text:
|Publication number
|Publication type
|Application number
|Publication date
|Jul 4, 2006
|Filing date
|Sep 19, 2003
|Priority date
|Sep 26, 2002
|Fee status
|Publication number
|Gary Fernandez, Ken Kane, Pierre Perret, Krishnan Seetharaman, Mark Sylor, Wilson T. MacDonald
|Original Assignee
|Computer Associates Think, Inc.
|Export Citation
|BiBTeX, EndNote, RefMan
|Patent Citations (6), Referenced by (53), Classifications (16), Legal Events (4)
|External Links: USPTO, USPTO Assignment, Espacenet
This invention relates to network monitoring systems, and more particularly to application response monitoring.
Application response monitoring systems measure and report on the performance of computer applications, especially as regards procedures or transactions initiated by user input. Such systems measure the delay between a user issuing an instruction to an application to perform a given action, and the application being ready to receive a next instruction from the user. Some systems also measure stages within the transaction and can report how much of the delay is due to each stage. Application response monitoring systems are used professionally by both developers of applications and by administrators of computing environments in which applications are used.
"Point-and-click" describes a style of graphical user interface (GUI) for computers. Microsoft's Windows, Apple's MacOS, many UNIX variants, and other operating systems feature point-and-click GUIs. In one common configuration, a computer includes a display screen, a mouse, and a keyboard. The operating system (OS) renders a pointer on the display screen and moves the pointer in response to movements of the mouse by a human user. The pointer acts a virtual tool within the GUI to indicate areas to interact with. The mouse includes a button that is clicked by the user. The user's keystrokes from the keyboard are still another form of user interaction.
Typically, some software applications running on the computer have visible windows in the GUI. At any given time, one of the windows has "focus", i.e., is the default recipient of keystrokes. The user can interact with controls in a window, such as buttons, icons, menus, and so forth, or can change the focus to a different window. A similar notion of focus exists among controls within a window, i.e., the "active" control is the default destination for keystrokes when multiple controls are present.
In general, in one aspect the invention features a computer-based method of formatting rules for monitoring application responsiveness. The method involves defining a collection of resources, each such resource being a source of application events; and defining a first transaction as a timeframe for measuring application responsiveness. The first transaction includes a pattern of application events from resources in the collection of resources, wherein the pattern is defined as a block of constructs and each construct in the block of constructs is selected from a group of construct syntaxes consisting of an event construct syntax, a choice construct syntax, a sequence construct syntax, and a last construct syntax. Also, the event construct syntax specifies a category of application events for the pattern to accept; the choice construct syntax specifies an option set of constructs from the group of construct syntaxes, any one of which is acceptable to the pattern; the sequence construct syntax specifies a sequence of constructs from the group of construct syntaxes, for the pattern to accept sequentially; and the last construct syntax specifies a final set of constructs from the group of construct syntaxes, such that the final set of constructs must be satisfied for the pattern to be matched.
Other embodiments include one or more of the following features. The step of defining the first transaction includes associating the transaction with a module of one or more transactions. The method also involves defining a second transaction based on the collection of resources.
In general, in another aspect, the invention features another computer-based method of monitoring networked application responsiveness. In this case, the method involves detecting an application instance that has a stream of application events; instantiating a finite state machine to recognize transactions in the stream of application events for the application instance, the finite state machine including a collection of states and a collection of transitions, each such transition having criteria for events that qualify to transition between a source state for the transition and a destination state for the transition, the source state and the destination state being among the collection of states; associating a first token with an initial state in the collection of states; processing the stream of application events sequentially, including, for each such event, comparing the event to a processed transition in the collection of transitions and associating an event token with the destination state of the processed transition if the event satisfies the criteria of the processed transition; and recognizing a transaction if a final state in the collection of states is associated with the event token for a candidate event in the stream of application events.
In general, in yet another aspect, the invention features another computer-based method of monitoring networked application responsiveness. In this case, the method involves receiving a message that specifies a responsiveness measure, a client, a server, and a networked service; selecting from a database a path corresponding to the client and the server, and a client set corresponding to the client; and adding the responsiveness measure to an aggregate sample of a plurality of clients, the aggregate sample selected according to the set, the path, and the networked service.
Other embodiments of this invention include one or more of the following features. The method also involves formulating a predicted responsiveness profile based on the aggregate sample; and if the responsiveness measure deviates from the predicted responsiveness profile by an amount given by a predetermined formula, creating an alert condition for the deviation.
In general, in still another aspect, the invention features a computer-based method of identifying user interface objects in a windowing environment. The method involves constructing a collection of string descriptions of window properties, including generating a base string description for a base window having an ancestry hierarchy of parent windows, and recursively generating subsequent string descriptions of the parent windows by following the ancestry hierarchy; calculating a hash of the collection of string descriptions; identifying the base window with an object identifier that combines an application name for an application associated with the base window, a numeric length of the collection of string descriptions, and the hash.
Other embodiments of this invention include one or more of the following features. The object identifier includes string separators separating the application name, the numeric length, and the hash.
In general in still yet another aspect, the invention features a computer-based method of monitoring networked application responsiveness. The method involves receiving a message that specifies a responsiveness measure, a client, a server, and a networked service; selecting from a database a path corresponding to the client and the server, and a client set corresponding to the client; and adding the responsiveness measure to an aggregate sample of a plurality of clients, the aggregate sample selected according to the set, the path, and the networked service.
Other embodiments of this invention also involve formulating a predicted responsiveness profile based on the aggregate sample; and if the responsiveness measure deviates from the predicted responsiveness profile by an amount given by a predetermined formula, creating an alert condition for the deviation.
The details of one or more embodiments of the invention are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the claims.
Referring to
System 10 includes facilities for an administrator 14 a to define the transactions that system 10 monitors. A ruleset 16 is an information structure that defines a transaction in system 10. Studio application 18 is a software program that allows a user to demonstrate a transaction by carrying out sample user interactions with an application 12, while system 10 automatically captures events from the demonstration. The events are stored in a script which can be replayed repeatedly, allowing a user to perform iterative cycles of testing and refining a ruleset, each time against identical input. Studio application 18 also generates rulesets 16 according to a ruleset syntax 20, which describes a textual format for rulesets 16.
During operation, a terminal agent 22 monitors an application 12 in a session 26 corresponding to user 14. As will be explained in more detail, terminal agent 22 uses information from a transaction agent 24 to characterize applications in terms of sources of events. Terminal agent 22 includes specialized event source objects to monitor various sources of event information. For example, terminal agent 22 includes a Windows hook 28 that monitors an event source of an operating system 13 of client device 30, where operating system 13 is one of the Microsoft Windows family of operating systems. Windows hook enables terminal agent 22 to monitor events in a message stream exposed by the operating system.
When terminal agent 22 detects an eligible event, it forwards a application event object 34 representing the event to transaction agent 24. Application event object 34 contains information describing the transaction, such as data on the user 14, the session 26, the corresponding application 12, and the time and duration of the transaction.
Transaction agent 24 receives a stream of application event objects 34 over time and examines the stream for transaction patterns. A ruleset engine 36 in transaction agent 24 reads rulesets 16 and uses them to recognize transactions among application events passed to transaction agent by terminal agent 22. Ruleset engine 36 includes a rule graph 92, which acts as a state machine for each actively monitored application 12.
Upon recognizing a transaction, transaction agent 24 sends a transaction event object 38 to monitor server 40, which is a software process that centralizes responsiveness data. Often, multiple terminal agents 22 and transaction agents 24 are distributed over multiple devices to monitor client sessions 26, each transaction agent 24 reporting to a shared monitor server 40.
Monitor server 40 also includes a naming service 44 that identifies transaction agents 24 robustly, even when the corresponding agents change identity under logical network address schemes such as DNS (domain name service) or IP (internet protocol) addressing. A proxy 45 associated with transaction agent 24 ensures that messages are sent to monitor server 40 at least at regular intervals. The messages include the current logical network address of the transaction agent 24, helping naming service 44 maintain a valid address for transaction agent 24.
Monitor server 40 includes features to store and retrieve responsiveness information for use by administrator 14 a. For example, pathset aggregation 42 supports real-time statistical analysis of event streams from clients, even in cases where the event stream from an individual client is so sparsely active that variance over short periods of time (for example, an hour or less) is not statistically significant, compared to any sample based on an individual stream. Pathset aggregation treats event streams from multiple clients as a single stream, allowing system 10 to measure statistically significant deviations from baseline behaviors over a time frame measured, for example, in minutes rather than hours.
Referring to
The stream of application event objects 34 is transformed into a different event stream by transaction agent 24, which adds a transaction event object 38 to an event stream informing monitor server 40 of recognized transactions.
Physical Configuration
Referring to
Referring to
Monitor server device 50 executes instructions that encode the software process of monitor server 40. Typically, an administrator 14 a has privileged responsibilities for maintaining monitor server device 50 and monitor server 40, as well as other components of system 10.
