WO2005008489A2 - System and method for high-performance profiling of application events - Google Patents
System and method for high-performance profiling of application events Download PDFInfo
- Publication number
- WO2005008489A2 WO2005008489A2 PCT/US2004/021774 US2004021774W WO2005008489A2 WO 2005008489 A2 WO2005008489 A2 WO 2005008489A2 US 2004021774 W US2004021774 W US 2004021774W WO 2005008489 A2 WO2005008489 A2 WO 2005008489A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- event
- information
- tracer
- profiler
- function
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/53—Network services using third party service providers
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/2866—Architectures; Arrangements
- H04L67/30—Profiles
Definitions
- XML Markup Language
- SOAP Simple Object Access Protocol
- Hypertext Hypertext
- the .NET Framework includes the common language runtime (CLR), which assists memory, process, and thread management.
- CLR common language runtime
- Profiler is one profiling tool for .NET-compatible applications. This and other profilers may provide notification of .NET framework events such as, for example, assembly load started, assembly load ended, method started, and method ended.
- the method includes registering a profiler as a provider to an event tracer. Information associated with an event is captured using the profiler, where the event is associated with a web-enabled application. A function token is associated with the captured information, which is then communicated to the event tracer.
- FIGURE 1 illustrates a system for high-performance profiling of application events according to certain embodiments of the disclosure
- FIGURE 2 illustrates a data flow diagram using an example embodiment of the management engine illustrated in FIGURE 1
- FIGURES 3A-B illustrate example methods for high-performance profiling of application events according to certain embodiments of the disclosure.
- DETAILED DESCRIPTION FIGURE 1 illustrates a system for high-performance profiling of application events in a network framework according to certain embodiments of the disclosure. At the outset, it will be understood that "high-performance” describes any suitable processing operable to be (but not necessarily) run in a production or live environment.
- system 100 is a client/server environment comprising at least one client or management workstation 104, a server or host 102, and network 108, but may also be a standard or local computing environment or any other suitable environment.
- system 100 allows a developer or another process to efficiently profile web-enabled applications in a production environment, often through offloading standard profiling processing to components that minimize effects in a production environment.
- system 100 may comprise an environment automatically providing one or more users with the ability to easily manage or view and generating or determining information useful for profiling web-enabled applications 160 and associated metrics 140.
- the term "automatically,” as used herein, generally means that the appropriate processing is substantially performed by at least part of system 100.
- Server 102 includes memory 120 and processor 125 and comprises an electronic computing device operable to receive, transmit, process and store data associated with system 100.
- Server 102 may comprise a general-purpose personal computer (PC), a Macintosh, a workstation, a Unix-based computer, a server, or any other suitable device.
- server 102 may be a blade server or a web server.
- server 102 may comprise software and/or hardware in any combination suitable to gather application events 140.
- FIGURE 1 only provides one example of computers that may be used with the disclosure.
- FIGURE 1 provides one example of server 102 that may be used with the disclosure
- system 100 can be implemented using computers other than servers, as well as a server pool.
- the present disclosure contemplates computers other than general purpose computers as well as computers without conventional operating systems.
- the term "computer” is intended to encompass any suitable processing device.
- Computer server 102 may be adapted to execute any operating system 110 including Windows NT, Windows 2000, Windows Server, Windows Storage Server, Windows XP home or professional, or any other suitable operating system including, referencing, or linking to an extensible instrumentation layer 130 and an event tracer 132.
- operating system 110 includes a network framework, such as Microsoft's .NET framework.
- Extensible instrumentation layer 130 exposes namespaces, classes, methods, and properties for hardware devices, operating system 110, and various applications 160.
- extensible instrumentation layer 130 may be Windows Management Instrumentation (WMI).
- Event tracer 132 is any module operable to provide a (at least substantially) commonly available ability to issue and format tracing events. Event tracer 132 may be controlled by tracelog functions including StartTrace(), EndTrace(), and UpdateTrace(), as well as others.
- event tracer 132 may log or write and suitable information or data associated with an event, such as the time of the event, a process ID under which the event occurs, thread ID under which the event occurs, a user-mode CPU time, and/or kernel-mode CPU time.
- Event tracer 132 may log this or other custom information (such as function ID, class ID, URLs, and context IDs) to event tracing log 170, which is typically stored in memory 120.
- Memory 120 may include any hard drive, memory, or database module and may take the form of volatile or non-volatile memory including, without limitation, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), removable media, or any other suitable local or remote memory component.
- illustrated memory 120 includes database 124, at least one web- enabled application 160, administration profile 165, and one or more event tracing logs 170, but may also include any other appropriate data.
- Database 124 stores one or more database tables, with each table including one or more columns.
