Detecting and analyzing performance anomalies of client-server based applications

A computer program product, comprising:

• a computer-readable storage device;
• and
• a computer-readable program code stored in the computer-readable storage device, the computer-readable program code containing instructions that are executed by a central processing unit (CPU) of a computer system to implement a method of detecting and analyzing an anomaly in a performance of an application in a connection between client and server computers, the method comprising:
• the computer system determining a status code of a response from the server computer and determining that the status code is a Hypertext Transfer Protocol (HTTP) status code of 500 through 599, which indicates the server computer did not properly perform a function in response to a request from the client computer executing the application, the response being sent by the server computer to the client computer via a communications network and responsive to the request;
• the computer system determining that the connection timed out in response to the server computer not responding to the request within a predetermined time period;
• the computer system calculating values of a round trip latency time (RTT) for multiple client computers having application sessions with the server computer, the values of the RTT including a value of a RTT of the response;
• the computer system dividing a space of the values of the RTT into buckets of RTT values, the buckets having a fixed size;
• the computer system computing running counts and means for the values of the RTT in each bucket;
• the computer system maintaining a boundary value that determines which buckets are in a lower value cluster C1 employed by a k-means clustering algorithm and which other buckets are in a higher value cluster C2 employed by the k-means clustering algorithm, wherein k=2;
• the computer system determining the buckets whose RTT values include respective values of the RTT, assigning the values of the RTT to the respective buckets, re-computing the counts and means for each bucket, and balancing C1 and C2 to ensure that (i) values in C1 are closer to a mean μ1 of C1 and (ii) values in C2 are closer to a mean μ2 of C2;
• the computer system computing μ1 of C1, a standard deviation σ1 of C1, μ2 of C2, and a standard deviation σ2 of C2;
• the computer system computing a threshold value as μ2+2σ2 if μ1+σ1≥μ2 or as μ1+2σ1 if μ1+σ1<μ2;
• the computer system determining that the value of the RTT of the response exceeds the threshold value;
• based on the status code of the response being the HTTP status code of 500 through 599, the value of the RTT exceeding the threshold value, and the connection having timed out in response to the server computer not responding to the request within the predetermined time period, the computer system detecting the anomaly in the performance of the application;
• and
• based on a temporal analysis and textual analysis of log entries associated with the anomaly, and based on an environment analysis that determines activity of the client computer, the server computer, and the communications network, the computer system determining candidate root causes of a failure that resulted in the anomaly, the failure being in the client computer, the server computer, the communications network, or a combination of the client computer, the server computer, and the communications network;
• the computer system sending an alert to a user via a graphical user interface dashboard, the alert describing the anomaly;
• the computer system collecting attributes of the anomaly and sending the attributes to a machine learning process, the attributes including the RTT, the indication of whether the connection timed out a delay value of the connection, details of the server computer and the application, details about a function specified by the request, and a uniform resource locator of the server computer;
• in response to the alert, the computer system receiving feedback from the user about whether the anomaly was correctly detected or incorrectly detected;
• the first computer utilizing the feedback as a label of the machine learning process;
• based on the collected attributes, the feedback, and the label, the computer system training a machine learning model for the machine learning process, the machine learning model including rules specifying subsequent anomalies in the performance of the application;
• the computer system detecting a subsequent anomaly in the performance of the application, the subsequent anomaly resulting in an outage in a network link, router, or switch in the communications network, which results in a disconnection between the client computer and the server computer;
• the computer system determining that the subsequent anomaly is correctly detected based on the trained machine learning model;
• and
• based on the subsequent anomaly being determined to be correctly detected based on the trained machine learning model, the first computer repairing the outage in the network link, the router, or the switch, which reconnects the client computer and the server computer via the communications network.

A computer system comprising:

• a central processing unit (CPU);
• a memory coupled to the CPU;
• and
• a computer readable storage device coupled to the CPU, the storage device containing instructions that are executed by the CPU via the memory to implement a method of detecting and analyzing an anomaly in a performance of an application in a connection between client and server computers, the method comprising:
• the computer system determining a status code of a response from the server computer and determining that the status code is a Hypertext Transfer Protocol (HTTP) status code of 500 through 599, which indicates the server computer did not properly perform a function in response to a request from the client computer executing the application, the response being sent by the server computer to the client computer via a communications network and responsive to the request;
• the computer system determining that the connection timed out in response to the server computer not responding to the request within a predetermined time period;
• the computer system calculating values of a round trip latency time (RTT) for multiple client computers having application sessions with the server computer, the values of the RTT including a value of a RTT of the response;
• the computer system dividing a space of the values of the RTT into buckets of RTT values, the buckets having a fixed size;
• the computer system computing running counts and means for the values of the RTT in each bucket;
• the computer system maintaining a boundary value that determines which buckets are in a lower value cluster C1 employed by a k-means clustering algorithm and which other buckets are in a higher value cluster C2 employed by the k-means clustering algorithm, wherein k=2;
• the computer system determining the buckets whose RTT values include respective values of the RTT, assigning the values of the RTT to the respective buckets, re-computing the counts and means for each bucket, and balancing C1 and C2 to ensure that (i) values in C1 are closer to a mean μ1 of C1 and (ii) values in C2 are closer to a mean μ2 of C2;
• the computer system computing μ1 of C1, a standard deviation σ1 of C1, μ2 of C2, and a standard deviation σ2 of C2;
• the computer system computing a threshold value as μ2+2σ2 if μ1+σ1≥μ2 or as μ1+2σ1 if μ1+σ1<μ2;
• the computer system determining that the value of the RTT of the response exceeds the threshold value;
• based on the status code of the response being the HTTP status code of 500 through 599, the value of the RTT exceeding the threshold value, and the connection having timed out in response to the server computer not responding to the request within the predetermined time period, the computer system detecting the anomaly in the performance of the application;
• and
• based on a temporal analysis and textual analysis of log entries associated with the anomaly, and based on an environment analysis that determines activity of the client computer, the server computer, and the communications network, the computer system determining candidate root causes of a failure that resulted in the anomaly, the failure being in the client computer, the server computer, the communications network, or a combination of the client computer, the server computer, and the communications network;
• the computer system sending an alert to a user via a graphical user interface dashboard, the alert describing the anomaly;
• the computer system collecting attributes of the anomaly and sending the attributes to a machine learning process, the attributes including the RTT, the indication of whether the connection timed out a delay value of the connection, details of the server computer and the application, details about a function specified by the request, and a uniform resource locator of the server computer;
• in response to the alert, the computer system receiving feedback from the user about whether the anomaly was correctly detected or incorrectly detected;
• the first computer utilizing the feedback as a label of the machine learning process;
• based on the collected attributes, the feedback, and the label, the computer system training a machine learning model for the machine learning process, the machine learning model including rules specifying subsequent anomalies in the performance of the application;
• the computer system detecting a subsequent anomaly in the performance of the application, the subsequent anomaly resulting in an outage in a network link, router, or switch in the communications network, which results in a disconnection between the client computer and the server computer;
• the computer system determining that the subsequent anomaly is correctly detected based on the trained machine learning model;
• and
• based on the subsequent anomaly being determined to be correctly detected based on the trained machine learning model, the first computer repairing the outage in the network link, the router, or the switch, which reconnects the client computer and the server computer via the communications network.