Monitor server device 50 and standalone devices 48 communicate with one another over a network 52. For example, application event objects 34 follow a response path 54 from standalone devices 48 across network 52. Standalone devices 48 also communicate with network services 56 such as web server 56 a and application server 56 b.
Referring to
The physical configurations shown in
Logical Configuration
The configuration of logical components, e.g., software, can vary according to the physical configuration of system 10. The logical architecture and operation of system 10 will now be explained with regard to
Referring to
Standalone device 48 also runs an agent 66, which is a distributed software entity that monitors application instances 70 and reports on their activity when detected events conform to predefined transactions. In particular, each agent 66 reports to monitor server 40.
In the configuration shown in
Referring to
Referring to
Resources and Resource Instances
Terminal agent 22 monitors events that occur for various facilities of session 26—for example, windowing processes, TCP connections to servers, and web browsers. Typically, the facility to be monitored provides an API (application programming interface) that exposes the necessary events to inspection. For example, the Microsoft Windows operating system has an API that notifies subscribing objects when a window is created, is destroyed, receives focus, loses focus, updates its title, and so forth.
Referring to
Each resource 72 has a resource category 76, according to which terminal agent 22 categorizes raw application events 46 from that resource 72. In general, for each different resource category 76, terminal agent 22 uses a different event source object to monitor raw application events 46.
A resource category 76 is persistent, in the sense that it is stably defined until terminal agent 22 is reconfigured. In contrast, a resource 72 has a dynamic existence over time. When a resource 72 exists, it is a "live" source of raw application events 46, but a resource 72 can terminate. For example, when a GUI process terminates, its corresponding resource 72 terminates, too.
System 10 includes resource categories 76 for OS session, windowing, networking, DNS, browser, email, and OS process. An OS session resource 72 represents a session 26. A windowing resource 72 represents a GUI process for a window or control. A networking resource 72 represents a non-DNS networking entity such as a TCP connection; DNS resources 72 representing DNS servers. Resource categories 76 exist for applications, too. For example, a browser resource 72 represents a web browser, and an email resource 72 represents an email client. An OS process resource 72 represents a generic process in the OS.
Within the architecture of system 10, an application instance 70 is a collection of resources 72. Like resources 72, an application instance 70 is dynamic, i.e., comes into and goes out of existence. Often, in practice, an application instance 70 corresponds to an executable, which is a collection of machine instructions that encode a software application. From this perspective, an application instance 70 represents an active, evolving example of the executable's instructions in action, with states and properties associated with carrying out the instructions. When the operating system allows, one set of instructions can be the basis for multiple such examples in a session. Each such example would be represented by independent application instances 70. Note, however, that application instance 70 is customizable, and in the general case a single application instance 70 can correspond to multiple executables. For example, for a user process that involves data entry into a database form, after which an automatic email is sent describing the data in the form via an email program, an administrator 14 a could define an application instance 70 that encompasses both the executable for the database form and the executable for the email program. An application prototype 71 represents the template from which a given application instance 70 is created in system 10. As will be explained in more detail, the definition of an application prototype 71 and its derived application instance 70 is encoded in a ruleset.
In the example of
Each application instance 70 has a collection of resources 72. Each of the resource categories 76 in the example has an active resource 72, except for the category for email. Each of the resources 72 in this example is associated with an application instance 70, except for a connection resource 72.
A given resource 72 can be shared by multiple application instances 70. In the example of
Event Streams and Transactions
Referring to
A transaction 80 specifies a pattern of application operations over time, as reflected by events corresponding to the operations. A transaction definition includes criteria that select which application event objects 34 will satisfy the pattern. A transaction definition also optionally includes time ordering among the criteria, indicating an order in which application event objects 34 must occur to satisfy the pattern.
Transactions 80 can be nested or can overlap. In the example shown in
1. Window gets focus. Window name is "Correction-Personal Data".
2. Button is pressed. Button name is "OK".
3. Window appears. Window name is "Administer Workforce (U.S.)-Use-Personal Data".
4. Menu command is invoked. Command is "File->Save".
5. Status message appears. Message is "Record Saved".
Ruleset Syntax
Referring to
Ruleset syntax 20 allows for portions of the text to be ignored by transaction agent 24 when the compliant ruleset 16 is parsed, for example so that human-readable explanations can be added. In particular, the hash sign "#" and all subsequent characters on a line are ignored. For clarity of explanation, the following description of ruleset syntax 20 will assume that no comments are present.
Ruleset syntax 20 begins with a ruleset statement 20 a, which defines the boundaries of the ruleset being defined. Ruleset statement 20 a includes the static keyword "application", followed by a name for the ruleset, followed by a block of text encased in curly braces (i.e., "{ }"). The rest of the ruleset is nested within this block of text.
Ruleset syntax 20 next includes a resources statement 20 b, which specifies resources 72 that will provide events for the associated transaction. Resources statement 20 b includes the static keyword "resources", followed by resource definitions block 84, which is another block of text encased in curly braces. Resource definitions block 84 lists resources 72 to be monitored.
After the resources statement 20 b, ruleset syntax 20 includes one or more transaction statements 20 c. A transaction statement 20 c tells the ruleset engine 36 how to recognize the operations and transactions 80 that are occurring within a running application 12. Transaction statement 20 c includes the static keyword "transaction", followed by a transaction name, which is followed by the static keyword "module", a module name, and a rule body block 86 encased in curly braces. Rule body block 86 is a block of text that specifies a pattern of events that characterizes the transaction.
Optionally, an alternate ruleset statement 20 d follows transaction statement 20 c. An alternate ruleset statement 20 d allows the definition of additional transactions for a given application 12 within the same ruleset. As will be explained in more detail, system 10 can monitor such transactions independently. Therefore, the transactions can have different scope. For example, the transactions can be nested.
Resource Definitions
Referring to
Resource definitions block 84 includes a required resource section 84 a, which identifies resources 72 that must exist in order for the application 12 to be running. Often, this includes the processes of the application 12. In general, though, any number of resources can be specified.
A required resource section 84 a is designated by the static keyword "require", followed by a selection kind 84 b that identifies how many of the specified resources must exist before the application is considered to be running. Selection kind 84 can be selected from the qualifier keywords "one", "any", or "all". The keyword "one" indicates that each resource 72 matching one of the resource specifications should be considered a separate running application instance 70 (e.g., an application with one or more GUI executables). The keyword "any" indicates that any resource 72 matching one of the resource specifications should be considered part of a single application instance 70, although resources matching all of the specifications need not be active at the same time (e.g., an application with multiple processes that come and go out of existence). The keyword "all" indicates that resources 72 matching all of the specifications must simultaneously exist in order for the application 12 to be considered to be running (e.g., an application with separate GUI and networking executables).
Required resource section 84 a further includes a curly-braced block that lists resource specifications 84 c. For each resource to be monitored for an application, an event source is specified in a resource specification 84 c, which begins with the static keyword "resource", followed by a name (shown as "event-source" in
Resource definitions block 84 also optionally includes an additional resource section 84 d that identifies any further resources that should be monitored as part of the application. This can include transient resources (those that come and go out of existence during the lifetime of the application) as well as the types of activity to monitor for the "required" processes (network connections, windowing activity, web (URL) activity, etc.). Additional resource section 84 d is designated by the static keyword "additional", followed by a curly-braced block of resources formatted as resource specifications 84 c.
Even if an application's transaction definitions do not explicitly reference the application's networking activity events, a "Connection" resource definition is often included in application resource definitions so that the networking activity is monitored by the agent and exposed to subsequent analysis as a distinguishable factor affecting response time.
Referring to
Referring to
Rule Body Block
Whereas resource definitions tell the ruleset engine 36 how to recognize a running instance 70 of an application, transaction definitions tell the engine how to recognize the operations that are occurring within the application after it is running. This involves telling the engine the one or more sequences of events to look for that characterize the transaction.
Referring to
Referring to
Event name 86 c is also part of the syntax for event specification 86 a. Event name 86 c is ignored by ruleset engine 36 but acts as a debugging aid, allowing a human ruleset developer using studio application 18 to easily correlate the behavior of the ruleset engine 36 with the actual steps supplied in the transaction definition. Any name may be supplied here and does not need to be a unique identifier.
Referring to
Referring to
Referring to
Ruleset syntax 20 treats the main rule body block 86 of a transaction statement 20 c as an implicit sequence construct 86 h. Thus, ruleset engine 36 requires entities of rule body block 86 to occur in sequence in order to satisfy rule body block 86.
Referring to
Each event specification 86 a in the last construct 86 i must be atomic. Choice constructs 86 g, sequence constructs 86 h, and last constructs 86 are not permitted to be nested inside a last construct 86 i.
Referring to
Referring to
Referring to
Parameter Lists
Both resources statement 20 b and transaction statements 20 c involve parameter lists that help to qualify the resource or event being specified. Ruleset syntax 20 includes a generalized syntax for parameter lists.