- Database 124 may receive records, schemas, or any other suitable data through interface 112 or from another process running on server 102.
- database 124 may be a relational database management system (or DBMS). Relational databases often use sets of schemas to describe the tables, columns, and relationships between the tables using basic principles known in the field of database design. But while described as a relational database, database 124 may be any data repository of any suitable format including XML documents, flat files, Btrieve files, comma-separated- value (CSV) files, an object oriented database, name- alue pairs, and others.
- CSV comma-separated- value
- Applications 160 include any standard or custom .NET-enabled or web- enabled software (including ASP.NET applications, remoting applications, and particular web services) associated with a network framework, such as Microsoft's .NET framework. Each application 160 may be written or developed in any appropriate language such as C, C++, C#, Java, J#, and VB.NET.
- memory 120 includes or references administration profile 165, which is operable to present customizable criteria to management engine 115 based, typically, on user input.
- administration profile 165 may include a plurality of criteria including which assemblies, classes, or methods to profile or log.
- Administration profile 165 may be in any suitable format including text, encoded, XML, tagged, and others so long as profile 165 remains operable to provide system 100 with customizable processing and logging using event tracing log 170.
- Memory 120 also stores one or more event tracing logs 170.
- Each event tracing log 170 may be an XML document, a binary file, a text file, a CSV file, an object, an array, or any logical or physical component operable to store information associated with an event from application 160 or operating system 110.
- event tracing log 170 may include a plurality of entries (or records), with each entry associated with one event.
- Event tracing log 170 may include a first entry associated with a start event and a second correlated entry associated with an end event. Further, it will be understood that event tracing log 170 may be local or remote, as well as temporary or persistent, without departing from the scope of the disclosure.
- Server 102 also includes processor 125.
- Processor 125 executes instructions and manipulates data to perform the operations of server 102 such as, for example, a central processing unit (CPU), an application specific integrated circuit (ASIC) or a field-programmable gate array (FPGA).
- FIGURE 1 illustrates a single processor 125 in server 102, multiple processors 125 may be used according to particular needs, and reference to processor 125 is meant to include multiple processors 125 where applicable.
- processor 125 executes management engine 115 that is operable to perform reduced-processing profiling of applications 160.
- Management engine 115 could include any hardware, software, firmware, or combination thereof operable to receive or retrieve metrics from extensible instrumentation layer 130 (such as WMI), efficient profile production application 160, log profiler or framework events, and allow an admimstrator or a developer to customize the profiled assemblies, classes, and methods using administration profile 165.
- management engine 115 may provide client 104 with profile views 150 (such as histograms, graphs, timelines, and others), data displays 150, reports 150, or management interfaces 150 operable to view and manipulate the stored events.
- management engine 115 is illustrated as a single multi-tasked module, the features and functionality performed by this engine may be performed by multiple modules such as, for example, a profiler module, a correlator module, and a reference module such as illustrated in FIGURE 2. Moreover, while not illustrated, management engine 115 may be a child or sub-module of any other appropriate software module such as, for example, an enterprise infrastructure management application without departing from the scope of this disclosure.
- Server 102 also often includes interface 112 for communicating with other computer systems, such as client 104, over network 108 in a client-server or other distributed environment via link 118.
- Network 108 facilitates wireless or wireline communication between computer server 102 and any other computer.
- Network 108 may communicate, for example, Internet Protocol (IP) packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data, and other suitable information between network addresses.
- IP Internet Protocol
- Network 108 may include one or more local area networks (LANs), radio access networks (RANs), metropolitan area networks (MANs), wide area networks (WANs), all or a portion of the global computer network known as the Internet, and/or any other communication system or systems at one or more locations.
- interface 112 comprises logic encoded in software and/or hardware in a suitable combination and operable to communicate with network 108. More specifically, interface 112 may comprise software supporting one or more communications protocols associated with communications network 108 or hardware operable to communicate physical signals.
- Client 104 comprises any computer and may include input devices, output devices, mass storage media, processors, memory, interfaces, communication ports, or other appropriate components for receiving commands from and present data to the user of client 104. It will be understood that there may be any number of clients 104 coupled to server 102 or client 104 may comprise a management component of server 102. As used in this document, client 104 is intended to encompass a personal computer, workstation, network computer, kiosk, wireless data port, personal data assistant (PDA), one or more processors within these or other devices, or any other suitable processing or display device or software. Moreover, “client 104" and “user of client 104" may be used interchangeably without departing from the scope of this disclosure.
- PDA personal data assistant
- client 104 may comprise a computer that includes an input device, such as a keypad, touch screen, mouse, or other device that can accept information, and an output device that conveys information associated with the operation of server 102 or clients 104, including digital data, visual information, or metrics 140.
