Ca, Inc.

Ca Technologies, Inc.

Erhan Giral

Corey Cohen

Smrati Gupta

Victor Muntés-Mulero

David Sanchez Charles

Andreas Gerhard Reiss

Cui Lin

Tomas Kolda

Mark Jacob Addleman

Michael Steven Walker

Indranil Basak

David Brooke Martin

Zaneta Svozilova

A topology-based transversal analysis service has been created that correlates topologies of different domains of a distributed application and creates cross-domain 'stories' for the different types of transactions provided by the distributed application. A 'story' for a transaction type associates an event(s) with a node in an execution path of the transaction type. This provides context to the event(s) with respect to the transaction type (&#x201c;transaction contextualization&#x201d;) and their potential business impact. The story is a journal of previously detected events and/or information based on previously detected events. The events have been detected over multiple instances of a transaction type and the journal is contextualized within an aggregate of execution paths of the multiple instances of the transaction type. The story can be considered a computed, ongoing narrative around application and infrastructure performance events, and the narrative grows as more performance-related events are detected.

Cross-domain transaction contextualization of event information

A multivariate clustering-based anomaly detector can generate an event for consumption by an APM manager that indicates detection of an anomaly based on multivariate clustering analysis after topology-based feature selection. The anomaly detector accumulates time-series data across a series of time instants to form a multivariate time-series data slice or multivariate data slice. The anomaly detector then performs multivariate clustering analysis with the multivariate data slice. The anomaly detector determines whether a multivariate data slice is within a cluster of multivariate data slices. If the multivariate data slice is within the cluster and the cluster is a known anomaly cluster, then the anomaly detector generates an anomaly detection event indicating detection of the known anomaly. The anomaly detector can also determine that a multivariate data slice is within an unknown cluster and generate an event indicating detection of an unknown anomaly.

Multivariate clustering-based anomaly detection

Large amounts of data from user interactions with web resources is available as data logs. Analysis may be performed to process the data log in order to determine the characteristics of the user interactions. Data log analysis may include identifying page states, which may be sets of frequent attributes and values that occur together in a session. The data log analysis may also include generating semantic labels of page states, which may describe the function of pages corresponding to different page states. Text mining models may be used to determine the semantic labels. Analysis may also include aggregating sets of page paths to create page journeys. These page journeys may be aggregated over all users, all user sessions, or other subsets of the clickstream. In some embodiments, comparing page journeys may provide recommendations for potential methods to improve the site and enhance user experiences.

Page journey determination from web event journals

Page journey determination from fingerprint information in web event journals

Instead of attempting to scan all metric measurements of a distributed application, an anomaly detector intelligently selects instances of metrics from the universe of metric instances available for the distributed application to detect anomalies. Intelligent feature selection allows the anomaly detector to efficiently and reliably detect anomalies for a distributed application. The intelligent selection is guided by execution paths of transactions of the distributed application, and the execution paths are determined from a topology of the distributed application. The anomaly detector scans the incoming time-series data of the selected metric instances by transaction type and determines whether the scanned measurements across the selected metric instances form a pattern correlated with anomalous behavior.

Topology-based feature selection for anomaly detection

A multivariate path-based anomaly detection and prediction service ('anomaly detector') can generate a prediction event for consumption by the APM manager that indicates a likelihood of an anomaly occurring based on path analysis of multivariate values after topology-based feature selection. To predict that a set of metrics will travel to a cluster that represents anomalous application behavior, the anomaly detector analyzes a set of multivariate date slices that are not within a cluster to determine whether dimensionally reduced representations of the set of multivariate data slices fit a path as described by a function.

Multivariate path-based anomaly prediction

A topology-based transversal analysis service has been created that correlates topologies of different domains of a distributed application and creates cross-domain 'stories' for the different types of transactions provided by the distributed application. A 'story' for a transaction type associates an event(s) with a node in an execution path of the transaction type. This provides context to the event(s) with respect to the transaction type ('transaction contextualization') and their potential business impact. The story is a journal of previously detected events and/or information based on previously detected events. The events have been detected over multiple instances of a transaction type and the journal is contextualized within an aggregate of execution paths of the multiple instances of the transaction type. The story can be considered a computed, ongoing narrative around application and infrastructure performance events, and the narrative grows as more performance-related events are detected.

Domain transversal based transaction contextualization of event information

For each event detected during execution of a monitored application comprising a plurality of application components, a determination is made of which of the plurality of application components corresponds to the detected event. Also, a dependency subgroup that includes the application component that corresponds to the detected event is identified, wherein a dependency subgroup indicates dependencies among a subgroup of the plurality of application components. A location within the dependency subgroup of the application component corresponding to the detected event is determined. An order of correction for the application components determined to correspond to detected events are determined based, at least in part, on the determined location. Correction of the application components determined to correspond to detected events are initiated according to the determined order of correction.

Ordered correction of application based on dependency topology

Tracking health of component in a computer system is disclosed. A health score for software components is determined for each of a plurality of time periods. The computing system determines a problem software component whose health score indicates the unhealthy status at a certain point in time. The computing system determines a set of software components that are linked by dependency relationships to the problem software component. The computing system tracks events at which software components in the set have a health score that went from the healthy status to the unhealthy status. The computing system rolls back in time through the events to locate a software component in the set that was first in time to have its health score go from the healthy status to the unhealthy status.

Tracking health status in software components

Client to server service request and response interactions are monitored. The service requests have embedded therein mobility-dedicated and business organization oriented reporting headers. At the server side of the interactions, a snooping agent picks up information from the headers, combines it with service performance metrics (e.g., time to service the request) and stores the data in a relational database. Queries are afterwards submitted to the database to spot trends including those showing emerging problems and areas for improvement in providing customers who use mobile devices with seamless and high quality service.

Mobile applications incorporating mobile-based transactions detection and monitoring means

A method for diagnosing problems in a computer system by visualizing flows through applications and other subsystems in a directed graph on a user interface. The user interface represents multiple instances of each application or other subsystem by a respective node, and edges indicate which nodes depend on one another. Aggregate metrics which are based on the multiple instances, and associated alerts, can be provided for the nodes and edges. An aging process can indicate which nodes have not been recently invoked. The user interface can also indicate which nodes and edges are associated with a given business transaction. In a summary view, a node hides the identity of invoked components such as servlets of the application, while in a detailed view these details are provided.

Growing community of inventors

Saratoga, CA, United States of America

Erhan Giral