Referring to
The syntax for parameter entries 88 a also supports a pattern-matching notation. This can be useful, for example, in order to recognize a window title that contains some varying component (e.g. an employee ID number). Pattern matching allows the window title to be selected based on the invariant portion of the title. Accordingly, entry 88 a optionally further includes a comparison qualifier 88 d and a delimiter 88 e. Comparison qualifier 88 d can be selected from the static keywords "exact", "contains", and "regexp". The "exact" keyword is the default when comparison qualifier 88 d is absent. The "exact" keyword requires the value supplied by the resource or event to match the specified value 88 f exactly (though without sensitivity to case). The "contains" keyword specifies a sub-string search. The "regexp" keyword indicates that value 88 f is a regular expression, to be evaluated accordingly.
Referring to
Substitution Parameters
Rulesets 16 can be designed to monitor several types of applications. Examples include a "Windows" ruleset to monitor basic window-to-window transitions within an application, and a "Web" ruleset to monitor page downloads of selected URLs. There can be a large (or total) degree of overlap between rulesets used by different user populations, perhaps only differing in certain parameter values for resources or events such as the name of the GUI executable, or the identity of the URL being monitored. Ruleset syntax 20 supports the development and deployment of generic rulesets 16 that are portable between such environments.
Referring to
Referring to
Referring to
The event specification 86 a containing the placeholder 88 g remains within the expanded ruleset to indicate that the subsequent definitions represent substituted values. If the placeholder definition is removed, then the parameter values will no longer be editable via studio application 18. However, the placeholder definition has no impact on the recognition of transactions. Ruleset engine 36 ignores placeholders 88 g and uses only the expanded definitions (with the substituted values) to recognize transactions 80.
Referring to
Referring to
Alternate Ruleset
It can be useful to monitor an application using two different rulesets simultaneously. For example, an application could be monitored both at a user transaction level while at the same time being monitored at a more granular, networking response time level. The transactions that occur will differ between the levels, but will overlap in time (the user level transactions will be comprised of the networking transactions as well as other activity). The discussion with regard to
Transaction agent 24 supports several approaches to monitoring an application using multiple rulesets. In one approach, multiple rulesets 16 can be created using identical resource definitions. The same application activity will then be independently analyzed for evidence of transactions using each application's ruleset. However, for reporting and administrative purposes, the separate rulesets are independent. There is no correlation between the monitored data for them.
A second approach to multiple rulesets is to embed the alternate transaction definitions within the same overall application definition, using the alternate ruleset statement 20 d. Transaction agent 24 analyzes an application's activity for transactions using each alternate ruleset defined, independently. However, the transactions recognized under each alternate definition (and their corresponding response information) are recorded under the same overall ruleset. Note that alternate rulesets cannot be nested, and that all transaction definitions that occur outside the scope of an alternate ruleset construct are treated as if they belong to a single alternate ruleset definition.
Referring to
Referring again to
In the examples discussed with regard to
Transaction Agent
The transaction agent 24 sorts through resources and events in order to recognize the application operations (transactions) that occur. This is done in two parts: recognizing the applications that are running, and recognizing the transactions that occur. As resources come into and go out of existence, the ruleset engine determines when an instance of a monitored application is running. In addition, once a running application instance is recognized (and only after it is recognized), the event streams from the application's resources are analyzed to recognize the transactions that occur.
Application Recognition
Application event object 34 is the basis for two special event objects, START and STOP, which signal resource availability. In particular, a START event from a given resource indicates that the resource is available and active, while a STOP event signals resource termination.
Referring to
When a sufficient set of "required" resource definitions have been matched (as indicated by the selection kind 84 b), the application instance transitions from a potential instance to a recognized instance, and transaction recognition activity begins. Transaction recognition activity continues until the "required" resource definitions and qualifier are no longer satisfied, for example due to resource terminations as signaled by STOP events.
Application lifecycle 90 applies to a given application instance 70. Initially, the instance does not exist (stage 90 a). A resource is recognized that does not match an existing resource—for example, perhaps user starts a second copy of a web browser (transition 90 b). Transaction agent 24 creates an object for application instance 70, including a collection of resources. The resource is added to the collection. The application instance 70 is now in a "potential" state (stage 90 c), between creation and full availability.
While the application instance 70 is in its potential state, resources come and go, with at least three possible results. One result is that the instance remains potential (transition 90 d). For example, the application instance 70 may require three resources, only two of which are yet available. Another possible result is that all of the require resources become available, in which case the instance becomes (transition 90 e) an active instance (stage 90 f). A third possible result is that every resource in the collection of resources terminates, causing the instance to move (transition 90 k) to a termination state (stage 90 i). In this case, transaction agent 24 destroys the associated object. Such an instance is an example of a false start.
Once the instance is active (stage 90 f), changes to its resources produce at least two possible outcomes. When resources defined to be "additional" terminate or become available, the instance remains active (transition 90 g). However, when a required resource terminates, the instance also terminates, moving (transition 90 h) to a termination state (stage 90 i).
Transaction Recognition
Referring to
Transaction event object 38 describes the transaction, the related application instance, the time and duration of the transaction, and additional event data describing stages within the transaction, along with time and duration for the stages as well. Transaction event object 38 also includes reporting data such as the module associated with the transaction.
Ruleset Compilation
Referring to
A rule graph for a ruleset has exactly one initial state 92 a (state zero, labeled "0" in
Each arc 92 d has an arc condition 92 e that characterizes the events that the transition accepts. Each arc 92 d also has an arc direction 92 f that specifies the transition from a source state for the arc to a destination state.
Referring to
For the top level of a transaction statement, the starting state is the initial state 92 a, and the ending state is the terminal state 92 b that represents the recognition of the transaction. Ruleset compiler 94 recursively processes the body of the transaction definition—i.e., the rule body block 86—using sub-processes specialized to the particular syntactical construction. These sub-processes include event translation 94 a, choice translation 94 b, sequence translation 94 c, and last translation 94 d. Each such sub-process receives a reference to a starting state, a reference to an ending state, and a syntactical construct of the ruleset (such as an atomic event specification 86 a, shown in
Event translation 94 a translates an atomic event specification 86 a. Event translation 94 a creates an arc between the starting and ending states. The arc condition corresponds to the event source 86 d, event kind 86 e, and parameter list 88 of the event specification.
Choice translation 94 b translates a choice construct 86 g. For each event specification in the choice construct, choice translation 94 b adds to rule graph 92 a separate subgraph between the starting and ending states. Choice translation 94 b recursively invokes sub-processes of ruleset compiler 94 to construct the subgraph as appropriate, depending on the type of event specification. For example, when the event specification is atomic, choice translation 94 b invokes event translation 94 a, passing the same starting and ending states as were passed to choice translation 94 b. When the event specification is a sequence construct (i.e., one nested inside the choice construct), choice translation 94 b invokes sequence translation 94 c. The invoked sub-process can itself recurse, constructing subgraphs within subgraphs.
Sequence translation 94 c translates a sequence construct 86 h. The sequence construct contains an interruptible series of event specifications. For each pair of adjacent event specifications in the series, sequence translation 94 c adds to rule graph 92 a separate subgraph, such that the subgraph connects adjacent states ordered like the adjacent event specifications. Similar to choice translation 94 b, sequence translation 94 c recursively invokes sub-processes of ruleset compiler 94 to construct the subgraph as appropriate, depending on the type of event specification.
Recall that the main body of a transaction rule is an implicit sequence construct 86 g (
Last translation 94 d translates a last construct 86 i. Last translation 94 d adds an intermediate state 92 c to the rule graph 92. The last construct 86 i contains an non-interruptible series of event specifications. For each event specification in the series, last translation 94 d adds a transition from the starting state to the new intermediate state. Last translation 94 d also adds a special "void" transition from the new intermediate state to the ending state, to indicate when the series of matching activity events has ended. The arc for the void transition has a special arc condition 92 e that requires no input. During processing, this void transition is not followed until all of the incoming transitions to the intermediate state have been satisfied.
Referring to
State Machine in Operation
Referring still to
A token 96 represents the progress of a path through the rule graph, from the initial state 92. The path corresponds to a recognized series of events. When a token is placed on a terminal state 92 b, the path represents a series of events that satisfies a transaction. Multiple tokens can be placed on the same rule graph at once, allowing the ruleset engine to track multiple paths simultaneously. In
Referring to
Note that the current token is not normally moved, but a new token is added to the destination state. One reason for this is that the new state may represent a dead-end path, i.e., a transaction that whose pattern is partially matched to the current event stream but which ultimately fails to match. Transaction recognition process 98 leaves original tokens in place as a historical record, to continue evaluating other alternative paths through the graph.
If multiple tokens are added to the same state of the graph, then transaction recognition process 98 discards all but the one representing the potential transaction with the most recent starting time. A later section entitled "TRANSACTION SELECTION" gives further information about tie-breaking procedures in transaction recognition process 98, below.