- Both the input device and output device may include fixed or removable storage media such as a magnetic computer disk, CD-ROM, or other suitable media to both receive input from and provide output to users of clients 104 through a portion of the output device, namely graphical user interface (GUI) 116.
- GUI 116 comprises a graphical user interface operable to allow the user of client 104 to interface with system 100 and view the output of a plurality of software products and application 160.
- GUI 116 provides the user of client 104 with an efficient and user- friendly presentation of data provided by system 100, such as a display or report based on profiled applications 160.
- GUI 116 may comprise a plurality of displays having interactive fields, pull-down lists, and buttons operated by the user.
- GUI 116 presents formatted output to and receives commands from client 104.
- graphical user interface may be used in the singular or in the plural to describe one or more graphical user interfaces and each of the displays of a particular graphical user interface.
- GUI 116 contemplates any graphical user interface, such as a generic web browser, that processes information in system 100 and efficiently presents the information to the user.
- Server 102 can accept data from client 104 via the web browser (e.g., Microsoft Internet Explorer or Netscape Navigator) and return the appropriate HTML or extensible Markup Language (XML) responses.
- GUI 116 may comprise a front-end of management engine 115, with the front-end operable to view profiled events or customize administration profile 165.
- GUI 116 and management engine 115 may be used interchangeably; although, it will be understood that management engine 115 will often include more functionality than a graphical user interface.
- management engine 115 identifies a web-enabled or .NET-compatible application 160 for profiling. It will be understood that this identification may be in response to a user request, dynamically based on system parameters, or automatically in response to a system request.
- application 160 resides or is executed in a production environment.
- Management engine 115 profiles or otherwise supervises application 160, typically in an attempt to determine response times and heap activity. As described above, in an effort to minimize performance degradation, management engine 115 attempts to offload at least a portion of standard profiler processing. For example, management engine 115 utilizes event tracer 132 to perform log in operations.
- management engine 115 may reference or load administration profile 165, thereby allowing a developer or administrator to select various assemblies, classes, methods, and other components of application 160 to profile.
- Management engine 115 may communicate information associated with non-selected components to a cache prior to calling expensive profiler functions.
- Management engine 115 may also offload class and method lookups in correlation of start and end events. For example, typical profiler callbacks return a function ID.
- Management engine 115 would log this function ID using event racer 132 and associate a function name with the function ID at a later time, hi another example, management engine 115 might blindly log both start and end events prior to performing any analysis. Once logged, management engine 115 may correlate each end event with its corresponding start event, thereby reducing the impact on various .NET processes.
- FIGURE 2 is data flow diagram including an example embodiment of management engine 115 generally illustrated in FIGURE 1.
- FIGURE 2 illustrates the flow of information between management engine 115, database 124, example WMI 130, and event tracer 132.
- management engine 115 includes profiler 202, correlator 204, HTTP plug-in 206, compiled instrumentation 208, poll thread 210, and pull thread 212. While illustrated as internal to management engine 115, it will be understood that each of these components may individually or collectively be a callable remote function, a service, a dynamic-linked library (DLL), a daemon, a Component Object Model (COM) function, or any other local or remote function, method, object, or sub-module.
- DLL dynamic-linked library
- COM Component Object Model
- Profiler 202 generally implements profiler techniques and algorithms such as callbacks and providing a user with in-depth instrumentation involving web-enabled application 160.
- profiler 202 may be a COM server that implements callbacks such as class load started,” “class load finished,” “function entered,” “function leave,” and many others. In certain embodiments, these callbacks are instrumented using event tracer 132.
- Profiler 202 may include a profile mask operable to identify or dete ⁇ nine active profiler functions.
- Profiler 202 may include a thread that listens for a "profiler notification" message operable to instruct profiler 202 to reload a configuration file and reset the mask based on this reload. Moreover, profiler 202 may be registered or coded as a provider, or a source of information associated with an event, with event tracer 132. Correlator 204 is an example component operable to i) collect, gather, or combine one or more event tracing logs 170; ii) correlate start and end events included in event tracing logs 170; iii) chargeback functions; and iv) generate database-compliant data structures based on event tracing logs 170.
- Correlator 204 may be further operable to identify and process individual records or entries in event tracing log 170 to perform function name processing and/or to efficiently correlate the start/end events. As described above, correlator 204 may be implemented as a plurality of plug-ins or DLLs without departing from the scope of this disclosure.
