Abstract: A system and method is disclosed that installs an agent on a computer system that is configured to be automatically started at startup of the computer system and that is also configured to detect the startup of processes on the computer system. The agent determines the capabilities to monitor process starts that available on the computer systems and installs an appropriate process start monitoring procedure. The installed process start monitoring procedure detects the start of a process, installs a core agent into the execution context of the started process and manipulates the start sequence of the started process to initialize and start the core agent. On startup, the core agent analyzes the execution context of the started process to identify the type of application executed by the started process, and injects a special agent matching the identified type into the started process to perform application level monitoring.

Abstract: A method is disclosed that estimates causal relationships between events based on heterogeneous monitoring data. The monitoring data consists in transaction tracing data, describing the execution performance of individual transactions, resource utilization measurements of infrastructure entities like processes or operating systems and network utilization measurement data. A topology model of the monitored environment describing its entities and the communication activities of these entities is incrementally created. The location of occurred events in the topology model is determined. The topology model is used in conjunction with a domain specific causality propagation knowledge base to calculate the possibility of causal relationships between events. Different causality determination mechanisms, based on the type of involved events are used to create graphs of causal related events.

Abstract: A performance monitoring and management system is provided for monitoring both server side and network side performance parameters of individual distributed transactions. The system uses correlation data which is transferred over a computer network to identify corresponding sender/receiver parts of a distributed transaction. Both server side tracing data and correlation data is transferred to an external correlation and monitoring server that creates per transaction end-to-end tracing data. Network probes are installed in the network infrastructures which monitor network conditions, like e.g. data transferred. Those network probes are configured in a way to identify and extract the correlation data used by the monitoring system and to tag created network measurements with this correlation data. Those tagged network measurements are then used to augment the per transaction end-to-end tracing data with corresponding network measurements.

Abstract: A system is provided for tracing end-to-end transactions. The system uses bytecode instrumentation and a dynamically injected agent to gather web server side tracing data, and a browser agent which is injected into browser content to instrument browser content and to capture tracing data about browser side activities. Requests sent during monitored browser activities are tagged with correlation data. On the web server side, this correlation information is transferred to tracing data that describes handling of the request. This tracing data is sent to an analysis server which creates tracing information which describes the server side execution of the transaction and which is tagged with the correlation data allowing the identification of the causing browser side activity.

Abstract: A system and method is disclosed that analyzes a set of historic transaction traces to identify an optimized set of transaction clusters with the highest transaction frequency. The transaction clusters are defined according to multiple parameters describing the execution context of the analyzed transactions. The transaction clusters are described by coordinates in a multidimensional, hierarchical classification space. Descriptive statistical data is extracted from historic transactions corresponding to previously identified transaction clusters and stored as reference data. Transaction trace data from currently executed transactions is analyzed to find a best matching historic transaction cluster. The current transaction traces are grouped according to their corresponding historic transaction cluster.

Abstract: A performance management system is provided that measures end user performance in a distributed computing environment. The system detects DOM updates caused by browser side activities, and identifies resource load requests introduced by a DOM update that request resource from third party sources. For such resource load requests, resource sensors are installed which detect the point in time when loading the resource was finished. This allows to measure load time for individual resource load requests requesting third party resources, and to assign the tracing and performance monitoring data describing those resource load requests to the tracing and performance monitoring data describing the browser side transaction execution that caused the third party resource loads.

Abstract: A system and method for real-time discovery and monitoring of multidimensional topology models describing structural aspects of applications and of computing infrastructure used to execute those applications is disclosed. Different types of agents are deployed to the monitored application execution infrastructure dedicated to capture specific topological aspects of the monitored system. Virtualization agents detect and monitor the virtualization structure of virtualized hardware used in the execution infrastructure, operating system agents deployed to individual operating systems monitor resource utilization, performance and communication of processes executed by the operating system and transaction agents deployed to processes participating in the execution of transactions, providing end-to-end transaction trace and monitoring data describing individual transaction executions.

Abstract: Method and system, comprising: capturing a plurality of secure communications between the first application and the second application; grouping the plurality of communications into one or more streams, each stream representing a network connection; and processing the one or more streams in parallel to create a plurality of transactions.

Abstract: Systems and methods comprising a context analyzer configured to associate one or more Hypertext Transfer Protocol (HTTP) transactions, an extensible document parser configured to parse a document included in the one or more HTTP transactions; and a library of parser additions used by the context analyzer to generate context-full replay instructions.

Abstract: Methods and Systems for non-intrusive real-time analysis of secure communications between a first application and a second application, wherein the first and second applications communicate through a communication channel. A plurality of secure communications between the first application and the second application is non-intrusively and securely captured. The plurality of communications is processed to process communications from a physical layer to a network layer. The plurality of communications is grouped into a plurality of streams and connection meta information is added to each stream, wherein each stream represents a single network connection. A plurality of transactions is created from the communications included in the plurality of streams, wherein a stream within the plurality of streams is encrypted, and the encrypted stream is decrypted.