After adding new tokens, transaction recognition process 98 tests whether any of the destination states is a terminal state (step 98 p). For each such terminal state found (result 98 q), transaction recognition process 98 considers the corresponding transaction recognized (step 98 s). Otherwise, if no tokens were newly placed on terminal states (result 98 r of step 98 p), transaction recognition process 98 loops back to process the next event (step 98 c).
If terminal states are reached for transactions from different alternate ruleset constructs, then transaction recognition process 98 selects a single transaction for reporting from each of the alternate ruleset constructs.
Once a transaction (or set of transactions) is recognized, transaction recognition process 98 purges outstanding tokens from the rule graph (step 98 t), then begins anew to look for the next transaction (step 98 b). The purging of outstanding tokens includes the following operations. For the token located on the initial state, transaction recognition process 98 leaves the token in place. Tokens that have reached terminal states (i.e. recognized transactions) are removed. Tokens located on intermediate states may either be preserved or removed, as follows.
Tokens from a subgraph that represents an alternate ruleset construct in which a transaction was recognized are generally removed from the rule graph. One exception is that tokens just created as a result of transitions from the initial state are preserved. This allows an application activity event that ends a transaction occurrence to also serve as the first event of a new transaction (e.g. window-to-window transitions).
Tokens from other alternate ruleset constructs, in which no transaction was just recognized, are also preserved during purging 98 t. Thus, transaction recognition process 98 evaluates transaction rules from different alternate ruleset constructs independently of each another.
Referring again to
Transaction Selection
It is possible for multiple transactions to be recognized simultaneously as a result of processing a single application activity event. This could be the result of alternate ruleset definitions or of ambiguous transaction rules. When multiple transactions from the same alternate ruleset are recognized, transaction recognition process 98 applies a tie-breaking algorithm to select a single transaction for reporting. First, transaction recognition process 98 discards transactions older than a predetermined threshold. This avoids mixing and matching events from different real transaction occurrences. Next, transaction recognition process 98 gives first preference to the transaction with the most recent starting time. Earlier starting times may represent transactions that were cancelled, and that now only appear to be completing due a mixing of events with the newer transaction occurrence. Third, if two or more transactions share the most recent starting time, transaction recognition process 98 gives preference to the transaction with the most specific transaction rule definition, i.e., the rule with the most state transitions.
By reporting only one of the transactions, transaction recognition process 98 avoids "double-counting" problems. Moreover, this serves as a mechanism to reset the engine and purge the states of incompletely recognized transactions, such as transactions that were not really occurring or were cancelled.
Handling the "Last" Construct
The "last" language construct requires special handling, since the last matching activity event of a series is not known until the subsequent (non-matching) event is received. First, transaction recognition process 98 forms a list of the token transitions that apply to the new event, but does not perform those transitions immediately. Then, if the final event of a series occurred for a "last" construct, transaction recognition process 98 transitions the corresponding token from the intervening state to the final state for the construct. From there, transitions may apply for the new activity event. Finally, transaction recognition process 98 performs all token transitions that match the new activity event.
When the series of matching events has ceased, the single token on the intervening event is copied to the destination state indicated by the special "void" transition and the token on the intervening state is removed. Unlike other transitions, the original token is removed in this case because it cannot represent an alternate evaluation path in the rule graph (i.e., there cannot be another last event in the series).
Object Identifiers
Referring again to
For example, when a user clicks on a button in a window, the operating system adds an event 46 describing the click to the stream. The event 46 includes information about the button, which in the Microsoft Windows model is a form of window. The button has a parent window—perhaps a dialog of a larger application. In this case, the button's parent (the dialog) has a parent of its own (the application window). This chain of parentage forms an object hierarchy for the session, back to some root window object. Every active window object (including controls) has a place within an object hierarchy.
As another example, a raw application event 46 in the Windows messaging stream could represent a window being opened or moving "to the front", i.e., receiving focus. In other words, the messaging stream also includes events that are not tied to user interactions.
Windows hook 28 uses a naming scheme for GUI objects within the Windows object model. The naming scheme helps Windows hook 28 detect similar GUI objects over time. For example, a data entry application might have a form to collect user input. The form includes a save button for saving the form to a database. A different dialog in the application would alert the user that the data saved successfully. The form, the save button, and the dialog would each have a distinct object identifier under the naming scheme. Moreover, when the user opened the form again to submit new data, the second instance of the form—and its accompanying second instance of the save button—would each have object identifiers that matched the first instances. Thus, the object identifiers allow terminal agent 22 to detect recurrent instances of GUI objects. Among other uses, object identifiers offer one way that rulesets 16 can select a particular GUI object—such as form or button—in the rules that characterize transactions.
The name assigned to each GUI object is based in part on stylistic properties of the object and on the object's position within the hierarchy of GUI objects active in the current session. The naming scheme includes a syntax and a process for generating names according to the syntax. In general, the naming scheme has sufficient specificity that, within a given session 26 at a given moment, the scheme uniquely identifies each object. The naming scheme also has sufficient generality over time that when a GUI object comes into being within the session, expires, and later recurs in a second instance, the scheme assigns the same name to both instances of the GUI object. This combination of specificity and generality allows the naming scheme to identify recurrent instances of a GUI object over time.
The naming scheme is based on data that is dynamically available as properties of a raw application event 46 (
The naming scheme for GUI objects is also independent of the human-readable titles that are associated with GUI objects for display. One benefit of this is that a GUI object can be dynamically re-titled (for example, to incorporate the name of a newly-opened file in the title of a window for a word processor application) without affecting the object's identity within the scheme. Also, the scheme is portable between internationally localized versions of the Microsoft Windows. For example, moving from an English version to a French version of Windows would not alter the object identifiers.
Also, the naming scheme is independent of the GUID (globally unique identifier) of windows objects. When a second instance of a window or control recurs after a first instance, the two instances have different GUID's. The GUID's in themselves do not give the two instances a common identifier.
Referring to
OID tag 100 a includes an application name 100 b and properties of a window path 100 c, such as a length 100 d and a checksum 100 e. Application name 100 b is a property of a GUI object as it exists natively within the Microsoft Windows object model, wherein each GUI object is affiliated with an application instance 70 (
Referring to
Referring to
Note that in practice, dynamic styles are excluded from class styles 100 h, window styles 100 i, and extended styles 100 k. By forming OID tags 100 a that are independent of dynamic styles, matches are more likely between different instances of similar objects over time. Different instances of a similar window can vary in their dynamic styles without affecting the object identifier that the naming scheme assigns.
For the most part, the naming scheme has sufficient specificity that, within a given session 26 at a given moment, the scheme uniquely identifies each object. However, one exception to this specificity occurs for objects from simultaneous similar application instances, i.e., ones that share the same application profile. For example, the main window for each instance will have the same application name 100 b and window path 100 c. Thus, each instance will have the same object identifier value.
Here is an example of an application name 100 b and window path 100 c:
The application name has the value MSDEV. The text between the first two backslashes in the example is the derived string property 100 f of a top window: "(AfxWndClass)"-8-cf0000-100-0. This parses into a value of "(AfxWndClass)" [the quote characters are part of the value] for class name, a value of 8 for class style, a value of cf0000 for window styles, a value of 100 for extended styles, and a value of 0 for child identifier. The text contains derived string properties for four other windows. The corresponding OID tag 100 a is:
In this example, the value 165 is the length of the window path, while the value 1322699925 is the checksum.
Referring to
Identifier process 102 receives a reference to a window object described by a raw application event 46 (step 102 a). This window object will be referred to as the "base" window object, as distinct from its parent objects in the object hierarchy. Identifier process 102 creates a window path 100 c for the base window object, beginning with a derived string property 100 f for the base window object (step 102 b). Identifier process 102 iterates up the object hierarchy to the root window object (loop at step 102 through 102 f). For each successive parent, identifier process 102 adds a hyphen delimiter (step 102 d) and a derived string property 100 f for the current parent window (step 102 e) to the front of the window path text. Dynamic styles are excluded from derived string properties 100 f in steps 102 b and 102 e.
After identifier process 102 finishes iterating, window path 100 c is complete. Identifier process 102 calculates the length 100 d of the window path 100 c and a checksum 100 e, then forms an OID tag 100 a according to object identifier syntax 100 (step 102 g).
Studio Application
Referring to
Studio application 18 also provides a debugging process 110 that guides a user through a repeated cycle of testing a ruleset, inspecting the results, and editing the ruleset. Studio application 18 allows the administrator to replay a scripted series of events from an event log repeatedly and identically, producing the same events and timings on each playback. This repeatable playback provides a testing environment in which multiple recognition attempts, based on the ruleset, can each be tested against identical inputs, eliminating uncertainty due to changing or differently-timed user input. Furthermore, once such a script is recorded, repeatable playback automates the process of providing input to the recognition engine, which can save considerable human effort during the iterative development of a ruleset.
Referring to
Next, recording process 104 waits until receiving user input to begin a demonstration time period, which is a time in which the user can demonstrate interactions to be recorded (step 104 c). For example, recording process 104 presents the user with a button to click in the GUI, indicating the beginning of the demonstration.