- HTTP plug-in or module 206 is operable to monitor, track, or otherwise process ASP.NET and web services. HTTP module is further operable to intercept requests, messages, or responses between client 104 and server 102 (or an associated web-based environment). For example, HTTP module 206 may implement an iHTTPModule interface and present "OnBeginRequest" and "OnEndRequest” functions and may be enabled by an ⁇ httpModules> tag.
- HTTP plug-in 206 may intercept incoming and outgoing communications to determine any suitable metric or event such as, for example, response time, client identity, response code, or number of requests. In one embodiment, HTTP plug-in 206 may be further operable to monitor Transmission Control Protocol (TCP) requests.
- Compiled instrumentation 208 is any component operable to easily instrument or manage internal applications or new .NET applications. For example, compiled instrumentation may comprise a plug-in compiled directly into an application such as management engine 115.
- Poll thread 210 is any plug-in or sub-module operable to poll WMI 130 for certain metrics such as, for example, number of compilations, number of sessions, number of applications, and many others.
- Pull thread 212 is any plug-in or sub-module operable to locate, identify, or otherwise retrieve or process event tracing logs 170. Pull thread 212 may be further operable to perform a "tracelog -update -f ' function to change the name of one of the logs 170, run a trace format against an old file, and delete the old file.
- FIGURES 3A-B are flow diagrams illustrating example methods 300 and 350, respectively, for high-performance profiling of web-enabled applications 160 or a network framework (such as .NET), according to various embodiments of the disclosure.
- FIGURE 3 A illustrates method 300, which offloads logging of customizable profiling
- FIGURE 3B illustrates method 350, which offloads various metadata population and correlation processes.
- the following descriptions focus on the operation of management engine 115 in performing methods 300 and 350. But system 100 contemplates using any appropriate combination and arrangement of logical elements implementing some or all of the described functionality.
- Method 300 begins in step 302, where a web-enabled or .NET compatible application 160 is identified. As described above, this identification may occur in response to a user request or through any other suitable technique.
- a profiler 202 is initialized.
- profiler 202 is invoked using the identified application 160 at step 306.
- profiler 202 captures information associated with an event at step 308.
- This event is typically associated with the identified application 160.
- the event may be "assembly load started,” “assembly load ended,” “method started,” “method ended,” and others.
- management engine 115 compares the captured information to an administration profile 165.
- management engine 115 determines if the captured information satisfies one or more criteria stored or referenced in administration profile 165. If the information does not satisfy one or more profile criteria, then management engine 115 communicates the captured information to cache 214 at step 314 and processing of this event ends.
- management engine 115 invokes a profiler function using the captured information at step 316. It will be understood that management engine 115 may invoke any appropriate profiler function such as, for example, generation of a histogram. Moreover, this invocation may occur at any time without departing from the scope of this disclosure.
- management engine 115 adds a function token to the captured information at step 318. For example, management engine 115 may perform a lookup of the appropriate function token based on a function ID stored or referenced in the captured information. Management engine 115 then invokes an event tracer 132, such as through an event tracer API, using the captured information at step 320.
- management engine 115 may execute a TraceEvent( ) function operable to log the event.
- management engine 115 logs the captured information using the event tracer 132.
- management engine 115 may execute example method 350 to perform various offloaded profiler functions.
- method 350 begins at step 352, where management engine 115 selects an event tracing log 170. This selection may be in response to a request from a user, dynamically based on system parameters, or automatically in response to a request from a process.
- management engine 115 identifies a first record in the selected log 170 at step 354.
- management engine 115 identifies a function token in the record.
- management engine 115 identifies a function name based on the function token or function ID via, for example, one or more queries of assembly metadata based on the function token at step 358.
- management engine 115 inserts a function name into the record based on the query. It will be understood, the management engine 115 may determine and insert the function name using any suitable technique.
- management engine 115 determines the identified record as an end event. If it is, management engine 115 scans prior records to identify the associated starting event at step 364. Once located, management engine 115 inserts any suitable correlation data into the identified end record based on the scan at step 366.
- management engine 115 determines if there are more records in the event tracing log at decisional step 368. If there are more records, then management engine 115 identifies the next record in log 170 and processing returns to step 356. Once substantially all of the event tracing records have been suitable processed or identified, then method 350 ends.
- the preceding flowcharts and accompanying description illustrate only exemplary methods 300 and 350. hi short, system 100 contemplates using any suitable technique for performing these and other tasks. Accordingly, many of the steps in these flowcharts may take place simultaneously and/or in different orders than as shown. Moreover, system 100 may use methods with additional steps, fewer steps, and/or different steps, so long as the methods remain appropriate.
- system 100 may use a profiler other than Microsoft's CLR profiler, so long as the profiler is operable to monitor, reference, or otherwise process information associated with a web-enabled application. Accordingly, the above description of example embodiments does not define or constrain this disclosure. Other changes, substitutions, and alterations are also possible without departing from the spirit and scope of this disclosure.
