Inferring application inventory

This disclosure relates to a guess application inventory.

Cloud computing infrastructure services allow a variety of services and applications to run within that infrastructure. Determining what services and applications are implemented within the various components of the infrastructure can be useful.

<p num="0003"> Allows you to determine which applications are implemented within your infrastructure.</p>

<p num="0004"> One embodiment is a system comprising at least one computing device and an inventory application that can be run on the at least one computing device. The inventory application runs on one of the machine instances based on at least the logic of retrieving data that embodies interoperability between a subset of the machine instances and at least partly based on the data. The inventory application runs outside the machine instance and does not perform an internal check of the one of the machine instances, including logic that generates an identification for at least one application.</p>

<p num="0005"> Allows you to determine which applications are implemented within your infrastructure.</p>

<figref num="1">FIG. 3 is a drawing of a networked environment according to various embodiments of the present disclosure.</figref><figref num="2A">It is a drawing of an example regional level data center architecture according to various embodiments of the present disclosure.</figref><figref num="2B">It is a drawing of an exemplary data center level data center architecture according to various embodiments of the present disclosure.</figref><figref num="2C">It is a drawing of an example rack level data center architecture according to various embodiments of the present disclosure.</figref><figref num="2D">It is a drawing of an example server level data center architecture according to various embodiments of the present disclosure.</figref><figref num="3A">It is a drawing of an embodiment of a user interface rendered by a client in the networked environment of FIG. 1 according to various embodiments of the present disclosure.</figref><figref num="3B">It is a drawing of an embodiment of a user interface rendered by a client in the networked environment of FIG. 1 according to various embodiments of the present disclosure.</figref><figref num="4">FIG. 5 is a flow chart illustrating an embodiment of functionality implemented as part of an inventory application executed in a computing environment in the networked environment of FIG. 1 according to various embodiments of the present disclosure.</figref><figref num="5">It is a schematic block diagram which provides the illustration of one example of the computing environment used in the computing environment in the networked environment of FIG. 1 according to various embodiments of the present disclosure.</figref>

Many aspects of the disclosure can be better understood with reference to the accompanying drawings. The components in the figure are not necessarily to scale, and instead the emphasis is on articulating the principles of this disclosure. Further, in the drawings, similar reference numbers specify the corresponding parts throughout some of the drawings.

The cloud computing infrastructure allows customers to implement virtual machine instances that run on computing devices. Customers may implement, for example, a set of operating systems and applications of their choice on a machine instance. Cloud infrastructure is often modeled using a split security model, where customers have exclusive access to the underlying functionality of machine instances, while cloud service providers provide the underlying cloud computing capabilities. Has exclusive access to sex. This prevents cloud service providers and customers from interfering with the operation of their respective services and puts responsibility for the maintenance and configuration of services on their respective managers.

Cloud service providers generally do not have root access to the customer machine instance, so they cannot inspect a running machine instance, and the cloud service provider knows what applications are running within the machine instance. Do not know. Such information may also be useful to independent software vendors who provide software to cloud service provider customers to facilitate a better understanding of their products. Such information may also be useful to customers implementing machine instances to inform them of software updates, best practice compliance, security vulnerabilities, or other information. In many cases, this information can only be aggregated or used only if it has been opt-in by the customer so as not to inadvertently divulge confidential or personally identifiable information.

While this information is generally not directly available, the data collected from the environment outside the machine instance may provide instructions regarding the applications running inside the machine instance. For example, a particular open network port may be the default port for a particular application, indicating that this application may run within a machine instance. As another example, a network routing configuration can route network traffic to a machine instance, but can point to a database server application, not from a machine instance. The free disk space allocated for a machine instance or disk redundancy configuration can also indicate the type of application running on the machine instance. Other factors can also be considered in attempts to identify the type of application running on the machine instance.