Recording process 104 concludes the demonstration time period upon receiving user input to that effect (step 104 e). For example, recording process 104 presents the user with a button to click in the GUI to indicate the end of the demonstration. In the interim between steps 104 c and 104 e, recording process 104 designates message objects 104 m from terminal agent 22 for recording (step 104 d). Recording process 104 writes the designated message objects 104 m into an event log 106 in chronological order (step 104 f), then ends.
Referring to
Playback process 108 opens event log 106 at specified position 108 m in the series of log entries. By default, the opening position is the beginning of the series.
Playback process 108 loops through the event log, from the first translation of a message object 104 m (step 108 b) to the last (step 108 e). The last position is given by length 108 n, which is an offset from position 108 m. By default, length 108 n is the full length of the series. For each translation, playback process 108 instantiates a raw application event object 46 (step 108 c) and adds the event object to an event stream, using the timestamp 104 n (step 108 d). More specifically, playback process 108 instantiates an object that implements an interface that acts as raw application event 46.
Playback process 108 directs the stream of instantiated events to a ruleset engine 36 (
Referring to
Debugging process 110 outputs results from ruleset engine 36 of the playback of the event log, such as the recognition of (or failure to recognize) a transaction (step 110 d). In particular, when event log 106 contains a pattern of events that demonstrates a known transaction 80, the results output of step 110 d indicates whether the ruleset 16 causes ruleset engine 36 to recognize the known transaction. In this case, the results of step 110 d indicate the accuracy of the ruleset 16 at recognizing the demonstrated transaction. Alternatively, when ruleset 16 encodes a set of rules that are known to cause ruleset engine 36 to recognize a certain transaction, the results output of step 110 d indicates whether the event log contains a pattern of events that satisfy the transaction.
Debugging process 110 decides whether to edit ruleset 16 by soliciting input from a user (step 110 e). If the ruleset is to be edited (result 110 f), the debugging process provides a user interface, such as a text editing window, for the user to make changes to the ruleset (step 110 h). The user interface includes a control, such as a button, for the user to indicate the changes are complete, at which point debugging process 110 passes the updated ruleset 16 to ruleset engine 36. Otherwise, if the user declines to edit the ruleset (result 110 g), the debugging process bypasses the editing step 110 h.
Debugging process 110 next decides whether to perform another playback of the event log, again by soliciting user input (step 110 k). If the user chooses playback (result 110 m), the debugging process loops back to step 110 c to play at least a portion of the event log using playback process 108 against ruleset engine 36. This allows the user to iterate repeatedly through a cycle of playing a recorded event log, inspecting the results, and modifying the ruleset, for example to improve the ruleset engine's recognition of a transaction demonstrated in the event log.
If the user declines playback (result 110 n), the debugging process decides whether to save ruleset 16 after soliciting user input (step 110 p). If the user chooses (result 110 q), the debugging process saves the ruleset, i.e., commits any changes (step 110 s) before ending; otherwise (result 110 r), debugging process ends without saving the ruleset.
Naming Service and Proxy
Referring to
Monitor server 40 often maintains contact with a transaction agent 24 over continuous timeframes of several days. Over such periods, the logical network address, such as an IP address, of the transaction agent can change. For example, when the configuration of network 52 allows, transaction agent can acquire its IP address via a DHCP (Dynamic Host Configuration Protocol) lease. DHCP is a protocol that allows a node on an IP network to acquire an IP address dynamically, for example from a shared pool of IP addresses, none of which is permanently allocated to nodes. A DHCP server process allocates an IP address to the node using a lease, which specifies a time period during which the allocation is valid. The lease often includes an expiration time, for example 24 or 48 hours after the lease is initiated, depending on the particular policy chosen by network administrators. Under some implementations of DHCP, once the lease expires, a node can renew the lease and retain its IP address, but under other implementations, renewals are not necessarily guaranteed. That is, the request for a renewal can in some cases be denied, resulting instead in the node receiving a lease on a different IP address. Also, again depending again on network policy and implementations, a node that reboots can lose its lease on its logical address. Thus, monitor server 40 can encounter situations in which the logical network address it has been maintaining for a transaction agent 24 becomes invalid or obsolete. Furthermore, although technologies exist for resolving other logical addressing schemes to IP addressing, such as DNS (Domain Name System) or WINS (Windows Internet Naming Service), in the general case, it is possible that such services will not be installed on network 52, or will be inoperative. Moreover, some such technologies (for instance, WINS) are specific to particular operating systems or network protocols, and thus have classes of clients to which they do not extend (for instance, UNIX).
When active, transaction agent 24 gathers batches of updates to send to monitor server 40 and transmits the batches at a minimum rate given by an active interval, for example every five minutes. Administrators 14 a select the active interval to suit the acceptable latency of updates to monitor server 40. A shorter active interval decreases the average delay between the time transaction agent 24 has a piece of information ready to send and the time the information is actually sent. However, over time, a shorter active interval also increases the average number of communications from transaction agent 24 to monitor server 40 over the network.
Transaction agent 24 can be inactive. This inactivity can be a deliberate choice of network administrators. For example, an administrator can install transaction agents 24 on a first number of client devices 30 and only activate the transaction agents 24 on a fraction of the client devices 30. Such a strategy conserves computing resources of monitor server 40, or could conserve the number of software licenses that must be purchased if transaction agent 24 is a commercial product. Alternatively, the inactivity of transaction agent 24 can be accidental, perhaps due to a software problem or a hardware failure.
Referring to
Naming service 44 has a cache table 44 a in which it maintains a latest logical network address for transaction agent 24. Naming service 44 updates cache table 44 a based on the messages sent from proxies 45. In particular, for each transaction agent 24, naming service 44 maintains a cache entry 44 b. Each cache entry 44 b includes an agent key 44 c that uniquely identifies cache entry 44 b within cache table 44 a; an agent address 44 d that stores the last logical network address known to the monitor server for the transaction agent 24; and an agent status 44 e, which stores information about the last transmission received from the transaction agent 24, such as the time of transmission and the interval 116 that was in effect. Naming service 44 periodically checks the status of cache entries 44 b. Naming service 44 can purge a cache entry 44 b, for example after detecting that a sufficiently long time period has elapsed without communication from transaction agent 24 or corresponding proxy 45.
Referring to
If a time period greater than or equal to active interval 116 a has elapsed without sending a transmission of the logical network address to monitor server 40 (result 114 f), heartbeat process 114 sends a message to naming service 44, describing the current logical network address (step 114 h). Otherwise (result 114 g), heartbeat process 114 loops back to step 114 a, repeating indefinitely.
If the transaction agent 24 that corresponds to proxy 45 is inactive (result 114 c), heartbeat process 114 sends a message to naming service 44, describing the current logical network address, approximately at an inactive interval 116 b (step 114 e). Here too, heartbeat process 114 loops back to step 114 a, repeating indefinitely.
By default, inactive interval 116 b is six hours. Administrators 14 a can change the values of active interval 116 a and inactive interval 116 b. Typically, however, inactive interval 116 b is greater than active interval 116 a, so that the overall rate of messages from proxy 45 is lower when transaction agent 24 is inactive.
Proxy 45 is installed on client device 30 such that proxy 45 runs automatically as part of the boot procedure of client device 30. Thus, as client machine powers up after a shutdown, proxy 45 activates heartbeat process 114. Similarly, proxy 45 also runs if client device 30 reboots. In general, proxy 45 is active whenever client device 30 is operational, regardless of the status of transaction agent 24.
Monitor server 40 has a static logical network address. Proxy 45 and transaction agent 24 are given this address as a parameter during installation and store it persistently on client device 30.
Pathset Aggregation
Monitoring system 40 provides data to analytical software (not shown) that detects alarm conditions for a network service or application by generating baseline statistical profiles of the service, then raising alarms when measured performance deviates from the profiles. The analytical software operates in approximately real-time, for example, with delays of zero to 5, 10, or 20 minutes. Such short time frames are important to administrators 14 a, for instance, who often have professional responsibility for the operation of the service, application, or underlying network. One challenge to the performance of such systems is that they require a statistically significant amount of data to occur within the window of detection time, in order that the deviation can be predicted with good statistical confidence. If the sample is too sparse, statistical models fail. What is more, the window of detection time often cannot be enlarged enough to compensate for sparse sample streams while still offering real-time or near-real-time alarms.
Data streams from events driven by individual human users can be sparse. As a particular user 14 interacts with a client device, engaging in operations that generate transactions to be sent to monitor server 40, the average rate of transactions performed can be quite variable. For example, activity rates can depend upon the user, the type of transaction, and contextual factors such as the time of day. A given client device may go through periods of idleness for several minutes, hours, or even days if the user is away. By the time a single user generates enough activity to characterize a problem condition, the problem may be several hours hold. Also, intermittent problems, such as network traffic blockages, might occur and disappear so rapidly that the detection window on a sparse data stream would not detect them.
