# US 2013/0158950 A1 · Application performance analysis that is adaptive to business activity patterns > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0158950 A1 - Document ID: US20130158950A1 - Status: Published application - Kind: A1 - Application number: 13/570,572 - Filed: 2012-08-09 - Published: 2013-06-20 - Earliest claimed: 2011-08-10 - Assignees: OPNET Technologies, Inc. - Inventors: Alain J. COHEN; Yiping DING; Stefan ZNAM - Web page: https://patentgrep.com/patent/US20130158950A1 ## CPC - G06F 17/00: Digital computing or data processing equipment or methods, specially adapted for specific functions (information retrieval, database structures or file system structures therefor G06F16/00) - G06F 11/3409: {for performance assessment} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 11/3495: {for systems} - H04L 43/16: Threshold monitoring - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 67/62: Establishing a time schedule for servicing the requests - H04L 69/28: Timers or timing mechanisms used in protocols - G06F 11/3442: {for planning or managing the needed capacity} - G06F 2201/81: Threshold - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present invention relates to a system and method for assessing application performance. hi some embodiments, the analysis considers external factors, such as business hours, time zone, etc., to identify or recognize distinctive intervals of application performance. These distinctive intervals correspond to different periods of activity by an enterprise or business and may occur in a cyclical manner or other type of pattern. The distinctive intervals defined by external factors are employed in the analysis to improve aggregating of statistics, setting of thresholds for performance monitoring and alarms, correlating business and performance, and the modeling of application performance. The metrics measured can include, among other things, measures of CPU and memory utilization, disk transfer rates, network performance, queue depths and application module throughput. Key performance indicators, such as transaction rates and round-trip response times may also be monitored. ## Claims ### Claim 1 A method for dynamically generating at least one metric threshold associated with a metric in a monitored system, the method comprising: receiving data associated with a metric; determining distinct intervals of time that result from external factors influencing activity of the monitored system; statistically analyzing the received data for each distinct interval separately; and determining at least one alarm threshold for future, similar intervals based on the statistical analysis. ### Claim 2 (depends on 1) The method of claim 1 wherein receiving the data comprises aggregating the received data based on an aggregation period for each distinct interval. ### Claim 3 (depends on 1) The method of claim 1, wherein determining the distinct intervals comprises receiving an input specifying the distinct intervals of time. ### Claim 4 (depends on 1) The method of claim 1, wherein determining the distinct intervals comprises receiving an input specifying hours of operations for the monitored system. ### Claim 5 (depends on 1) The method of claim 1, wherein determining the distinct intervals comprises receiving an input specifying a set of external factors that influence the activity of the monitored system. ### Claim 6 (depends on 1) The method of claim 1, wherein determining the distinct intervals comprises determining the distinct intervals of time from a heuristic analysis of the received data. ### Claim 7 (depends on 1) The method of claim 1, wherein statistically analyzing the received data: receiving data at a first time scale; and extrapolating received data at a second time scale for the distinct interval. ### Claim 8 (depends on 1) The method of claim 1, further comprising triggering an alarm on receipt of received data within a similar interval that violates the at least one alarm threshold. ### Claim 9 (depends on 1) The method of claim 1, further comprising: statistically analyzing received data for at least one additional metric for one of the distinct intervals of time; and correlating the metric and the at least one additional metric based on the statistical analysis within the distinct interval of time. ### Claim 10 A method for monitoring a system, wherein activity of the system is influenced by external factors that result in intervals of different activity, the method comprising: receiving data associated with a metric of the monitored system; identifying time intervals of the received data based on information indicating the external factors; determining, for each identified Urns interval, at least one value indicating a statistical distribution of values of the metric; and determining, for subsequent intervals that are similar to the identified intervals of time, at least one threshold indicating a boundary of an abnormal value for the metric. ### Claim 11 (depends on 10) The method of claim 10, wherein identifying the time intervals comprises receiving information specifying a range of hours in a day. ### Claim 12 (depends on 10) The method of claim 10, wherein identifying the time intervals comprises receiving information specifying days of a week. ### Claim 13 (depends on 10) The method of claim 10, wherein identifying the time intervals comprises receiving information specifying days of a year. ### Claim 14 (depends on 10) The method of claim 10, wherein determining the at least one value indicating the statistical distribution comprises determining a mean value of the metric within each identified time interval. ### Claim 15 (depends on 10) The method of claim 10, wherein determining the at least one value indicating the statistical distribution comprises determining a standard deviation value of the metric within each identified time interval. ### Claim 16 (depends on 10) The method of claim 10, further comprising triggering an alarm event on receipt of received data within a subsequent interval that is similar to one of the identified intervals that violates the at least one threshold. ### Claim 17 A system for monitoring a system, said system comprising: a collector for receiving data for at least one metric of performance by the monitored system; and a monitoring server configured to aggregate the received data, recognize time intervals of the received data corresponding to a distinct period of activity in the monitored system, determine, for each identified time interval, at least one value indicating a statistical distribution of values of the metric, and determining, for subsequent intervals that are similar to the identified intervals of time, at least one threshold indicating a boundary of an abnormal value for the metric. ### Claim 18 (depends on 17) The system of claim 17, wherein the monitoring server further comprises a data aggregator configured to aggregate the received data based on the identified intervals of time. ### Claim 19 (depends on 17) The system of claim 17, wherein the monitoring server is configured to determine the at least one threshold for each identified interval based on a mean value and standard deviation of the metric for each interval. ### Claim 20 (depends on 17) The system of claim 17, further comprising an alarm engine configured to generate an alarm event on receipt of received data within a subsequent interval that is similar to one the identified intervals that violates the at least one threshold.