Application health monitoring utilizing distributed vantage points
In one implementation, a device may obtain performance metrics from vantage points distributed across a computing network. The device may map the performance metrics to a corresponding application based on a network address associated with the performance metrics. The device may establish a performance metric baseline for the corresponding application based on the performance metrics that are mapped to the corresponding application. The device may identify an anomaly in a performance metric mapped to the corresponding application based on a comparison to the performance metric baseline.
1 . A method, comprising:
obtaining, by a device, performance metrics from vantage points distributed across a computing network;
mapping, by the device, the performance metrics to a corresponding application based on a network address associated with the performance metrics;
generating, by the device, a mapping of each of the vantage points to corresponding points of presence of the corresponding application, wherein the mapping identifies a closest point of presence of the corresponding application for each of the vantage points;
establishing, by the device, a performance metric baseline for the corresponding application based on the performance metrics that are mapped to the corresponding application;
identifying, by the device, an anomaly in a particular performance metric of the performance metrics that are mapped to the corresponding application based on a comparison to the performance metric baseline; and
generating, by the device and based on the mapping, a characterization of performance metrics that indicates how one or more of the points of presence of the corresponding application are serving different geographical regions.
2 . The method as in claim 1 , wherein the particular performance metric is mapped to the corresponding application using one or more of a landing uniform resource locator or a destination Internet protocol address extracted from the network address associated with the performance metrics.
3 . The method as in claim 1 , wherein mapping of the performance metrics to the corresponding application includes:
identifying a matching application for a root domain extracted from the network address associated with the performance metrics; and
identifying a matching sub-application for a subdomain extracted from the network address associated with the performance metrics.
4 . The method as in claim 1 , wherein the performance metrics include HTTP response timing measurements.
5 . The method as in claim 4 , wherein the performance metrics include one or more of redirect, domain name system, connect, secure socket layer, send, receive, or time-to-first-byte metrics based on the HTTP response timing measurements.
6 . The method as in claim 1 , wherein the performance metrics include HTTP response codes returned to the vantage points from attempted HTTP connections.
7 . The method as in claim 1 , wherein the performance metrics include page load and document object model load metrics.
8 . The method as in claim 1 , further comprising:
performing a root cause analysis of the anomaly by correlating the particular performance metric with additional network data including ping, traceroute, and border gateway protocol data.
9 . An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
obtain performance metrics from vantage points distributed across a computing network;
map the performance metrics to a corresponding application based on a network address associated with the performance metrics;
generate a mapping of each of the vantage points to corresponding points of presence of the corresponding application, wherein the mapping identifies a closest point of presence of the corresponding application for each of the vantage points;
establish a performance metric baseline for the corresponding application based on the performance metrics that are mapped to the corresponding application;
identify an anomaly in a particular performance metric of the performance metrics that are mapped to the corresponding application based on a comparison to the performance metric baseline; and
generate, based on the mapping, a characterization of performance metrics that indicates how one or more of the points of presence of the corresponding application are serving different geographical regions.
10 . The apparatus as in claim 9 , wherein the particular performance metric is mapped to the corresponding application using one or more of a landing uniform resource locator or a destination Internet protocol address extracted from the network address associated with the performance metrics.
11 . The apparatus as in claim 9 , wherein the process is further configured to:
identify a matching application for a root domain extracted from the network address associated with the performance metrics; and
identify a matching sub-application for a subdomain extracted from the network address associated with the performance metrics.
12 . The apparatus as in claim 9 , wherein the performance metrics include HTTP response timing measurements.
13 . The apparatus as in claim 12 , wherein the performance metrics include one or more of redirect, domain name system, connect, secure socket layer, send, receive, or time-to-first-byte metrics based on the HTTP response timing measurements.
14 . The apparatus as in claim 9 , wherein the performance metrics include HTTP response codes returned to the vantage points from attempted HTTP connections.
15 . The apparatus as in claim 9 , wherein the performance metrics include page load and document object model load metrics.
16 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
obtaining performance metrics from vantage points distributed across a computing network;
mapping the performance metrics to a corresponding application based on a network address associated with the performance metrics;
generating a mapping of each of the vantage points to corresponding points of presence of the corresponding application, wherein the mapping identifies a closest point of presence of the corresponding application for each of the vantage points;
establishing a performance metric baseline for the corresponding application based on the performance metrics that are mapped to the corresponding application;
identifying an anomaly in a particular performance metric of the performance metrics that are mapped to the corresponding application based on a comparison to the performance metric baseline; and
generating, based on the mapping, a characterization of performance metrics that indicates how one or more of the points of presence of the corresponding application are serving different geographical regions.
17 . The method as in claim 1 , wherein the mapping provides an overview of a geolocation distribution of infrastructure of the corresponding application.
18 . The method as in claim 1 , wherein the characterization indicates performance of the corresponding application for one or more source and destination pairs.
19 . The apparatus as in claim 9 , wherein the mapping provides an overview of a geolocation distribution of infrastructure of the corresponding application.
20 . The apparatus as in claim 9 , wherein the characterization indicates performance of the corresponding application for one or more source and destination pairs.