Distributed System Topology Enrichment from Transaction Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern application monitoring systems face incomplete models of monitored environments due to unmonitored components, leading to incorrect or misleading results in higher-level monitoring tasks like causality and root cause estimation.
Innovation Solution
A combined analysis of topology and transaction monitoring data is performed to infer the existence of unmonitored components, enriching both the topological model and transaction trace data, and using this enriched data for enhanced anomaly detection and causality estimation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agents are deployed to all components of the monitored environment, then the topological model completeness is improved, but the device complexity and organizational difficulty increase
Solution Approach 1:
The patent uses transaction monitoring data as an intermediary to infer the existence of unmonitored components. Instead of directly deploying agents to all components, the system analyzes transaction traces to indirectly detect components that lack agents, thereby resolving the contradiction between model completeness and deployment complexity.
Solution Approach 2:
The system implements a feedback mechanism where transaction monitoring data is continuously analyzed to identify gaps in the topological model. This feedback loop enables the system to automatically detect unmonitored components and enrich the model without requiring manual agent deployment to every component.
2Measurement precision
If agents are deployed to all components, then the measurement precision of monitoring data is improved, but the loss of time and resources for deployment increases
Solution Approach 1:
The patent performs preliminary enrichment of the topological model by analyzing transaction monitoring data before conducting higher-level monitoring tasks. This preliminary action identifies unmonitored components in advance, ensuring measurement precision is improved without requiring time-consuming agent deployment to all components.
Solution Approach 2:
The system creates a virtual representation of unmonitored components by inferring their existence from transaction data. This copying approach allows the system to treat inferred components similarly to agent-monitored components, achieving high measurement precision without the time cost of actual agent deployment.
3Measurement precision
If transaction monitoring data is enriched with inferred component data, then the anomaly detection accuracy is improved, but the device complexity of the analysis system increases
Solution Approach 1:
The patent merges transaction monitoring data with topological model data to create an enriched view of the monitored environment. By combining these data sources, the system improves anomaly detection accuracy while managing analysis complexity through integrated processing rather than separate complex systems.
Solution Approach 2:
The system implements a universal analysis framework that processes both transaction monitoring data and topological model data through the same inference engine. This multi-functional approach improves anomaly detection across different data types without requiring separate complex analysis systems for each data source.
Data Source
AI summary
A system and method is disclosed for the combined analysis of transaction execution monitoring data and a topology model created from infrastructure monitoring data of computing systems involved in the execution of the monitored transactions. Monitored communication activities of transactions are analyzed to identify intermediate processing nodes between sender and receiver side and to enrich transaction monitoring data with data describing those intermediate processing nodes. The topology model may also be improved by the combined analysis, as functionality and services provided by elements of the topology model may be derived by the involvement of those elements in the execution of monitored transactions. The result of the combined analysis is used by an automated anomaly detection and causality estimation system. The combined analysis may also reveal entities of a monitored environment that are used by transaction executions but which are not monitored.