Methods and apparatus for monitoring and reporting network activity of applications on a group of host computers

A computer system operative to monitor and report network activity of applications on a group of host computer systems within the computer system, comprising:

• one or more computer processors;
• a management computer system operative to provide network activity monitoring rules to the host computer systems, the network activity monitoring rules including rules for monitoring first and second network operations performed by the applications, each first network operation establishing a respective communications mechanism by which an application can engage in network communications with another computer system, each second network operation indicating that a respective communications exchange utilizing the communications mechanism has occurred between the application and the other computer system;
• wherein the network activity monitoring rules are used to detect ports that are enabled by the applications but are not in active use over a recent interval;
• and
• in response to each host computer system of the group, an agent operative to (i) monitor network activity of the applications residing on the host computer system in accordance with the network activity monitoring rules provided by the management computer system, (ii) store local network activity data describing the monitored network activity of the applications in a local network activity data structure, and (iii) periodically upload the local network activity data to the management computer system, the management computer system being further operative to (i) receive the local network activity data uploaded from each of the host computer systems of the group, (ii) utilize the uploaded data from each of the host computer systems to periodically update a management database including network activity data for all the host computer systems of the group, (iii) in response to user request, generate a user-readable report from the management database showing the network activity of the applications of the host computers of the group, and (iv) in response to detecting the ports that are enabled by the applications but are not in active use during the recent interval, identify a particular application from the applications to be de-activated.

A management computer system including a computer processor for use in monitoring and reporting network activity of applications on a group of host computer systems, the management computer system being configured to execute a management process including:

• providing network activity monitoring rules to the host computer systems, the network activity monitoring rules including rules for monitoring first and second network operations performed by the applications, each first network operation establishing a respective communications mechanism by which an application can engage in network communications with another computer system, each second network operation indicating that a respective communications exchange utilizing the communications mechanism has occurred between the application and the other computer system;
• wherein the network activity monitoring rules are used to detect ports that are enabled by the applications but are not in active use during a recent interval;
• receiving local network activity data periodically uploaded from each of the host computer systems of the group, the local network activity data describing network activity of the applications monitored in accordance with the network activity monitoring rules;
• utilizing the uploaded data from each of the host computer systems to periodically update a management database including network activity data for all the host computer systems of the group;
• and
• in response to user request, generating a user-readable report from the management database showing the network activity of the applications of the host computers of the group;
• in response to detecting the port that are enabled by the applications but are not in active use during the recent interval, identifying a particular application form the applications to be de-activated;
• wherein the management computer system comprises one or more processors.

A host computer system including a computer processor forming part of a group of host computer systems having applications whose network activity is to be monitored and reported, the host computer including an agent and a network monitoring component collectively operative to:

• receive network activity monitoring rules from a management computer system, the network activity monitoring rules including rules for monitoring first and second network operations performed by the applications, each first network operation establishing a respective communications mechanism by which an application can engage in network communications with another computer system, each second network operation indicating that a respective communications exchange utilizing the communications mechanism has occurred between the application and the other computer system;
• wherein the network activity monitoring rules are used to detect ports that are enabled by the applications but are not in active use during a recent interval;
• monitor network activity of the applications residing on the host computer system in accordance with the network activity monitoring rules provided by the management computer system;
• store local network activity data describing the monitored network activity of the applications in a local network activity data structure;
• and
• periodically upload the local network activity data to the management computer system for use in (i) updating a management database including network activity data for all the host computer systems of the group, (iii) generating a user-readable report from the management database showing the network activity of the applications of the host computers of the group, and (iv) in response to detecting the ports that are enabled by the applications but are not in active use during the recent interval, identifying a particular application from the applications to be de-activated;
• wherein the host computer system comprises one or more processors.

A non-transitory computer program product comprising a computer-readable medium having a plurality of computer instructions recorded thereon, the computer instructions being operative when executed by a management computer system to cause the management computer system to perform a management process for monitoring and reporting network activity of applications on a group of host computer systems, the management process including:

• providing network activity monitoring rules to the host computer systems, the network activity monitoring rules including rules for monitoring first and second network operations performed by the applications, each first network operation establishing a respective communications mechanism by which an application can engage in network communications with another computer system, each second network operation indicating that a respective communications exchange utilizing the communications mechanism has occurred between the application and the other computer system;
• wherein the network activity monitoring rules are used to detect ports that are enabled by the applications but are not in active use during a recent interval;
• receiving local network activity data periodically uploaded from each of the host computer systems of the group, the local network activity data describing network activity of the applications monitored in accordance with the network activity monitoring rules;
• utilizing the uploaded data from each of the host computer systems to periodically update a management database including network activity data for all the host computer systems of the group;
• and
• in response to user request, generating a user-readable report from the management database showing the network activity of the applications of the host computers of the group;
• in response to detecting the port that are enabled by the applications but are not in active use during the recent interval, identifying a particular application form the applications to be de-activated.

A non-transitory computer program product comprising a computer-readable medium having a plurality of computer instructions recorded thereon, the computer instructions being operative when executed by a host computer system to cause the host computer system to execute a monitoring and reporting process by which the network activity of applications on the host computer system is to be monitored and reported, the monitoring and reporting process including:

• receiving network activity monitoring rules from a management computer system, the network activity monitoring rules including rules for monitoring first and second network operations performed by the applications, each first network operation establishing a respective communications mechanism by which an application can engage in network communications with another computer system, each second network operation indicating that a respective communications exchange utilizing the communications mechanism has occurred between the application and the other computer system;
• wherein the network activity monitoring rules are used to detect ports that are enabled by the applications but are not in active use during a recent interval;
• monitoring network activity of the applications residing on the host computer system in accordance with the network activity monitoring rules provided by the management computer system;
• storing local network activity data describing the monitored network activity of the applications in a local network activity data structure;
• and
• periodically uploading the local network activity data to the management computer system for use in (i) updating a management database including network activity data for all the host computer systems of the group, (iii) generating a user-readable report from the management database showing the network activity of the applications of the host computers of the group, and (iv) in response to detecting the ports that are enabled by the applications but are not in active use during the recent interval, identifying a particular application from the applications to be de-activated.