Automated software configuration management
A system uses agents to monitor a distributed business transaction as well as monitor changes in software configuration. An agent may detect a file load, such a class load, obtain portions of the file such as functions, and perform a hash on the byte code functions. A hash tree may then be constructed and compared to previous states of the system. The hash tree may be generated, for example, at each file loading detected, so that system states can be compared. Differences in hash trees are detected and the changes are reported to an administrator of the system that provides the distrusted business transaction.
1. A method for managing software configuration during runtime, comprising:
detecting, by an agent installed on an application server, at runtime loading of a file in an application, the application being one of a plurality of applications that provide a distributed business transaction;
responsive to the detecting, identifying, by the agent, components of the loaded file in byte code;
performing, by the agent, a hash of the components of the loaded file to generate corresponding hash values;
constructing a hash tree from the generated hash values;
determining whether a previously constructed hash tree from a previously detected load of a file is available to perform a comparison;
comparing the constructed hash tree against the previously constructed hash tree to identify a difference in bytecode, wherein the identified difference includes identification of a distrusted business transaction by tracking one or more changes to blocks of byte code inside the loaded file; and
reporting results of the comparison.
2. The method of claim 1 , wherein the components include functions and data, and wherein the hash is performed on the functions.
3. The method of claim 1 , wherein the components include portions of a configuration file.
4. The method of claim 1 , wherein constructing the hash tree includes constructing a Merkle tree from the hash values.
5. The method of claim 1 , including constructing the hash tree responsive to detection of each loading of a file.
6. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform operations for managing software configuration, the operations including:
detecting, by an agent installed on an application server, at runtime loading of a file in an application, the application being one of a plurality of applications that provide a distributed business transaction;
responsive to the detecting, identifying, by the agent, components of the loaded file in byte code;
performing, by the agent, a hash of the components of the loaded file to generate corresponding hash values;
constructing a hash tree from the generated hash values;
determining whether a previously constructed hash tree from a previously detected load of a file is available to perform a comparison;
comparing the constructed hash tree against the previously constructed hash tree to identify a difference in bytecode, wherein the identified difference includes identification of a distrusted business transaction by tracking one or more changes to blocks of byte code inside the loaded file; and
reporting results of the comparison.
7. The non-transitory computer-readable storage medium of claim 6 , wherein the components include functions and data, and wherein the hash is performed on the functions.
8. The non-transitory computer-readable storage medium of claim 6 , wherein the components include portions of a configuration file.
9. The non-transitory computer-readable storage medium of claim 6 , including constructing a hash tree responsive to detection of each loading of a file.
10. A system for managing software configuration for delivering an agent on a machine, the system comprising:
a processor; memory; and
one or more modules stored in memory and executable by the processor to perform operations including:
detect at runtime loading of a file in an application, the application being one of a plurality of applications that provide a distributed business transaction;
responsive to the detecting, identifying components of the loaded file in byte code;
perform a hash of the components of the loaded file to generate corresponding hash values;
construct a hash tree from the generated hash values;
determine whether a previously constructed hash tree from a previously detected load of a file is available to perform a comparison;
compare the constructed hash tree against the previously constructed hash tree to identify a difference in bytecode, wherein the identified difference includes identification of a distrusted business transaction by tracking one or more changes to blocks of byte code inside the loaded file; and
report results of the comparison.
11. The system of claim 10 , wherein the components include functions and data, and wherein the hash is performed on the functions.
12. The system of claim 10 , wherein the components include portions of a configuration file.
13. The system of claim 10 , including constructing a hash tree responsive to detection of each loading of a file.