Abstract: An apparatus, system, and method are provided for gathering trace data indicative of resource activity on a computer system. The present invention includes a monitoring module that initiates one or more activity monitors on a target computer system to detect different types of resource activity. A determination module determines activity indicators involving resources of the target computer system using the one or more activity monitors. The activity indicators may comprise a variety of information useful in identifying one or more separate resource activities. A collection module organizes the activity indicators into trace data representative of the resource activity. Preferably, the monitoring module, determination module, and collection module operate continuously on the target computer system. In this manner, the trace data includes an accurate set of both current activity indicators as well as historical activity indicators.

Abstract: An apparatus, system, and method are provided for analyzing the association of a resource to a business process. The invention includes an origination module, an evaluation module, and an identification module. The origination module receives an identifier and derives a seed resource associated with the identifier. The evaluation module applies heuristic routines to trace data and derives a set of candidate resources, and each heuristic routine assigns each candidate resource a probability value. The evaluation module further combines the probabilities for each candidate resource into a combined probability. The identification module identifies a resource associated to a business process by examining the combined probability of a candidate resource with a threshold value. The heuristic routines, thresholds, techniques for combining probabilities and the like are modifiable to accommodate user needs and system changes over time.

Abstract: An apparatus, system, and method are provided for automatically discovering and grouping files and other resources used by a business process. The present invention includes a monitoring module that collects trace data representative of operational behavior of software applications. An analysis module analyzes the trace data to discover resources affiliated with the business process. A determination module defines a logical application corresponding to the business process and includes the resources discovered by the analysis module. The logical application is automatically defined such that business policies may be readily implemented on the logical application as a whole. Manual identification of resources for a business process is eliminated or substantially reduced.

Abstract: An apparatus, system, and method are provided for gathering trace data indicative of resource activity on a computer system. The present invention includes a monitoring module that initiates one or more activity monitors on a target computer system to detect different types of resource activity. A determination module determines activity indicators involving resources of the target computer system using the one or more activity monitors. The activity indicators may comprise a variety of information useful in identifying one or more separate resource activities. A collection module organizes the activity indicators into trace data representative of the resource activity. Preferably, the monitoring module, determination module, and collection module operate continuously on the target computer system. In this manner, the trace data includes an accurate set of both current activity indicators as well as historical activity indicators.

Abstract: An apparatus, system, and method are provided for associating resources using a time based algorithm. The apparatus comprises an initialization module, a query module, and a resource time module. The initialization module receives a seed identifier that identifies a seed resource. The seed resource may be a data file, an executable file, a directory, or another data structure associated with a logical application or business process. The query module accesses trace data and searches the trace data for a candidate resource that might be linked to the seed resource. The trace data describes a plurality of resource events that occur on a computer or network system. The resource time module selects a candidate resource based on a similar time attribute recorded in the trace data. The similar time attribute may refer to an access time of the candidate resource that is similar to, such as within a time range, an access time of a seed resource or otherwise linked resource.