Abstract: Systems and methods comprising a context analyzer configured to associate one or more Hypertext Transfer Protocol (HTTP) transactions, an extensible document parser configured to parse a document included in the one or more HTTP transactions; and a library of parser additions used by the context analyzer to generate context-full replay instructions.

Abstract: A performance monitoring and management system is provided for monitoring both server side and network side performance parameters of individual distributed transactions. The system uses correlation data which is transferred over a computer network to identify corresponding sender/receiver parts of a distributed transaction. Both server side tracing data and correlation data is transferred to an external correlation and monitoring server that creates per transaction end-to-end tracing data. Network probes are installed in the network infrastructures which monitor network conditions, like e.g. data transferred. Those network probes are configured in a way to identify and extract the correlation data used by the monitoring system and to tag created network measurements with this correlation data. Those tagged network measurements are then used to augment the per transaction end-to-end tracing data with corresponding network measurements.

Abstract: A performance management system is provided that measures end user performance in a distributed computing environment. The system detects DOM updates caused by browser side activities, and identifies resource load requests introduced by a DOM update that request resource from third party sources. For such resource load requests, resource sensors are installed which detect the point in time when loading the resource was finished. This allows to measure load time for individual resource load requests requesting third party resources, and to assign the tracing and performance monitoring data describing those resource load requests to the tracing and performance monitoring data describing the browser side transaction execution that caused the third party resource loads.

Abstract: The present invention relates to a method and apparatus for providing automatic context management for simulating virtual users for testing and monitoring web applications, including those web applications that execute code on the client side, without requiring the actual execution of client side web application code or the execution of the client within the testing, monitoring, or simulation tool. Simulation tools with automatic context management according to the present invention can record and replay context-full scripts that do not require manual customization and are capable of handling state information even for web applications that execute code on the client side. These scripts are able to realistically mimic complex web application transactions on the network HTTP layer.

Abstract: A recorder, comprising: a context analyzer configured to associate HTTP transactions of a web application with a web session, wherein the web application executes code on the client side; an extensible document parser configured to parse a document included in the HTTP transactions; a library of parser additions used by the context analyzer to generate a context-full replay instruction; and a script generator configured to record a script including the context-full replay instruction in order to recreate the HTTP transactions in order to simulate use of the web application by a user.

Abstract: Method and system, comprising: capturing a plurality of secure communications between the first application and the second application; grouping the plurality of communications into one or more streams, each stream representing a network connection; and processing the one or more streams in parallel to create a plurality of transactions.

Abstract: Provided is a method and system for monitoring and analysis of networked systems, that is non-intrusive and real time. Both secure and non-secure traffic may be analyzed. The provided method involves non-intrusively copying data from a communication medium, reconstructing this data to a higher level of communication, such as the application level, grouping the data into sets, each set representing a session, and organizing the data for chosen sessions in hierarchical fashion which corresponds to the hierarchy of the communicated information. If monitored communications are encrypted, they are non-intrusively decrypted in real time. Hierarchically reconstructed session data is used by one or more plug-in applications, such as alarms, archival applications, visualization applications, script generation applications, abandonment monitoring applications, error detection applications, performance monitoring applications, and others.

Abstract: The present invention relates to a method and apparatus for providing automatic context management for simulating virtual users for testing and monitoring web applications, including those web applications that execute code on the client side, without requiring the actual execution of client side web application code or the execution of the client within the testing, monitoring, or simulation tool. Simulation tools with automatic context management according to the present invention can record and replay context-full scripts that do not require manual customization and are capable of handling state information even for web applications that execute code on the client side. These scripts are able to realistically mimic complex web application transactions on the network HTTP layer.

Abstract: The present invention relates to a method and apparatus for providing automatic context management for simulating virtual users for testing and monitoring web applications, including those web applications that execute code on the client side, without requiring the actual execution of client side web application code or the execution of the client within the testing, monitoring, or simulation tool. Simulation tools with automatic context management according to the present invention can record and replay context-full scripts that do not require manual customization and are capable of handling state information even for web applications that execute code on the client side. These scripts are able to realistically mimic complex web application transactions on the network HTTP layer.

Abstract: A method for facilitating network communications from one or more independent execution threads by a dedicated worker thread. Because an operating system is not designed for use with a large number of threads, such a system requires the use of multiple computers for simulating a large number of virtual users. This increases complexity, as well as cost. The present invention reduces the number of threads needed, which reduces resource needs, and in turn increases the number of virtual users that can be simulated. According to the present invention, a worker thread uses non-blocking function calls to efficiently handle requests for network operations.