Referring to
Pathset aggregation data 118 also stores client sets 118 e, which are collections of clients, for instance grouped by physical proximity or by function. Thus, a client set could represent a collection of client devices 30 at a branch office, or all the client devices 30 in a marketing department of a corporation. Client sets are customizable. Administrators 14 a define their semantic meaning and associate each client record 118 b with a client set 118 e.
Pathset aggregation data 118 also keeps module records 118 f that describe predetermined types of activities between clients and servers over the network. For instance, one module record 118 f could specify email traffic, while another specifies DNS services and a third specifies a database application. Module records 118 f correspond to values referenced by the "module" portion of transaction statement 20 c (
In addition, pathset aggregation data 118 stores pathset records 118 g. A pathset record 118 g collects aggregate responsiveness data based on a client set and a module. In particular, a pathset record 118 g includes a collection of responsiveness samples 118 h; a client set reference 118 k that specifies a client set 118 e; and a module reference 118 m that specifies a module record 118 f. The responsiveness samples 118 h collect response data from transaction event objects 38.
Referring to
Periodically, monitor server 40 passes responsiveness samples 118 h of the pathset records 118 g to the analytical software for reporting and alarming, for example by writing a file out to shared storage and by sending a message to the analytical software that the file is available for retrieval. The aggregation of transaction statistics according to client set and module provides a sample for a statistical baseline profile of service to clients—in particular, to clients in the client set that consume services of the type described by the module. Moreover, the aggregate data stream for multiple clients is less sparse than the data streams for the clients individually, allowing more rapid detection of deviations from the profile.
Referring to
It should be understood that the above-described functionality is implemented on one or more digital processors programmed appropriately. These one or more digital processors have whatever input and output interfaces and devices are required to implement the described functionality (including keyboards, display units, modems, cable interfaces) and they include data storage, both internal and external, for storing the program and the data that are discussed herein.
Also a number of embodiments of the invention have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. For example, in described embodiments, operating system 13 is a member of Microsoft's Windows family, for example Windows 98. In alternative embodiments, operating system 13 could belong to another operating system family, for example Macintosh or Unix, including Linux. Furthermore, client device 30 could be a device other than a traditional personal computer, for example a handheld device or cell phone, with a correspondingly adapted operating system 13. Accordingly, other embodiments are within the scope of the following claims.
|Cited Patent
|Filing date
|Publication date
|Oct 29, 1999
|Sep 18, 2001
|International Business Machines Corporation
|Method and apparatus in a data processing system for systematically serializing complex data structures
|Apr 14, 1999
|Nov 13, 2001
|Harold Herman Trebes, Jr.
|System and method for providing peer-oriented control of telecommunications services
|Feb 2, 2001
|Sep 17, 2002
|Logis-Tech Corporation
|Environmental stabilization system and method for maintenance and inventory
|Aug 31, 1999
|Dec 9, 2003
|Accenture Llp
|Managing information in an integrated development architecture framework
|Jun 30, 2000
|Dec 16, 2003
|Hi/Fn, Inc.
|Processing protocol specific information in packets specified by a protocol description language
|Nov 3, 2003
|Nov 4, 2004
|Roletto Massimiliano Antonio
|Aggregator for connection based anomaly detection
|Citing Patent
|Filing date
|Publication date
|Jan 16, 2005
|Apr 28, 2009
|Computer Associates Think, Inc.
|Methods and apparatus for information processing and display for network management
|Nov 24, 2009
|International Business Machines Corporation
|Performance evaluation of a network-based application
|Feb 14, 2007
|May 4, 2010
|Xilinx, Inc.
|Self aligning state machine
|Feb 14, 2007
|May 18, 2010
|Xilinx, Inc.
|Performance monitors (PMs) for measuring performance in a system and providing a record of transactions performed
|Mar 22, 2011
|Xilinx, Inc.
|Port interface modules (PIMs) in a multi-port memory controller (MPMC)
|Sep 5, 2008
|Apr 5, 2011
|Computer Associates Think, Inc.
|System and method for remote network management over unreliable and/or low-bandwidth communications links
|May 17, 2011
|Progress Software Corporation
|Non-intrusive event capturing for event processing analysis
|Apr 27, 2009
|Jun 14, 2011
|Computer Associates Think, Inc.
|Methods and apparatus for information processing and display for network management
|Jun 21, 2011
|Southern Company Services, Inc.
|Load balancing port proxy for dynamically controlling routing of query requests
|Apr 20, 2007
|Aug 30, 2011
|Sysmex Corporation
|Quality control system and quality control information delivery device
|Jun 25, 2004
|Apr 17, 2012
|Apple Inc.
|Method and apparatus for facilitating long-lived DNS queries
|Apr 15, 2009
|Aug 7, 2012
|Time Warner Cable, Inc.
|System and method for affecting the behavior of a network device in a cable network
|Nov 19, 2009
|Oct 23, 2012
|Sap Ag
|Intelligent event query publish and subscribe system
|Nov 7, 2009
|Nov 13, 2012
|Harris Technology, Llc
|Address sharing network
|Nov 20, 2012
|International Business Machines Corporation
|Efficient management of customized functionality within shared data objects
|Apr 26, 2010
|Feb 12, 2013
|International Business Machines Corporation
|Generating unique identifiers
|Apr 2, 2013
|Harris Technology, Llc
|Address sharing network
|Jun 18, 2013
|Knoa Software, Inc.
|Generic, multi-instance method and GUI detection system for tracking and monitoring computer applications
|Feb 14, 2007
|Jul 2, 2013
|Xilinx, Inc.
|Graphical user interface (GUI) including input files with information that determines representation of subsequent content displayed by the GUI
|Nov 19, 2009
|Sep 17, 2013
|Sap Ag
|Stream sharing for event data within an enterprise network
|Jun 27, 2010
|Oct 15, 2013
|International Business Machines Corporation
|Allocating unique identifiers using metadata
|Dec 14, 2010
|May 13, 2014
|Seeker Security Ltd.
|Method and system of runtime analysis
|Oct 22, 2012
|Feb 24, 2015
|Sap Se
|Intelligent event query publish and subscribe system
|Sep 12, 2008
|Mar 17, 2015
|International Business Machines Corporation
|Process management using representation state transfer architecture
|Aug 31, 2006
|May 5, 2015
|Oracle America, Inc.
|Using method-profiling to dynamically tune a virtual machine for responsiveness
|Jun 30, 2006
|May 19, 2015
|Ricoh Company, Ltd.
|Information processing apparatus, information processing system, message control method, and program product, storage medium
|May 12, 2014
|May 26, 2015
|Seeker Security Ltd.
|Method and system of runtime analysis
|Oct 6, 2010
|Aug 25, 2015
|Hewlett-Packard Development Company, L.P.
|Method and system for processing events
|Dec 14, 2010
|Mar 8, 2016
|Synopsys, Inc.
|Methods and systems of detecting and analyzing correlated operations in a common storage
|Mar 23, 2013
|May 31, 2016
|Microsoft Technology Licensing, Llc
|Stepping and application state viewing between points
|Sep 23, 2011
|Jul 12, 2016
|Microsoft Technology Licensing, Llc.
|Monitoring the responsiveness of a user interface
|Jun 25, 2004
|Jan 12, 2006
|Sekar Kiren R
|Method and apparatus for facilitating long-lived DNS queries
|Jul 26, 2004
|Jan 26, 2006
|Septon Daven W
|Monitoring a license proxy
|Jan 16, 2005
|Feb 9, 2006
|Booman Gordon A
|Methods and apparatus for information processing and display for network
|Jun 30, 2006
|Jan 4, 2007
|Yuki Ishibashi
|Information processing apparatus, information processing system, message control method, and program product, storage medium
|Sep 9, 2005
|Mar 15, 2007
|International Business Machines Corporation
|Performance evaluation of a network-based application
|Apr 20, 2007
|Jan 24, 2008
|Tadayuki Yamaguchi
|Quality control system and quality control information delivery device
|Mar 21, 2008
|Oct 2, 2008
|Lovas Louis R
|Non-intrusive event capturing for event processing analysis
|Apr 15, 2009
|Aug 6, 2009
|Andrew Danforth
|System and Method for Affecting the Behavior of a Network Device in a Cable Network
|Feb 18, 2010
|Mcclements Scott M
|Efficient management of customized functionality within shared data objects
|Mar 11, 2010
|Computer Associates Think, Inc.
|System and method for remote network management over unreliable and/or low-bandwidth communications links
|Mar 18, 2010
|Pankaj Dhoolia
|Process Management Using Representation State Transfer Architecture
|Nov 19, 2009
|May 20, 2010
|Sap Ag
|Intelligent event query publish and subscribe system
|Apr 27, 2009
|Jul 15, 2010
|Gordon Andrew Booman
|Methods and apparatus for information processing and display for network management
|May 12, 2011
|Harris Technology, Llc
|Address Sharing Network
|Jun 27, 2010
|Dec 29, 2011
|International Business Machines Corporation
|Allocating unique identifiers
|Nov 17, 2011
|Mar 15, 2012
|Knoa Software, Inc.
