# US 2013/0159999 A1 · System and method for generating application-level dependencies in one or more virtual machines > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0159999 A1 - Document ID: US20130159999A1 - Status: Published application - Kind: A1 - Application number: 13/327,407 - Filed: 2011-12-15 - Published: 2013-06-20 - Earliest claimed: 2011-12-15 - Assignees: Industrial Technology Research Institute - Inventors: Tzi-Cker Chiueh; Hao-Cheng Lin - Web page: https://patentgrep.com/patent/US20130159999A1 ## CPC - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45504: {Abstract machines for program code execution, e.g. Java virtual machine [JVM], interpreters or emulators} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - H04L 41/069: using logs of notifications; Post-processing of notifications - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - G06F 2201/815: Virtual - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A technique generates application-level dependencies in one or more virtual machines (VMs). An intercepting module in a VM monitor intercepts a guest operation system (OS) at TCP send and close related operations. An introspecting module in the VM monitor performs VM introspection for TCP connection and thread information by checking running thread and processing socket kernel objects. It generates an application trajectory and exports application dependencies from the application trajectory for a selected application. ## Claims ### Claim 1 A system for generating application-level dependencies in one or more virtual machines (VMs), comprising: an application performance management (APM) server running on a physical machine, to accept a request and send a command to at least one forward daemon to turn on inspect status of at least one related VM of said one or more VMs, and generate an application trajectory of a selected application and export application dependencies for said selected application; one or more intercepting modules, wherein each intercepting module intercepts a guest operation system (OS) at transmission control protocol (TCP) send and close related operations on the at least one related VM; and one or more introspecting modules, wherein each introspecting module performs VM introspection for TCP connection and running thread information. ### Claim 2 The system as claimed in 1, wherein said each introspecting module performs said VM introspection by checking the guest OS's running kernel data structure and getting one or more running threads and TCP connection information, and generating one or more per-thread traffic logs for sending to said APM server via said forward daemon. ### Claim 3 (depends on 1) The system as claimed in claim 1, wherein said each intercepting module and said each introspecting module are both in a corresponding VM monitor on a corresponding physical server, and a corresponding forward daemon of the at least one forward daemon is running on said corresponding physical server. ### Claim 4 (depends on 2) The system as claimed in claim 2, wherein said APM server further comprises: a traffic log conversion module for converting the one or more per-thread traffic logs to one or more inter-thread traffic logs; and a dependency map generating module for generating said application trajectory from the one or more inter-thread traffic logs and exporting the application dependencies from the application trajectory for the selected application. ### Claim 5 (depends on 4) The system as claimed in claim 4, said system uses a log database to store the one or more inter-thread traffic logs. ### Claim 6 (depends on 1) The system as claimed in claim 1, wherein each of the one or more per-thread traffic logs contains time information, thread information, connection information and direction. ### Claim 7 (depends on 4) The system as claimed in claim 4, wherein each of the one or more inter-thread traffic logs contains time information, sender thread information, receiver thread information and direction. ### Claim 8 (depends on 1) The system as claimed in claim 1, wherein said application trajectory records message exchanges and time periods between applications that starting from one application. ### Claim 9 (depends on 1) The system as claimed in claim 1, wherein said application trajectory is stored in a tree data structure starting from a root node, and comprises one or more nodes, one or more links and one or more arrows, a node in the application trajectory indicates a message exchange to an application during a time period, a link in the application trajectory indicates a direct message exchange between two applications, an arrow in the trajectory indicates the direction of a connection between two applications. ### Claim 10 (depends on 1) The system as claimed in claim 1, wherein said application dependencies is an application dependency map represented in a tree data structure. ### Claim 11 (depends on 1) The system as claimed in claim 1, wherein said APM server uses an incremental enable module to gradually enables related VM's inspect status until the at least one related VM's inspect status is turn on. ### Claim 12 A computer-implemented method for generating application-level dependencies in one or more virtual machines (VMs), comprising: under controlling of one or more physical servers that provide a virtual environment having said one or more VMs; intercepting a guest operation system (OS) at transmission control protocol (TCP) send and close related operations of at least one related VM of said one or more VMs; performing VM introspection for TCP connection and running thread information; and generating an application trajectory of a selected application and exporting application dependencies from the application trajectory for the selected application. ### Claim 13 (depends on 12) The computer-implemented method as claimed in claim 12, further comprising performing said VM introspection by checking the guest OS's running threads and getting one or more running threads and TCP connection information and generating one or more per-thread traffic logs. ### Claim 14 (depends on 13) The computer-implemented method as claimed in claim 13, further comprising converting the one or more per-thread traffic logs to one or more inter-thread traffic logs, ### Claim 15 (depends on 14) The computer-implemented method as claimed in claim 14, further comprising a learning phase, a discovery phase and a generation phase to generate application-level dependencies. ### Claim 16 (depends on 15) The computer-implemented method as claimed in claim 15, further comprising, in the learning phase, using an incremental approach to identify at least one VM related to the selected application, and generating a related vm-id list and providing to the discovery phase. ### Claim 17 (depends on 15) The computer-implemented method as claimed in claim 15, further comprising, in the discovery phase, collecting the one or more per-thread traffic logs, generating the one or more inter-thread traffic logs and providing to the generation phase. ### Claim 18 (depends on 15) The computer-implemented method as claimed in claim 15, further comprising, in the generation phase, generating the application trajectory and generating an application dependency map from the application trajectory by applying an application dependency algorithm. ### Claim 19 (depends on 18) The computer-implemented method as claimed in claim 18, further comprising using a recursive approach by the application dependency algorithm to find out all indirect dependent threads related to the selected application during a time period. ### Claim 20 (depends on 13) The computer-implemented method as claimed in claim 13, wherein each of the one or more per-thread traffic logs comprises time information, thread information, connection information and direction. ### Claim 21 (depends on 14) The computer-implemented method as claimed in claim 14, wherein each of the one or more inter-thread traffic logs comprises time information, sender thread information, receiver thread information and direction. ### Claim 22 (depends on 12) The computer-implemented method as claimed in claim 12, further comprising implementing the intercepting either by hardware breakpoint or by intercepting TCP related system calls. ### Claim 23 (depends on 12) The computer-implemented method as claimed in claim 12, further comprising running at multi-process models. ### Claim 24 (depends on 12) The computer-implemented method as claimed in claim 12, further comprising running at multi-thread models. ### Claim 25 (depends on 22) The computer-implemented method as claimed in claim 22, wherein a decision to select an intercept mechanism depends on the number of hardware debug registers supported by a central processing unit (CPU) and the number of TCP send and close related functions. ### Claim 26 (depends on 25) The computer-implemented method as claimed in claim 25, wherein when the number of hardware debug registers supported by a CPU is greater than the number of TCP send and close related functions, intercepting by hardware breakpoint is selected. ### Claim 27 (depends on 25) The computer-implemented method as claimed in claim 25, wherein when the number of hardware debug registers supported by a CPU is not greater than the number of TCP send and close related functions, intercepting TCP related system calls is selected, which includes a shadow service descriptor table (SDT) is cloned in a VM monitor and the SDT table is modified to intercept TCP related system calls.