Flowlet resolution for application performance monitoring and management

A system comprising:

• one or more processors;
• and
• memory including instructions that, upon being executed by the one or more processors, cause the system to:
• capture first telemetry over a first period of time from at least a first server and a first network device of a network;
• determine a plurality of nodes of an application dependency map associated with the first telemetry by concatenating server features and process features;
• determine a plurality of edges of the application dependency map based on the first telemetry comprising flow information indicative of one or more flows between pairs of nodes of the plurality of nodes;
• determine a first feature vector for a first node of the plurality of nodes;
• determine a cluster comprising the first node and a second node of the plurality of nodes in the application dependency map based on a similarity metric between the first feature vector and a second feature vector of the second node satisfying a similarity threshold;
• determine, based on the application dependency map, a first plurality of flowlets for at least one flow generated by the first server and including the first network device as a hop;
• determine a baseline metric for at least one first flowlet of the first plurality of flowlets;
• determine at least one anomalous flowlet by comparing the baseline metric to a corresponding metric of at least one second flowlet associated with second telemetry captured over a second period of time from at least the first server and the first network device;
• determine that the at least one anomalous flowlet was processed by both the first server and a second server;
• and
• migrate, based on determining that the at least one anomalous flowlet was processed by both the first server and the second server, the first server from a first location to a second location, wherein the migrating reduces a distance between the first server and a third location of the second server of the network associated with the at least one anomalous flowlet, the second location being different than the third location.

A non-transitory computer-readable medium having instructions that, upon being executed by one or more processors, cause the one or more processors to:

• capture first telemetry over a first period of time from at least a first server and a first network device of a network;
• determine a plurality of nodes of an application dependency map associated with the first telemetry by concatenating server features and process features;
• determine a plurality of edges of the application dependency map based on the first telemetry comprising flow information indicative of one or more flows between pairs of nodes of the plurality of nodes;
• determine a first feature vector for a first node of the plurality of nodes;
• determine a cluster comprising the first node and a second node of the plurality of nodes in the application dependency map based on a similarity metric between the first feature vector and a second feature vector of the second node satisfying a similarity threshold;
• determine, based on the application dependency map, a first plurality of flowlets for at least one flow generated by the first server and including the first network device as a hop;
• determine a baseline metric for at least one first flowlet of the first plurality of flowlets;
• determine at least one anomalous flowlet by comparing the baseline metric to a corresponding metric of at least one second flowlet associated with second telemetry captured over a second period of time from at least the first server and the first network device;
• determine that the at least one anomalous flowlet was processed by both the first server and a second server;
• and
• migrate, based on determining that the at least one anomalous flowlet processed by both the first server and the second server, the first server from a first location to a second location, wherein the migrating reduces a distance between the first server and a third location of the second server of the network associated with the at least one anomalous flowlet, the second location being different than the third location.