualization containers. Methods may include enumerating operating-system-level virtualization containers on a networked device; creating a named pipe accessible by at least one application running in each operating-system-level virtualization container; retrieving, via the named pipe, performance data gathered by the at least one application, including an identification of each operating-system-level virtualization container; generating metrics based on the retrieved performance data; and generating an event incorporating the metrics, including operating-system-level virtualization container identifiers.

Abstract: Provided are methods and computer program products monitoring the contents of network traffic in a network device. Methods may include collecting, using a kernel space driver interface, network traffic data sent by and/or received at the network device, parsing the collected network traffic data to extract transaction data corresponding to at least one logical transaction defined by a network protocol and storing an indicator of a quantity of the collected network traffic data that was parsed, and generating an event incorporating the extracted transaction data.

Abstract: Provided are methods and computer program products for monitoring system calls in an operating system using safely removable system function table chaining. Methods may include loading a collector application driver providing one or more dispatch functions corresponding to one or more system functions, each dispatch function operable to call a pre-hook function prior to calling a system function, to call the system function, and to call a post-hook function following the call to the system function. A metadata block in pinned kernel memory contains, for each system function, access descriptors to the system function and the pre- and/or post-hook functions for the system function. The dispatch functions are copied into the pinned kernel memory, and the operating system's access descriptors for the system functions are altered to instead point to the corresponding dispatch functions.

Abstract: Provided are methods and computer program products monitoring the contents of network traffic in a network device. Methods may include collecting, using a kernel space driver interface, network traffic data sent by and/or received at the network device, parsing the collected network traffic data to extract transaction data corresponding to at least one logical transaction defined by a network protocol and storing an indicator of a quantity of the collected network traffic data that was parsed, and generating an event incorporating the extracted transaction data.

Abstract: Provided are methods and computer program products for monitoring the performance of network applications executing within operating-system-level virtualization containers. Methods may include enumerating operating-system-level virtualization containers on a networked device; creating a named pipe accessible by at least one application running in each operating-system-level virtualization container; retrieving, via the named pipe, performance data gathered by the at least one application, including an identification of each operating-system-level virtualization container; generating metrics based on the retrieved performance data; and generating an event incorporating the metrics, including operating-system-level virtualization container identifiers.

Abstract: Provided are methods and computer program products for monitoring system calls in an operating system using safely removable system function table chaining. Methods may include loading a collector application driver providing one or more dispatch functions corresponding to one or more system functions, each dispatch function operable to call a pre-hook function prior to calling a system function, to call the system function, and to call a post-hook function following the call to the system function. A metadata block in pinned kernel memory contains, for each system function, access descriptors to the system function and the pre- and/or post-hook functions for the system function. The dispatch functions are copied into the pinned kernel memory, and the operating system's access descriptors for the system functions are altered to instead point to the corresponding dispatch functions.