Abstract
Description
Claims
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP04756737.5A EP1652080B1 (en) | 2003-07-11 | 2004-07-08 | System and method for high-performance profiling of application events |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US48660103P | 2003-07-11 | 2003-07-11 | |
US60/486,601 | 2003-07-11 | ||
US10/886,756 | 2004-07-07 | ||
US10/886,756 US7984129B2 (en) | 2003-07-11 | 2004-07-07 | System and method for high-performance profiling of application events |
Publications (3)
Publication Number | Publication Date |
---|---|
WO2005008489A2 true WO2005008489A2 (en) | 2005-01-27 |
WO2005008489A3 WO2005008489A3 (en) | 2005-04-14 |
WO2005008489A8 WO2005008489A8 (en) | 2005-06-02 |
Family
ID=33567933
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2004/021774 WO2005008489A2 (en) | 2003-07-11 | 2004-07-08 | System and method for high-performance profiling of application events |
Country Status (3)
Country | Link |
---|---|
US (2) | US7984129B2 (en) |
EP (1) | EP1652080B1 (en) |
WO (1) | WO2005008489A2 (en) |
Families Citing this family (60)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7984129B2 (en) | 2003-07-11 | 2011-07-19 | Computer Associates Think, Inc. | System and method for high-performance profiling of application events |
US7483973B2 (en) * | 2003-08-28 | 2009-01-27 | International Business Machines Corporation | Gateway for service oriented state |
US7475386B1 (en) * | 2003-11-14 | 2009-01-06 | Sun Microsystems, Inc. | Mechanism for disjoint instrumentation providers in a tracing framework |
US20050235284A1 (en) * | 2004-04-14 | 2005-10-20 | International Business Machines Corporation | Systems and methods for tracking processing unit usage |
US8640114B2 (en) * | 2006-09-07 | 2014-01-28 | Oracle America, Inc. | Method and apparatus for specification and application of a user-specified filter in a data space profiler |
CN102004950A (en) * | 2005-04-25 | 2011-04-06 | 因文西斯系统公司 | Recording and tracing non-trending production data and events in an industrial process control environment |
US7721278B2 (en) * | 2005-05-27 | 2010-05-18 | Microsoft Corporation | Modular server architecture for multi-environment HTTP request processing |
WO2007068091A1 (en) * | 2005-12-12 | 2007-06-21 | Audiokinetic Inc. | Method and system for multi-version digital authoring |
US20070180101A1 (en) * | 2006-01-10 | 2007-08-02 | A10 Networks Inc. | System and method for storing data-network activity information |
US8176480B1 (en) * | 2006-02-27 | 2012-05-08 | Symantec Operating Corporation | Adaptive instrumentation through dynamic recompilation |
US8151322B2 (en) | 2006-05-16 | 2012-04-03 | A10 Networks, Inc. | Systems and methods for user access authentication based on network access point |
CA2657202A1 (en) * | 2006-07-28 | 2008-01-31 | Farmaprojects, S.A. | Extended release pharmaceutical formulation of metoprolol and process for its preparation |
US7716378B2 (en) | 2006-10-17 | 2010-05-11 | A10 Networks, Inc. | System and method to associate a private user identity with a public user identity |
US8312507B2 (en) | 2006-10-17 | 2012-11-13 | A10 Networks, Inc. | System and method to apply network traffic policy to an application session |
US8813055B2 (en) | 2006-11-08 | 2014-08-19 | Oracle America, Inc. | Method and apparatus for associating user-specified data with events in a data space profiler |
US8627335B2 (en) * | 2006-11-13 | 2014-01-07 | Oracle America, Inc. | Method and apparatus for data space profiling of applications across a network |
GB0624033D0 (en) * | 2006-12-01 | 2007-01-10 | Iti Scotland Ltd | Dynamic intervention with software applications |
US7770183B2 (en) * | 2007-01-30 | 2010-08-03 | Microsoft Corporation | Indirect event stream correlation |
US8762951B1 (en) | 2007-03-21 | 2014-06-24 | Oracle America, Inc. | Apparatus and method for profiling system events in a fine grain multi-threaded multi-core processor |
US20090164356A1 (en) * | 2007-10-12 | 2009-06-25 | Alexander Bakman | Method, system and apparatus for calculating chargeback for virtualized computing resources |
US8826242B2 (en) | 2007-11-27 | 2014-09-02 | Microsoft Corporation | Data driven profiling for distributed applications |
JP5133678B2 (en) * | 2007-12-28 | 2013-01-30 | 株式会社ベネッセコーポレーション | Video playback system and control method thereof |