|Generic, multi-instance method and gui detection system for tracking and monitoring computer applications
|Feb 22, 2011
|Dec 6, 2012
|Thoughtwire Holdings Corp.
|Method and System for Managing the Lifetime of Semantically-Identified Data
|Oct 6, 2010
|Jun 6, 2013
|David W. Birdsall
|Method and system for processing events
|Mar 23, 2013
|Aug 22, 2013
|Microsoft Corporation
|Stepping and application state viewing between points
|Mar 24, 2014
|Sep 30, 2015
|Pingdom AB
|Method, server and agent for monitoring user interaction patterns
|Dec 14, 2010
|Jun 23, 2011
|Seeker Security Ltd.
|Methods and systems of detecting and analyzing correlated operations in a common storage
|Sep 29, 2014
|Feb 25, 2016
|주식회사 앤벗
|Device and method for generating screen movement graph for application
|U.S. Classification
|International Classification
|Cooperative Classification
|European Classification
|Jun 4, 2004
Owner name: CONCORD COMMUNICATIONS, INC., MASSACHUSETTS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:FERNANDEZ, GARY;KANE, KEN;PERRET, PIERRE;AND OTHERS;REEL/FRAME:014696/0191;SIGNING DATES FROM 20040410 TO 20040517
|Mar 22, 2007
Owner name: COMPUTER ASSOCIATES THINK, INC., NEW YORK
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CONCORD COMMUNICATIONS, INC.;REEL/FRAME:019047/0414
Effective date: 20070208
Owner name: COMPUTER ASSOCIATES THINK, INC.,NEW YORK
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CONCORD COMMUNICATIONS, INC.;REEL/FRAME:019047/0414
Effective date: 20070208
|Dec 2, 2009
|Fee payment
Year of fee payment: 4
|Dec 4, 2013
|Fee payment
Year of fee payment: 8


text:
Remove Ads x
João Mineiro e Marciano - As 20 Mais - download at 4shared. João Mineiro e Marciano - As 20 Mais is hosted at free file sharing service 4shared.
| Uploaded via: 4shared site
Share Add to my account
Is owner
View only
Upload & Edit
Members may only view items in this folder.
Members may view, add, edit and delete items in this folder.
Checked by McAfee. No virus detected.
76 comments Add new comment View all
Wrong code entered. Please, try again.
Enter the code above to post message:
robertoniklos 1 month ago Reply Spam SpamCancel
chamnan R. 3 months ago Reply Spam SpamCancel
mateusdealmei... 6 months ago Reply Spam SpamCancel
de marte essa foi boa kkkkk
nathanmeiolok... 11 months ago Reply Spam SpamCancel
joa mineiro veio de minas e o marciano de onde??
Remove Ads x
Download all files from this folder
Download folder as:
This file will be created in your 4shared folder
File name:
Zip as:
Download as B1
João Mineiro e Marciano - As 20 Mais.rarFile QR Code

subset: commoncrawl


text:
Home Concert Tickets Rap/Hip-Hop/Reggae Wiz Khalifa
Wiz Khalifa Tickets
Find the Wiz Khalifa tickets you're looking for on NME ticket exchange, the world's largest ticket marketplace. Select an event to view the range of tickets available or view the Wiz Khalifa tour dates to find an upcoming event near you. You can also sell your spare Wiz Khalifa Concert Tickets on NME ticket exchange, and listing tickets is free. All Wiz Khalifa tickets are covered by the NME ticket exchange Ticket guarantee!
Selling fast!
|Auburn, Washington, USA White River Amphitheatre Snoop Dogg & Wiz Khalifa
|We have 671 tickets available
|From £22.44
More Results
0 remaining
Can't find the event you're looking for? Tell us about it!


text:
A box, with a mass or 10 kg is stationary on a horisontalsurface. The coefficient of static friction is 0.50 and thecoefficient of kinetic friction is 0.40.
A man exerts a force of 20N horizontally on the box.
What is the frictional force on the box from thesurface?
What is the acceleration of the box?


text: Upcoming Postgraduate Events Below you will find the list of forthcoming postgraduate recruitment fairs in the UK and EU that a member of University staff will be attending over the coming months, together with information about upcoming postgraduate study events that we will be hosting on our campus. Members of University staff also attend numerous exhibitions and events around the world. Find out when we will be visiting your country. Forthcoming events Naturejobs Career Expo 2016 16Sep QS World Grad School Tour Paris 2016 8Oct QS World Grad School Tour Copenhagen 2016 13Oct QS World Grad School Tour Milan 2016 18Oct QS World Grad School Tour Sofia 2016 22Oct FindAPhD Live, Cambridge 25Oct Postgraduate Study Fair by The Careers Group 26Oct FindAPhD Live, Oxford 27Oct Russell Group Postgraduate Roadshow, Edinburgh 31Oct Russell Group Postgraduate Roadshow, Warwick 1Nov Russell Group Postgraduate Roadshow, Newcastle 2Nov QS World Grad School Tour Thessaloniki 2016 2Nov Russell Group Postgraduate Roadshow, Nottingham 3Nov QS World Grad School Tour Athens 2016 3Nov Russell Group Postgraduate Roadshow, York 4Nov National Graduate Recruitment Exhibition, Birmingham 4Nov Postgraduate Study Fair, Manchester 16Nov Master and More Study Fair Stuttgart 18Nov The National Engineering & Construction Recruitment Exhibition, Birmingham 25Nov Psychology 4 Graduates Exhibition 30Nov PostgraduateStudentships PhD Funding Fair 6Dec Master and More Study Fair Münster 14Jan FindAMasters and FindAPhD Postgraduate Study Fair, Birmingham 18Jan Master and More Study Fair Munich 20Jan Postgraduate Study Fair, Bristol 24Jan Postgraduate Study Fair by The Careers Group 25Jan Postgraduate Study Fair, Sheffield 8Feb


text:
Remove Ads x
eboostr 4 full with crack - download at 4shared. eboostr 4 full with crack is hosted at free file sharing service 4shared.
Share Add to my account
Is owner
View only
Upload & Edit
Members may only view items in this folder.
Members may view, add, edit and delete items in this folder.
Checked by McAfee. No virus detected.
20 comments Add new comment View all
Wrong code entered. Please, try again.
Enter the code above to post message:
yassino N. 2 years ago Reply Spam SpamCancel
When you add crack..
is still a demo..
but the chrono is gone.
i dont know if that means is full.
Remove Ads x
Download all files from this folder
Download folder as:
This file will be created in your 4shared folder
File name:
Zip as:
Download as B1
eboostr 4 full with crack.rarFile QR Code


text:
- Intex Auto Pool Cleaner $74.99
- Intex 12' x 36" Easy Set Pool w/ Cartridge Filter Pump OUT OF STOCK SALE
- Intex Deluxe Pool Cover from $56.99
- Skimmer Basket $4.99
- Intex 36" Neon Frost Pool Tube $4.99
- Intex Surf 'n Slide Play Center OUT OF STOCK
- Intex Round Solar Cover from $14.99
- 4 oz. Vinyl Repair Kit $9.99
- Intex Windmill Blow Spray Play Center $49.99
- Swimming Pool Waterfall Fountain $19.99
- Intex "Type H" Filter Cartridge $3.99
- Intex 2500 GPH Cartridge Filter Pump $129.99
We also have an extensive verity of outdoor furniture from table sets to umbrellas, gazebos, and Weber grills.
There are so many products and technological advances in pool care these days, it can often be difficult to decide exactly what your pool requires. You can trust us, as your one stop shop, to help you sort through unnecessary products and select exactly what you need. Our experienced sales staff can help you by offering sound advice and assist you in making selections from our inventory of high-quality items.
At State Fair Seasons, we are ready to provide quality products and dependable service to our customers. We are proud of our reputation for excellence and look forward to continuing to serve the community with high-quality pool supplies and service. Contact us today to learn more about our products and services.


text:
I'm trying to get a javascript to work... the script needs to be in the body.
This scripts is an aweber personalization script... when somebody fills out the subscription form the thank you page displays their name...
I've put this script in the header under the body tag... right about the form...at the end of the form... I put in the footer above the body tag...
It's won't work (script works on non-wordpress sites)
I read this
In the spot where you wish to use the Javascript, set the call for the Javascript. For example, you are using a Javascript that sets a link for users to "email this page" to a friend and you want it to be under the post title. It might look like this:

" rel="bookmark">
<?php the_title(); ?>


text:
The Association for the Advancement of Creative Musicians is one of the
oldest non-profit
music organizations in the United States devoted to the presentation and performance of contemporary music. The year 2015 concluded a successful 50th anniversary celebration, we
are thankful to be privileged with the opportunity to present and perform contemporary music
as our journey continues.
AACM member Henry Threadgill is the 2016 Pulitzer Prize Winner in Music.
The AACM New York extends our heartfelt congratulations.
