Dynamic incident tracking and investigation in service monitors

摘要

A method for a service monitor of a computing environment includes monitoring application network transactions and behaviors for the computing environment, the computing environment including client subnets accessing servers, the monitoring independent of client site monitors; decomposing the monitored transactions and behaviors into network, server and application quality components; using the components to identify services, servers and client subnets as associated with a quality issue; and implementing an active investigation on the services, servers and client subnets to gather statistical data to assist root cause analysis independent of a network monitoring interruption; The quality issue might be a performance issue, such as excessive response times, excessive loss rates, or small transfer rates. The quality issue might be an availability issue, such as an unreachable network node or a missing web page. The service monitor includes an event detection module configured to decompose the monitored transactions and behaviors into network, server and application quality components and to use the components to identify services, servers and client subnets as being associated with a quality issue. The monitor also includes active investigation modules networked to gather statistical data according to criteria to assist root cause analysis without monitoring interruption.