US8903983B2 (en) * | 2008-02-29 | 2014-12-02 | Dell Software Inc. | Method, system and apparatus for managing, modeling, predicting, allocating and utilizing resources and bottlenecks in a computer network |
US9098625B2 (en) * | 2008-02-29 | 2015-08-04 | International Business Machines Corporation | Viral trace |
US8935701B2 (en) * | 2008-03-07 | 2015-01-13 | Dell Software Inc. | Unified management platform in a computer network |
US9645912B2 (en) * | 2008-12-01 | 2017-05-09 | Microsoft Technology Licensing, Llc | In-place function modification |
US8689239B2 (en) * | 2009-05-20 | 2014-04-01 | Microsoft Corporation | Dynamic event collection and structured storage |
US8738972B1 (en) | 2011-02-04 | 2014-05-27 | Dell Software Inc. | Systems and methods for real-time monitoring of virtualized environments |
US9495222B1 (en) * | 2011-08-26 | 2016-11-15 | Dell Software Inc. | Systems and methods for performance indexing |
US9172583B1 (en) * | 2011-11-22 | 2015-10-27 | Crimson Corporation | Actively provisioning a managed node |
US9928562B2 (en) | 2012-01-20 | 2018-03-27 | Microsoft Technology Licensing, Llc | Touch mode and input type recognition |
US9122853B2 (en) | 2013-06-24 | 2015-09-01 | A10 Networks, Inc. | Location determination for user authentication |
CN105531679B (en) * | 2013-10-10 | 2018-05-15 | 英特尔公司 | The abnormality detection carried out on networking client |
US11165770B1 (en) | 2013-12-06 | 2021-11-02 | A10 Networks, Inc. | Biometric verification of a human internet user |
US11507663B2 (en) | 2014-08-11 | 2022-11-22 | Sentinel Labs Israel Ltd. | Method of remediating operations performed by a program and system thereof |
US9710648B2 (en) | 2014-08-11 | 2017-07-18 | Sentinel Labs Israel Ltd. | Method of malware detection and system thereof |
US10048856B2 (en) | 2014-12-30 | 2018-08-14 | Microsoft Technology Licensing, Llc | Configuring a user interface based on an experience mode transition |
US9612810B2 (en) * | 2015-08-25 | 2017-04-04 | International Business Machines Corporation | Profile-based per-device code optimization |
US11288245B2 (en) | 2015-10-16 | 2022-03-29 | Microsoft Technology Licensing, Llc | Telemetry definition system |
US10929272B2 (en) * | 2015-10-16 | 2021-02-23 | Microsoft Technology Licensing, Llc | Telemetry system extension |
US20170187782A1 (en) * | 2015-10-16 | 2017-06-29 | Microsoft Technology Licensing, Llc | Telemetry response system |
US11386061B2 (en) * | 2015-10-16 | 2022-07-12 | Microsoft Technology Licensing, Llc | Telemetry request system |
US10031788B2 (en) * | 2015-11-09 | 2018-07-24 | Nec Corporation | Request profile in multi-threaded service systems with kernel events |
US10042737B2 (en) | 2016-08-31 | 2018-08-07 | Microsoft Technology Licensing, Llc | Program tracing for time travel debugging and analysis |
US10031834B2 (en) | 2016-08-31 | 2018-07-24 | Microsoft Technology Licensing, Llc | Cache-based tracing for time travel debugging and analysis |
US10310977B2 (en) | 2016-10-20 | 2019-06-04 | Microsoft Technology Licensing, Llc | Facilitating recording a trace file of code execution using a processor cache |
US10324851B2 (en) * | 2016-10-20 | 2019-06-18 | Microsoft Technology Licensing, Llc | Facilitating recording a trace file of code execution using way-locking in a set-associative processor cache |
US10489273B2 (en) | 2016-10-20 | 2019-11-26 | Microsoft Technology Licensing, Llc | Reuse of a related thread's cache while recording a trace file of code execution |
US10310963B2 (en) | 2016-10-20 | 2019-06-04 | Microsoft Technology Licensing, Llc | Facilitating recording a trace file of code execution using index bits in a processor cache |
US10540250B2 (en) | 2016-11-11 | 2020-01-21 | Microsoft Technology Licensing, Llc | Reducing storage requirements for storing memory addresses and values |
US11695800B2 (en) | 2016-12-19 | 2023-07-04 | SentinelOne, Inc. | Deceiving attackers accessing network data |
US11616812B2 (en) | 2016-12-19 | 2023-03-28 | Attivo Networks Inc. | Deceiving attackers accessing active directory data |
US10318332B2 (en) | 2017-04-01 | 2019-06-11 | Microsoft Technology Licensing, Llc | Virtual machine execution tracing |
US10296442B2 (en) | 2017-06-29 | 2019-05-21 | Microsoft Technology Licensing, Llc | Distributed time-travel trace recording and replay |