More Informations here:
AACM member Thurman Barker has just been awarded a promotion to full professor
of music at Bard College. Mr. Barker has expanded the jazz program at Bard College
since his appointment in 1993. Mr. Barker continues his close association with the AACM
and his commitment to creating new music. CONGRATULATIONS THURMAN BARKER!
AACM Co-founder and AACM New York President Muhal Richard Abrams #DDArtist
has a NEW WEBSITE! www.muhalrichardabrams.com (click Links)
You can also donate by check or money order payable to: AACM New York Chapter, Inc. Send to: AACM New York Chapter, Inc. P.O. Box 187, Times Square Station, New York, NY, 10108-0187
$25,398.00! Friends, Thank You! In honor of our 50th Anniversary, we appreciate you helping the AACM New York City Chapter, Inc. meet the Robert D. Bielecki Foundation $25,000.00 matching grant. We are encouraged by your continued dedication and support. All donations to the AACM New York City Chapter, Inc. helps us to continue bringing you New Music for years to come.
The AACM NYC thanks you for your donations and comments. Click here
View AACM concert posters 1965-1975 from our archive. Visit our Gallery.
Check out these recent releases by AACM members and associates.
Henry Threadgill - Old Locks and Irregular Verbs
Adegoke Steve Colson - Tones For
Harriet Tubman - Sojourner Truth - Frederick Douglass
Vijay Iyer and Wadada Leo Smith
A Cosmic Rhythm With Each Stroke


text:
- Report: #892935
Report - Rebuttal - Arbitrate
Complaint Review: Speedway Coin Laundry
Speedway Coin Laundry3707 Speedway Austin, Texas United States of America
Speedway Coin Laundry Babu Mohmad, Speedway Grocery and Coin Laundry Laundry Service Destroyed $500 of clothes with no compensation Austin, Texas
Ripoff Report
About you?
Ripoff Report
A business' first
line of defense
on the Internet.
If your business is
willing to make a
commitment to
customer satisfaction
Click here now..
Does your business have a bad reputation?
Fix it the right way.
Corporate Advocacy Program™
My clothes were burned badly by malfunctioning drier. Owner refuses to compensate.
I went to Speedway Coin Laundry to wash clothes on Saturday June 2, 2012. After washing a load of clothes I put them in a drier for 20 minutes. About 15 minutes in I smelled something burning, so I checked my clothes and the entire load was burnt and smoke was coming from the drier. This place could have burned down if I would have left to run errands. This drier literally burned all of my dark clothes and am a college student.
Once my clothes cooled down I took them out and went to show them to the sale associate that worked there and he told me to see the manager when he comes by later Saturday evening. I asked for the managers number to contact him about what just happened, but he would not give me his number. So I stopped by again that evening the manager was not there and I was told he would be back Sunday, June 3, 2012, evening. [continued below]....
I stopped by again June 3, 2012 in the evening and the manager still was not there. I felt like he was avoiding me. I stopped by again for a third time Monday June 4, 2012 and the manager Babu Mohmad was there. I calmly explained my situation that one of his driers was malfunctioning and damaged my clothes by burning them. He said there was nothing he could do because it was not the day of. He told me to leave and pushed me out of his way.
In summary I attempted to contact the manager, Babu Mohmad, 4 times. It took 3 days for me to reach him and when I did all Babu said he would not compensate me because it had happened 3 day ago. Beware of this grocery store and laundry mat the owner is a jerk and not responsible for his own business.
This report was posted on Ripoff Report on 06/04/2012 06:19 PM and is a permanent record located here: http://www.ripoffreport.com/r/Speedway-Coin-Laundry/Austin-Texas-78705/Speedway-Coin-Laundry-Babu-Mohmad-Speedway-Grocery-and-Coin-Laundry-Laundry-Service-Destr-892935. The posting time indicated is Arizona local time. Arizona does not observe daylight savings so the post time may be Mountain or Pacific depending on the time of year.
Ripoff Report has an exclusive license to this report. It may not be copied without the written permission of Ripoff Report.
Click Here to read other Ripoff Reports on Speedway Coin Laundry
If you would like to see more Rip-off Reports on this company/individual, search here:Search Tips
In order to assure the best results in your search:
- Keep the name short & simple, and try different variations of the name.
- Do not include ".com", "S", "Inc.", "Corp", or "LLC" at the end of the Company name.
- Use only the first/main part of a name to get best results.
- Only search one name at a time if Company has many AKA's.
Advertisers above have met our
strict standards for business conduct.


text:
|09 Jan 2010
No keyboard while running 7
I recently installed windows 7 on my desktop. During boot up I can use my keyboard, but once windows loads the keyboard is unresponsive.
I've tried a wireless and wired keyboard. I also have a wireless keyboard and mouse combo in which the mouse still works but still no keys.
Any ideas to what the issue is very appritiated.
|My System Specs
|09 Jan 2010
Windows 7 Professional x64
I recently installed windows 7 on my desktop. During boot up I can use my keyboard, but once windows loads the keyboard is unresponsive.
I've tried a wireless and wired keyboard. I also have a wireless keyboard and mouse combo in which the mouse still works but still no keys.
Any ideas to what the issue is very appritiated.
Was the keyboard working before the install? Was it upgrade or clean?
When you say it works before Windows loads, do you mean it works in the BIOS?
These are questions we will need answered before too much help.
It may need a BIOS update.
More likely it may need a driver. You can set Windows to install drivers automatically. (if you can get a keyboard to work)
You may also try safe mode and see if it works.
|My System Specs
|10 Jan 2010
Win7 x64 + x86
Start...All Programs...Accessories...Ease of Access...On Screen Keyboard
It's a pain to use - but it's less painful than not having a keyboard!
I believe that you can use it from the logon screen (if needed) by clicking on an icon in the lower right corner.
Right click on Computer in the Start menu, then select "Manage"
Then select "Device Manager" in the left hand pane of the window that opens up.
Anything have problems listed there?
|My System Specs
|10 Jan 2010
Was the keyboard working before the install? Was it upgrade or clean?
When you say it works before Windows loads, do you mean it works in the BIOS?
I've also ran it in safe mode, and the keyboard is not responsive.
|My System Specs
|30 Jan 2010
Windows 7
No suggestions, just came in here with the exact same issue-USB Keyboard will work in BIOS, but not work in Windows 7 randomly. Will also stop working if I wake the computer out of sleep mode. Drivers are up to date.
Keyboard is a Kensington Keyboard for life-nothing fancy, and worked normally in Windows Vista last week.
|My System Specs
|08 Feb 2012
64 bit - Windows 7 Ultimate
I have a issue but the other way around.... I can not access Bios or press any key but I can use my keyboard 100% once the OS is up and running.
I also have a Win 7 machine... was working last week but has stopped which is odd
|My System Specs
|Thread Tools
|Similar help and support threads
Black screen, keyboard & mouse not working and fans still running.
CPU: AMD FX 8350 Mobo: Asus Sabertooth 990FX R.2.0 GPU: EVGA GTX 660 2GB SC PSU: Corsair CX600M RAM: G.SKILL Sniper 1600Mhz 2x4GB It happened while I was playing BF3, my screen suddenly went black and it says no VGA input, I tried turning off the computer by holding down the power button but...
|Hardware & Devices
HP 6820ea - non responsive trackpad and keyboard when running hot
Hi all, I've been passed a HP 6820ea laptop to repair which is suffering with the trackpad and keyboard becoming non responsive when running hot or when i use for prolonged periods. I've advised the client to look at a replacement but he wants to keep the laptop running due to accountancy...
|Hardware & Devices
Keyboard making sounds, won't repeat keystrokes - cat sat on keyboard!
Please help, my cat sat on my keyboard this morning and turned something on - it was a Flash keys option I think (or Filter Keys?) - couldn't really see around her. :confused: I now have noises each time I press a key and am not able to repeat keys easily - only one stroke per key is allowed at a...
|Hardware & Devices
Keyboard won't work until OS Win 7 is fully up and running
Anyone know of a fix for this problem? I can use my keyboard in my OS fine but trying to go into safe boot or Bios is not possible because the keyboard is not showing up. Really would love some help so if someone with a similar issue in the past could please help that would be great.
|Hardware & Devices
BSOD while running Final Fantasy XIV and using Zune via G19 keyboard
I'm running Win7 Ultimate (64-bit), been installed all of 3 weeks now as I had to reformat and reinstall recently. The whole set up was built February 2011. My specs are all filled in as well as I know them. Has BSOD twice now, in as many days, when running Final Fantasy XIV (Which is what this...
|BSOD Help and Support
Keyboard - Shift & Alt keys stopped working for keyboard shortcuts
As I wrote in the title, my Shift and Alt keys stopped working for keyboard shortcuts. However, the Shift key still works when capitalizing letters. I've been dealing with this problem off/on for the past two weeks and haven't been able to figure it out. I've gone into Ease of Access features...
|Hardware & Devices
|Our Sites
|Site Links
|About Us
|Find Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd
All times are GMT -5. The time now is 14:09.