Method and system for automated injection of process type specific in process agents on process startup

1. A computer-implemented method for instrumenting monitoring agents into processes executing on an operating system of a computing device, comprising:

executing an operating system agent as a process in an execution environment of a computing device, wherein the operating system agent is managed by the operating system and the operating system agent is implemented by executable instructions stored in a non-transitory data store associated with the computing device;

establishing, by the operating system agent, a data connection across a network with a monitor server located remotely from the computing device;

installing, by the operating system agent, an injection procedure into the execution environment;

detecting, by the injection procedure, start of a given process in the execution environment, where the given process differs from the process for the operating system agent;

starting, by the injection procedure, a core agent in the given process, wherein the core agent is started in response to detecting start the given process and the core agent is implemented by executable instructions stored in the non-transitory data store;

monitoring, by the core agent, execution of an application executed by the given process in the execution environment; and

sending, by the core agent, performance data describing execution of the application across the network to the monitor server;

wherein installing an injection procedure further comprises

determining, by the operating system agent, availability of an install mechanism in a user space of the execution environment;

installing, by the operating system agent, the injection procedure into the user space in response to a determination that an install mechanism is available in the user space; and

installing, by the operating system agent, the injection procedure into a kernel space in response to a determination that an install mechanism is unavailable in the user space.

2. The computer-implemented method of claim 1 wherein the injection procedure installed into the kernel space further comprises identifying a generic function executed during start of a process; and inserting code that loads the core agent into the generic function, after the execution of the generic function and prior to the execution of the application by the process; the code that loads the core agent further determines if the generic function is executed during process start in the main thread of the process and suppresses the loading of the core agent if the generic function was executed after the start of the process in other threads of the process.

3. The computer-implemented method of claim 1 further comprises

determining, by the core agent, a type for the given process;

retrieving, by the core agent, a process specific agent from a repository residing on the computing device, where the process specific agent is selected from a plurality of process specific agents based on the type for the given process; and

starting, by the core agent, the retrieved process specific agent in the given process.

4. The computer-implemented method of claim 3 further comprises

monitoring, by the process specific agent, execution of the application executed by the given process in the execution environment; and

sending, by the process specific agent, performance data describing execution of the application across the network to the monitor server.

5. The computer-implemented method of claim 1 wherein sending performance data further comprises sending the performance data by the core agent to the operating system agent; receiving the performance data at the operating system agent; and sending the performance data by the operating system agent to the monitor server.

6. The computer-implemented method of claim 1 wherein the performance data is sent by the core agent directly to the monitor server.

7. A computer-implemented method for instrumenting monitoring agents into processes executing on an operating system of a computing device, comprising:

detecting start of a given process in an execution environment of the computing device;

starting a core agent in the given process, wherein the core agent is started in the execution context of the given process and in response to detecting start the given process;

determining, by the core agent, a type for the given process;

retrieving, by the core agent, a process specific agent from a repository residing on the computing device, where the process specific agent is selected from a plurality of process specific agents based on the type for the given process; and

starting, by the core agent, the retrieved process specific agent in the execution context of the given process, wherein the core agent and the process specific agent are implemented by executable instructions stored in a non-transitory data store and executed by a processor of the computing device.

8. The computer-implemented method of claim 7 wherein the core agent having access to resources restricted by the operating system and the process specific agent is without access to the resources restricted by the operating system.

9. The computer-implemented method of claim 7 wherein determining type for the given process further comprises determining a type of technology platform used by the given process; and selecting the process specific agent from the plurality of process specific agents according to the type of technology platform.

10. The computer-implemented method of claim 9 further comprises determining a type of technology platform by detecting by the core agent that the given process loads a specific library associated with a particular type of technology platform.

11. The computer-implemented method of claim 9 further comprises determining type of technology platform from name of executable binary for the given process.

12. The computer-implemented method of claim 7 wherein determining type for the given process further comprises determining a type of application server executing the given process and placing the process specific agent into the given process based on the type of application server.

13. The computer-implemented method of claim 7 wherein determining type for the given process further comprises placing the process specific agent into the given process in accordance with a command on a command line that starts the given process.

14. The computer-implemented method of claim 7 wherein determining type for the given process further comprises intercepting call to fetch values from registry keys and placing the process specific agent into the given process in accordance with the intercepted values from the registry keys.

15. The computer-implemented method of claim 7 further comprises

monitoring, by the process specific agent, execution of an application executed by the given process in the execution environment; and

sending, by the process specific agent, performance data describing execution of the application across the network to the monitor server.

16. The computer-implemented method of claim 15 further comprises

executing an operating system agent as a process in the execution environment, wherein the process differs from the given process and the operating system agent is implemented by executable instructions stored in the non-transitory data store and executed by the processor of the computing device;

establishing, by the operating system agent, a data connection across a network with a monitor server located remotely from the computing device;

receiving, by the operating system agent, the performance data from the core agent; and

sending, by the operating system agent, the performance data across the network to the monitor server.

17. The computer-implemented method of claim 16 wherein the performance data is sent by the process specific agent directly to the monitor server.

18. A computer-implemented method for instrumenting monitoring agents into processes executing on an operating system of a computing device, comprising:

executing an operating system agent as a process in an execution environment of a computing device, wherein the operating system agent is managed by the operating system and the operating system agent is implemented by executable instructions stored in a non-transitory data store associated with the computing device;

establishing, by the operating system agent, a data connection across a network with a monitor server located remotely from the computing device;

installing, by the operating system agent, an injection procedure into the execution environment;

detecting, by the injection procedure, start of a given process in the execution environment, where the given process differs from the process for the operating system agent;

starting, by the injection procedure, a core agent in the given process, wherein the core agent is started in response to detecting start the given process and the core agent is implemented by executable instructions stored in the non-transitory data store;

monitoring, by the core agent, resources loaded by the given process;

sending, by the core agent, metadata for the resources to operating system agent;

sending, by the operating system agent, a notification across the network to the monitor server, where the notification indicates a change in resources loaded by the given process;

receiving, by the operating system agent, the metadata from the core agent;

comparing, by the operating system agent, the metadata to metadata previously stored by the operating system agent, where the previously stored metadata describes resources previously loaded by the given process; and

sending, by the operating system agent, the notification to the monitor server in response to a deviation between the metadata received from the core agent and the previously stored metadata.