JP2020530922A (en) | 2017-08-08 | 2020-10-29 | センチネル ラボ, インコーポレイテッドSentinel Labs, Inc. | How to dynamically model and group edge networking endpoints, systems, and devices |
US11470115B2 (en) | 2018-02-09 | 2022-10-11 | Attivo Networks, Inc. | Implementing decoys in a network environment |
WO2020236981A1 (en) | 2019-05-20 | 2020-11-26 | Sentinel Labs Israel Ltd. | Systems and methods for executable code detection, automatic feature extraction and position independent code detection |
CN111736978B (en) * | 2020-07-29 | 2020-11-27 | 长沙微康信息科技有限公司 | System diary data classification processing method and device and intelligent electronic equipment |
US11579857B2 (en) | 2020-12-16 | 2023-02-14 | Sentinel Labs Israel Ltd. | Systems, methods and devices for device fingerprinting and automatic deployment of software in a computing network using a peer-to-peer approach |
US11899782B1 (en) | 2021-07-13 | 2024-02-13 | SentinelOne, Inc. | Preserving DLL hooks |
Family Cites Families (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4866599A (en) * | 1985-06-27 | 1989-09-12 | Bull Hn Information Systems Inc. | Call instruction, return instruction and trap procedure for ring crossing architecture |
DE3735828C2 (en) * | 1986-10-24 | 1994-11-10 | Hitachi Ltd | Method for resuming instruction execution after an interruption in a microprocessor-controlled data processing device |
US6126329A (en) | 1993-06-08 | 2000-10-03 | Rational Software Coporation | Method and apparatus for accurate profiling of computer programs |
US5682328A (en) * | 1996-09-11 | 1997-10-28 | Bbn Corporation | Centralized computer event data logging system |
US6182244B1 (en) | 1997-09-10 | 2001-01-30 | International Business Machines Corporation | System and method for automatically initiating a tracing facility and dynamically changing the levels of tracing currently active |
US6553564B1 (en) | 1997-12-12 | 2003-04-22 | International Business Machines Corporation | Process and system for merging trace data for primarily interpreted methods |
US6751789B1 (en) * | 1997-12-12 | 2004-06-15 | International Business Machines Corporation | Method and system for periodic trace sampling for real-time generation of segments of call stack trees augmented with call stack position determination |
GB2345557A (en) | 1999-01-07 | 2000-07-12 | Ibm | Fast trace log for a multi-processing environment |
US6345295B1 (en) | 1999-01-22 | 2002-02-05 | International Business Machines Corporation | Conducting traces in a computer system attachment network |
US6308324B1 (en) | 1999-06-10 | 2001-10-23 | International Business Machines Corporation | Multi-stage profiler |
GB2362968B (en) * | 1999-12-23 | 2003-12-10 | St Microelectronics Sa | Computer system with debug facility |
US6735758B1 (en) | 2000-07-06 | 2004-05-11 | International Business Machines Corporation | Method and system for SMP profiling using synchronized or nonsynchronized metric variables with support across multiple systems |
US6993246B1 (en) * | 2000-09-15 | 2006-01-31 | Hewlett-Packard Development Company, L.P. | Method and system for correlating data streams |
CA2350735A1 (en) * | 2001-03-14 | 2002-09-14 | Ibm Canada Limited-Ibm Canada Limitee | A method for providing open access to application profiling data |
US6975595B2 (en) * | 2001-04-24 | 2005-12-13 | Atttania Ltd. | Method and apparatus for monitoring and logging the operation of a distributed processing system |
US7099350B2 (en) * | 2001-04-24 | 2006-08-29 | Atitania, Ltd. | Method and apparatus for converting data between two dissimilar systems |
US20030046029A1 (en) * | 2001-09-05 | 2003-03-06 | Wiener Jay Stuart | Method for merging white box and black box testing |
US7281013B2 (en) * | 2002-06-03 | 2007-10-09 | Microsoft Corporation | Workload analysis tool for relational databases |
US7512954B2 (en) * | 2002-07-29 | 2009-03-31 | Oracle International Corporation | Method and mechanism for debugging a series of related events within a computer system |
US20040064685A1 (en) * | 2002-09-27 | 2004-04-01 | Hung Nguyen | System and method for real-time tracing and profiling of a superscalar processor implementing conditional execution |
US7984129B2 (en) | 2003-07-11 | 2011-07-19 | Computer Associates Think, Inc. | System and method for high-performance profiling of application events |
