Application performance analyzer and corresponding method
An application performance analyzer adapted to analyze the performance of one or more applications running on IT infrastructure, comprises: a data collection engine collecting performance metrics for one or more applications running on the IT infrastructure; an anomaly detection engine analyzing the performance metrics and detecting anomalies, i.e. performance metrics whose values deviate from historic values with a deviation that exceeds a predefined threshold; a correlation engine detecting dependencies between plural anomalies, and generating anomaly clusters, each anomaly cluster consisting of anomalies that are correlated through one or more of the dependencies; a ranking engine ranking anomalies within an anomaly cluster; and a source detection engine pinpointing a problem source from the lowest ranked anomaly in an anomaly cluster.
1. A system for identifying a problem source in an information technology (IT) infrastructure, comprising:
one or more processors configured to:
receive, from one or more agents of the IT infrastructure, performance metrics for applications running on the IT infrastructure, the one or more agents executing outside of the applications, the performance metrics excluding transaction information specifying calls between the applications;
detect anomalies using the performance metrics for the applications running on the IT infrastructure;
determine correlated anomalies based on communication path data indicating the correlated anomalies belong to a group of applications of the IT infrastructure that communicate with each other via a communication path;
generate a ranking of the correlated anomalies, a first correlated anomaly of a first application further in the communication path being ranked lower than a second correlated anomaly of a second application earlier in the communication path; and
identify an application of the group of applications as the problem source from a lowest ranked anomaly of the ranking of the correlated anomalies.
2. The system of claim 1 , wherein the performance metrics comprise at least one of:
CPU usage;
disk space occupancy;
memory usage;
requests per second;
response time; or
error count value.
3. The system of claim 1 , wherein the one or more processors configured to detect the anomalies includes the one or more processors being configured to apply a k-Nearest Neighbor algorithm or k-NN algorithm.
4. The system of claim 1 , wherein the detected anomalies include performance metrics with values that deviate from historic values with a deviation that exceeds a predefined threshold.
5. The system of claim 1 , wherein the one or more agents include a lightweight agent (AG) installed on a node of the IT infrastructure.
6. The system of claim 1 , wherein the one or more processors are further configured to:
detect dependencies between the anomalies based on the communication path data; and
generate an anomaly cluster including the correlated anomalies based on the correlated anomalies being correlated through one or more of the dependencies.
7. The system of claim 1 , wherein the one or more processors are configured to determine the correlated anomalies based on user input indicating the group of applications communicate with each other.
8. The system of claim 1 , wherein the one or more processors are configured to determine the correlated anomalies based on user input indicating a group of servers that execute the group of applications communicate with each other.
9. The system of claim 1 , wherein the problem source includes a server of the IT infrastructure that executes the application.
10. The system of claim 1 , wherein the one or more processors are configured to determine the correlated anomalies based on the communication path data indicating a group of servers that execute the group of applications communicate with each other.
11. A method for identifying a problem source in an information technology (IT) infrastructure, comprising, by a computing system:
receiving, from one or more agents of the IT infrastructure, performance metrics for applications running on the IT infrastructure, the one or more agents executing outside of the applications, the performance metrics excluding transaction information specifying calls between the applications;
detecting anomalies using the performance metrics for the applications running on the IT infrastructure;
determining correlated anomalies based on communication path data indicating the correlated anomalies belong to a group of applications of the IT infrastructure that communicate with each other via a communication path;
generating a ranking of the correlated anomalies, a first correlated anomaly of a first application further in the communication path being ranked lower than a second correlated anomaly of a second application earlier in the communication path; and
identifying an application of the group of applications as the problem source from a lowest ranked anomaly of the ranking of the correlated anomalies.
12. The method of claim 11 , wherein the performance metrics comprise at least one of:
CPU usage;
disk space occupancy;
memory usage;
requests per second;
response time; or
error count value.
13. The method of claim 11 , wherein detecting the anomalies includes applying a k-Nearest Neighbor algorithm or k-NN algorithm.
14. The method of claim 11 , wherein the detected anomalies include performance metrics with values that deviate from historic values with a deviation that exceeds a predefined threshold.
15. The method of claim 11 , wherein the one or more agents include a lightweight agent (AG) installed on a node of the IT infrastructure.
16. The method of claim 11 , further comprising:
detecting dependencies between the anomalies based on the communication path data; and
generating an anomaly cluster including the correlated anomalies based on the correlated anomalies being correlated through one or more of the dependencies.
17. The method of claim 11 , wherein the correlated anomalies are determined based on input indicating at least one of:
the group of applications communicate with each other; or
a group of servers that execute the group of applications communicate with each other.
18. The method of claim 11 , wherein the problem source includes a server of the IT infrastructure that executes the application.
19. The method of claim 11 , wherein the correlated anomalies are determined based on the communication path data indicating a group of servers that execute the group of applications communicate with each other.
20. A non-transitory computer readable storage medium having stored thereon executable instructions that when executed by one or more processors of a computer system configure the computer system to:
receive, from one or more agents of an information technology (IT) infrastructure, performance metrics for applications running on the IT infrastructure, the one or more agents executing outside of the applications, the performance metrics excluding transaction information specifying calls between the applications;
detect anomalies using the performance metrics for the applications running on the IT infrastructure;
determine correlated anomalies based on communication path data indicating the correlated anomalies belong to a group of applications of the IT infrastructure that communicate with each other via a communication path;
generate a ranking of the correlated anomalies, a first correlated anomaly of a first application further in the communication path being ranked lower than a second correlated anomaly of a second application earlier in the communication path; and
identify an application of the group of applications as a problem source from a lowest ranked anomaly of the ranking of the correlated anomalies.