# US 9,438,488 B2 · Systems and methods for appflow for datastream

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,438,488 B2
- Document ID: US9438488B2
- Status: Granted
- Kind: B2
- Application number: 13/673,445
- Filed: 2012-11-09
- Published: 2014-05-15
- Granted: 2016-09-06
- Earliest claimed: 2012-11-09
- Assignees: Citrix Systems, Inc.
- Applicants: Citrix Systems, Inc.
- Inventors: Rajesh Joshi; Gaurav Chhawchharia
- Web page: https://patentgrep.com/patent/US9438488B2

## CPC

- H04L 43/026: using flow identification
- H04L 41/12: Discovery or management of network topologies
- H04L 43/12: Network monitoring probes
- H04L 41/5067: Customer-centric QoS measurements
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- Y02D 30/50: in wire-line communication networks, e.g. low power modes or reduced link rate
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

The present disclosure is directed towards systems and methods for monitoring application level flow for database applications served by a cluster of servers. An application flow monitor may receive and distribute write requests of a client to at least one master server and read requests of the client to one or more slave servers, based on load balancing or similar policies. The application flow monitor may receive responses from the recipient server and may aggregate the requests and responses into Internet Protocol Flow Information Export (IPFIX) messages that may describe the entire communication flow for the application. Accordingly, application flow statistics may be monitored, regardless of which server was involved in any particular request/response exchange, allowing scalability without impairment of administrative processes.

## Claims

### Claim 1

A method for monitoring application level flow by an intermediary device between a client and a server hosting a database, comprising:
receiving, by an intermediary device from a client device, a first database request designated for a server hosting a database having a first type, the first database request comprising a request type and a request string, the intermediary device identifying from parameters of the first database request each of the first type of database, the request type and the request string, wherein the request type comprises one of a read type of request or a write type of request;
identifying, by the intermediary device, that a parameter of the first database request matches a parameter of a first policy of a set of one or more policies;
selecting by the intermediary device, the server from a plurality of servers based on the request type, the intermediary device configured to select a master server for write type of requests and a slave server having a copy of the database for read type of requests;
generating, by the intermediary device responsive to the identification, a first Internet Protocol Flow Information Export (IPFIX) message comprising an identification of the first type of database, an identification of the request type of the first database request, and the request string of the first database request;
transmitting, by the intermediary device to the server, the first database request;
receiving, by the intermediary device from the server, a first response to the first database request, the first response comprising a response status and a response string;
determining, by the intermediary device, that the first response corresponds to the first database request; and
generating, by the intermediary device responsive to the determination, a second IPFIX message comprising an identification of the response status and the response string of the first response;
aggregating, by the intermediary device, the first IPFIX message and the second IPFIX message into a single application flow record.

### Claim 2 (depends on 1)

The method of claim 1, further comprising transmitting, by the intermediary device to the first client, the first response.

### Claim 3 (depends on 1)

The method of claim 1, wherein determining that the first response corresponds to the first database request and generating the second IPFIX message is performed without matching a parameter of the first response to a parameter of the first policy.

### Claim 4 (depends on 1)

The method of claim 1, further comprising transmitting, by the intermediary device, the first IPFIX message and the second IPFIX message to a data collector.

### Claim 5 (depends on 1)

The method of claim 1, further comprising aggregating first IPFIX message and second IPFIX message by concatenating one or more stings of the first IPFIX message with one or more strings of the second IPFIX message.

### Claim 6 (depends on 1)

The method of claim 1, wherein generating the second IPFIX message further comprises generating the second IPFIX message comprising an identification of the length of the response string.

### Claim 7 (depends on 1)

The method of claim 1, wherein the server comprises a plurality of computing devices, and wherein transmitting the first database request to the server further comprises identifying a first computing device of the plurality of computing devices and transmitting the first database request to the identified first computing device.

### Claim 8 (depends on 7)

The method of claim 7, wherein receiving the first response comprises receiving the first response from the identified first computing device.

### Claim 9 (depends on 7)

The method of claim 7, further comprising:
receiving, by the intermediary device from the client device, a second database request comprising a request type and a request string;
identifying, by the intermediary device, that a parameter of the second database request matches a parameter of the first policy;
generating, by the intermediary device responsive to the identification, a third IPFIX message comprising an identification of the request type of the second database request, and the request string of the second database request;
identifying, by the intermediary device, a second computing device of the plurality of computing devices based on a load balancing policy;
transmitting, by the intermediary device to the identified second computing device, the second database request;
receiving, by the intermediary device from the identified second computing device, a second response to the second database request, the second response comprising a response status and a response string;
determining, by the intermediary device, that the second response corresponds to the second database request;
generating, by the intermediary device responsive to the determination, a fourth IPFIX message comprising an identification of the response status and the response string of the second response; and
aggregating the first, second, third, and fourth IPFIX messages in an application flow record.

### Claim 10 (depends on 9)

The method of claim 9, wherein identifying the first computing device of the plurality of computing devices comprises identifying the first computing device responsive to the first database request having a first request type; and wherein identifying the second computing device of the plurality of computing devices comprises identifying the second computing device responsive to the second database request having a second, different request type.

### Claim 11

A system for monitoring application level flow by an intermediary device between a client and a server hosting a database, comprising:
an intermediary device, deployed between a client device and a server, comprising a processor executing an application flow monitor, the application flow monitor configured for:
receiving, from the client device, a first database request designated for a server hosting a database having a first type, the first database request comprising a request type and a request string, wherein the request type comprises one of a read type of request or a write type of request;
identifying from parameters of the first database request each of the first type of database, the request type and the request string;
identifying that a parameter of the first database request matches a parameter of a first policy of a set of one or more policies;
selecting the server from a plurality of servers based on the request type, the intermediary device configured to select a master server for write type of requests and a slave server having a copy of the database for read type of requests;
generating, responsive to the identification, a first Internet Protocol Flow Information Export (IPFIX) message comprising an identification of the first type of database, an identification of the request type of the first database request, and the request string of the first database request;
transmitting, to the server, the first database request;
receiving, from the server, a first response to the first database request, the first response comprising a response status and a response string;
determining that the first response corresponds to the first database request;
generating, responsive to the determination, a second IPFIX message comprising an identification of the response status and the response string of the first response; and
aggregating the first IPFIX message and the second IPFIX message into a single application flow record.

### Claim 12 (depends on 11)

The system of claim 11, wherein the application flow monitor is further configured for transmitting, to the first client, the first response.

### Claim 13 (depends on 11)

The system of claim 11, wherein the application flow monitor is further configured for determining that the first response corresponds to the first database request and generating the second IPFIX message, without matching a parameter of the first response to a parameter of the first policy.

### Claim 14 (depends on 11)

The system of claim 11, wherein the application flow monitor is further configured for transmitting the first IPFIX message and the second IPFIX message to a data collector.

### Claim 15 (depends on 11)

The system of claim 11, wherein the application flow monitor or a data collector executed by a second device is further configured for aggregating the first IPFIX message and second IPFIX message by concatenating one or more strings of the first IPFIX message with one or more strings of the second IPFIX message.

### Claim 16 (depends on 11)

The system of claim 11, wherein the application flow monitor is further configured for generating the second IPFIX message comprising an identification of the length of the response string.

### Claim 17 (depends on 11)

The system of claim 11, wherein the server comprises a plurality of computing devices, and wherein the application flow monitor is further configured for identifying a first computing device of the plurality of computing devices and transmitting the first database request to the identified first computing device.

### Claim 18 (depends on 17)

The system of claim 17, wherein the application flow monitor is further configured for receiving the first response from the identified first computing device.