Abstract: An apparatus, system, and method are provided for gathering trace data indicative of resource activity on a computer system. The present invention includes a monitoring module that initiates one or more activity monitors on a target computer system to detect different types of resource activity. A determination module determines activity indicators involving resources of the target computer system using the one or more activity monitors. The activity indicators may comprise a variety of information useful in identifying one or more separate resource activities. A collection module organizes the activity indicators into trace data representative of the resource activity. Preferably, the monitoring module, determination module, and collection module operate continuously on the target computer system. In this manner, the trace data includes an accurate set of both current activity indicators as well as historical activity indicators.

Abstract: An apparatus, system, and method are provided for associating resources using a time based algorithm. The apparatus comprises an initialization module, a query module, and a resource time module. The initialization module receives a seed identifier that identifies a seed resource. The seed resource may be a data file, an executable file, a directory, or another data structure associated with a logical application or business process. The query module accesses trace data and searches the trace data for a candidate resource that might be linked to the seed resource. The trace data describes a plurality of resource events that occur on a computer or network system. The resource time module selects a candidate resource based on a similar time attribute recorded in the trace data. The similar time attribute may refer to an access time of the candidate resource that is similar to, such as within a time range, an access time of a seed resource or otherwise linked resource.