-
2004
- 2004-07-07 US US10/886,756 patent/US7984129B2/en not_active Expired - Fee Related
- 2004-07-08 EP EP04756737.5A patent/EP1652080B1/en not_active Not-in-force
- 2004-07-08 WO PCT/US2004/021774 patent/WO2005008489A2/en active Application Filing
-
2011
- 2011-06-06 US US13/153,630 patent/US8504674B2/en not_active Expired - Fee Related
Non-Patent Citations (3)
Title |
---|
HARKEMA, M ET AL: "Performance Monitoring of Java Applications" PROCEEDINGS OF THE THIRD INTERNATIONAL WORKSHOP ON SOFTWARE AND PERFORMANCE, 26 July 2002 (2002-07-26), pages 114-127, XP002315876 * |
PIEREK, MATT: "The .NET Profiling API and the DNProfiler Tool" MSDN MAGAZINE, [Online] December 2001 (2001-12), pages 1-9, XP002315877 Retrieved from the Internet: URL:http://msdn.microsoft.com/msdnmag/issues/01/12/hood/> [retrieved on 2005-02-01] * |
TUNSTALL, CRAIG; COLE, GWYN: "Developing WMI Solutions- A Guide to Windows Management Instrumentation" November 2002 (2002-11), ADDISON-WESLEY , BOSTON, MA,USA , XP002315878 page 669, line 1 - line 18 page 671, line 38 page 689, line 18 page 700, line 21 - line 22 page 708, line 27 - line 28 figure 13.3 figure 13.7 * |
Also Published As
Publication number | Publication date |
---|---|
WO2005008489A8 (en) | 2005-06-02 |
EP1652080A2 (en) | 2006-05-03 |
US20110238812A1 (en) | 2011-09-29 |
EP1652080B1 (en) | 2017-05-03 |
US8504674B2 (en) | 2013-08-06 |
US20050010930A1 (en) | 2005-01-13 |
WO2005008489A3 (en) | 2005-04-14 |
US7984129B2 (en) | 2011-07-19 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7984129B2 (en) | System and method for high-performance profiling of application events | |
US10204173B2 (en) | System and method for storing metrics in a database | |
US7505953B2 (en) | Performance monitoring of method calls and database statements in an application server | |
US9165077B2 (en) | Technology for web site crawling | |
US7523191B1 (en) | System and method for monitoring user interaction with web pages | |
US7617190B2 (en) | Data feeds for management systems | |
US20040133671A1 (en) | Click stream analysis | |
US7461369B2 (en) | Java application response time analyzer | |
US7912933B2 (en) | Tags for management systems | |
WO2020087082A1 (en) | Trace and span sampling and analysis for instrumented software | |
US11792157B1 (en) | Detection of DNS beaconing through time-to-live and transmission analyses | |
US7937460B2 (en) | System and method for providing service level management | |
US20050086664A1 (en) | Method and apparatus for transaction tracking in a web presentation architecture | |
US11429608B2 (en) | Optimizing search of an accelerated data model by enabling emitting of structured and unstructured fields from the data model | |
US11604789B1 (en) | Bi-directional query updates in a user interface | |
Mortazavi-Asl | Discovering and mining user web-page traversal patterns | |
US11734297B1 (en) | Monitoring platform job integration in computer analytics system | |
US7415517B1 (en) | Developing session context from nonlinear web site flow records | |
RU2348068C2 (en) | Information concervation independent from reproduction | |
EP1652111B1 (en) | Web product interface system and method | |
US11675771B1 (en) | Identity resolution | |
US11947528B1 (en) | Automatic generation of queries using non-textual input | |
US11704285B1 (en) | Metrics and log integration | |
CN114020723A (en) | Data processing method and device |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A2 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A2 Designated state(s): GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
CFP | Corrected version of a pamphlet front page | ||
CR1 | Correction of entry in section i |
Free format text: IN PCT GAZETTE 04/2005 UNDER (71) REPLACE "COMPUTER ASSOCIATES THINK, INC. ¢US/US!; ONE CORPORATE ASSOCIATES PLAZA, ISLANDIA, NY 11749-7000 (US)" BY "COMPUTER ASSIOCIATES THINK, INC. ¢US/US!; ONE COMPUTER ASSOCIATES PLAZA, ISLANDIA, NY 11749-7000 (US)." |
|
REEP | Request for entry into the european phase |
Ref document number: 2004756737 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2004756737 Country of ref document: EP |
|
WWP | Wipo information: published in national office |
Ref document number: 2004756737 Country of ref document: EP |