APPLICATION TOPOLOGY DERIVATION IN A VIRTUALIZED COMPUTING SYSTEM

1 . A method of determining application topology in a virtualized computing system having a cluster of hosts, the hosts including hypervisors supporting virtual machines (VMs), the method comprising:

executing agents on the VMs to obtain process metadata describing processes executing in the VMs;

receiving, at an application analysis system, the process metadata;

receiving, at the application analysis system, network flow metadata from the agents on the VMs, from a network analyzer in the virtualized computing system, or from both the agents and the network analyzer;

parsing, by the application analysis system, the process metadata to identify a first source process and a first destination process executing within a first VM of the VMs;

parsing, by the application analysis system, the network flow metadata to identify a source VM and a destination VM of the VMs;

relating, by the application analysis system, the network flow metadata to portions of the process metadata associated with the source and the destination VMs to identify a second source process and a second destination process;

generating, by the application analysis system, an intra-VM topology of a first source component connected to a first destination component, the first source component identifying the first source process, the first destination component identifying the first destination process; and

generating, by the application analysis system, an intra-VM topology of a second source component connected to a second destination component, the second source component identifying the source VM and the second source process, the second destination component identifying the destination VM and the second destination process.

2 . The method of claim 1 , wherein the application analysis system initially identifies the second source process as a child process, and wherein the application analysis system sets the second source process to a parent process of the child process.

3 . The method of claim 1 , wherein the application analysis system initially identifies the second destination process as a child process, and wherein the application analysis system sets the second destination process to a parent process of the child process.

4 . The method of claim 1 , further comprising:

relating, by the application analysis system, the network flow metadata to the process metadata to determine an identified component and an unidentified object; and

generating, by the application analysis system, a miscellaneous edge topology of the identified component connected to a node, the node associated with the unidentified object.

5 . The method of claim 4 , wherein the unidentified object is a non-VM object external to the cluster of hosts, and wherein the node comprises an external node.

6 . The method of claim 4 , wherein the unidentified object is a VM object external to the cluster of hosts, and wherein the node comprises a VM node.

7 . The method of claim 4 , wherein the unidentified object is a VM object executing in the cluster of hosts, wherein the node comprises a VM node, and wherein the application analysis system associates infrastructure provider information with the VM node.

8 . A non-transitory computer readable medium comprising instructions to be executed in a computing device to cause the computing device to carry out a method of determining application topology in a virtualized computing system having a cluster of hosts, the hosts including hypervisors supporting virtual machines (VMs), the method comprising:

executing agents on the VMs to obtain process metadata describing processes executing in the VMs;

receiving, at an application analysis system, the process metadata;

receiving, at the application analysis system, network flow metadata from the agents on the VMs, from a network analyzer in the virtualized computing system, or from both the agents and the network analyzer;

parsing, by the application analysis system, the process metadata to identify a first source process and a first destination process executing within a first VM of the VMs;

parsing, by the application analysis system, the network flow metadata to identify a source VM and a destination VM of the VMs;

relating, by the application analysis system, the network flow metadata to portions of the process metadata associated with the source and the destination VMs to identify a second source process and a second destination process;

generating, by the application analysis system, an intra-VM topology of a first source component connected to a first destination component, the first source component identifying the first source process, the first destination component identifying the first destination process; and

generating, by the application analysis system, an intra-VM topology of a second source component connected to a second destination component, the second source component identifying the source VM and the second source process, the second destination component identifying the destination VM and the second destination process.

9 . The non-transitory computer readable medium of claim 8 , wherein the application analysis system initially identifies the second source process as a child process, and wherein the application analysis system sets the second source process to a parent process of the child process.

10 . The non-transitory computer readable medium of claim 8 , wherein the application analysis system initially identifies the second destination process as a child process, and wherein the application analysis system sets the second destination process to a parent process of the child process.

11 . The non-transitory computer readable medium of claim 8 , further comprising:

relating, by the application analysis system, the network flow metadata to the process metadata to determine an identified component and an unidentified object; and

generating, by the application analysis system, a miscellaneous edge topology of the identified component connected to a node, the node associated with the unidentified object.

12 . The non-transitory computer readable medium of claim 11 , wherein the unidentified object is a non-VM object external to the cluster of hosts, and wherein the node comprises an external node.

13 . The non-transitory computer readable medium of claim 11 , wherein the unidentified object is a VM object external to the cluster of hosts, and wherein the node comprises a VM node.

14 . The non-transitory computer readable medium of claim 11 , wherein the unidentified object is a VM object executing in the cluster of hosts, wherein the node comprises a VM node, and wherein the application analysis system associates infrastructure provider information with the VM node.

15 . A virtualized computing system having a cluster comprising hosts connected to a network, the hosts including hypervisors, the virtualized computing system comprising:

virtual machines (VMs) executing on the hypervisors, the VMs executing agents to obtain process metadata describing processes executing in the VMs; and

a server configured to execute an application analysis system, the application analysis system configured to:

receive the process metadata;

receive network flow metadata from the agents on the VMs, from a network analyzer in the virtualized computing system, or from both the agents and the network analyzer;

parse the process metadata to identify a first source process and a first destination process executing within a first VM of the VMs;

parse the network flow metadata to identify a source VM and a destination VM of the VMs;

relate the network flow metadata to portions of the process metadata associated with the source and the destination VMs to identify a second source process and a second destination process;

generate an intra-VM topology of a first source component connected to a first destination component, the first source component identifying the first source process, the first destination component identifying the first destination process; and

generate an intra-VM topology of a second source component connected to a second destination component, the second source component identifying the source VM and the second source process, the second destination component identifying the destination VM and the second destination process.

16 . The virtualized computing system of claim 15 , wherein the application analysis system initially identifies the second source process as a child process, and wherein the application analysis system sets the second source process to a parent process of the child process.

17 . The virtualized computing system of claim 15 , wherein the application analysis system is configured to:

relate the network flow metadata to the process metadata to determine an identified component and an unidentified object; and

generate a miscellaneous edge topology of the identified component connected to a node, the node associated with the unidentified object.

18 . The virtualized computing system of claim 17 , wherein the unidentified object is a non-VM object external to the cluster of hosts, and wherein the node comprises an external node.

19 . The virtualized computing system of claim 17 , wherein the unidentified object is a VM object external to the cluster of hosts, and wherein the node comprises a VM node.

20 . The virtualized computing system of claim 17 , wherein the unidentified object is a VM object executing in the cluster of hosts, wherein the node comprises a VM node, and wherein the application analysis system associates infrastructure provider information with the VM node.