In addition, factors may be considered aggregated to identify multiple applications that may include a set of software applications that collaborate across many server and / or machine instances to provide a particular service. .. Examples of services can be, among other things, business intelligence services, customer relationship management (CRM) services, human resource management systems (HRMS), corporate performance management systems (EPM), and supply chain management systems (SCM). An example factor could be that a machine instance could have a first open network port known to be the default port for database servers used by a particular service. .. A machine instance, or another associated machine instance, may also have a second open network port known to be the default port for analytics servers known to be used with database servers. .. Individually, these open ports as default may indicate each of their applications, but overall, both the database server and the analytics server are running as a set of complex software provided by the vendor. Greater potential. For example, Vendor A may provide business intelligence software components that include SQL databases, data warehouses, and analysis modules that run on multiple servers and / or virtual machine instances. Another vendor, Vendor B, may offer similar business intelligence software, but the software components, architecture, and data flow between the components can be different (and firewall information, port information, network topology, data transmission features). (Bandwidth, flow, burstability, etc.), virtual machine instance size, etc.). Multiple instances and / or compu

Inventory applications are operations-related data and machine instances, including hardware usage, network configurations, network routing configurations, disk configurations, applications known to run on machine instances, or other data. Aggregate the configuration. The aggregated data is then compared to a known profile of the application to identify the application running within the machine instance. The identification may be stored with the metadata in the data store for later use in generating analytical reports that embody the use of the application.

The following discussion provides a general description of the system and its components, followed by a discussion of their behavior.

With reference to FIG. 1, a networked environment 100 according to various embodiments is shown. The networked environment 100 includes a computing environment 101 and a client 104 that communicate data with each other via the network 107. Network 107 may be, for example, the Internet, an intranet, an extranet, a wide area network (WAN), a local area network (LAN), a wired network, a wireless network, or other suitable network, or more than one such network. Includes any combination.

The computing environment 101 may include, for example, a server computer or any other system that provides computer functionality. Alternatively, the computing environment 101 may use, for example, a plurality of computing devices that may be used, arranged in one or more server banks or computer banks or other arrangements. Such computing devices may be placed in a single installation or may be distributed in many different geographic locations. For example, the computing environment 101 may include a plurality of computing devices, which may include cloud computing resources, grid computing resources, and / or any other distributed computing arrangement. In some cases, the computing environment 101 becomes an elastic computing resource in which the capacity of processing, network, storage, or other computing-related resources allocated to the customer may change over time. It may correspond.

Various applications and / or other functions may be performed in the computing environment 101 according to various embodiments. In addition, various data are stored in the data store 111 that can access the computing environment 101. The data store 111 may represent a plurality of data stores 111, as can be understood. The data stored in the data store 111 is associated with, for example, the behavior of various applications and / or the functional entities described below.

Components running on the computing environment 101 include, for example, machine instances 114, inventory applications 117, and other applications, services, processes, systems, engines, or functionality not discussed in detail in this disclosure. Machine instance 114 comprises a virtualized instance of the operating system to facilitate the execution of one or more applications 121. Execution of such an application may open network ports, carry network traffic, initiate system processing, perform disk access, or perform other functionality within Machine Instance 114. The configuration and other parameters of machine instance 114 may be defined by the customer, the system administrator of computing environment 101, at least in part based on the default parameters, or by another approach.

The configuration of machine instance 114 may be associated with instance type 124, which defines the amount of access to compute resources in compute environment 101 when running machine instance 114 and associated application 121. Instance type 124 includes disk free space allocated to machine instance 114, maximum or average estimated central processing unit (CPU) utilization, maximum or average estimated graphics processing unit (GPU) utilization, and maximum. Alternatively, parameters such as the average estimated disk access rate, or other parameters may be defined. In some embodiments, such parameters may also be defined independently of instance type 124.

Machine instance 114 may also have network configuration 127 that defines network traffic permissions, network traffic routing permissions, or other data. For example, network configuration 127 may define a subset of the network ports of machine instance 114 through which machine instance 114 will accept traffic. Network configuration 127 may also limit which networking protocol machine instance 114 accepts traffic. Networking Configuration 127 also includes machine instances from any network address, such as an Internet Protocol (IP) address range, a subset of defined IP addresses, a subset of defined media access control (MAC) addresses, or other network addresses. You may limit whether 114 accepts.

The inventory application 117 is executed to identify the application 121 running on the machine instance 114 implemented in the computing environment 101. To this end, the inventory application 117 includes the configuration of machine instance 114 as well as the usage data 135 associated with machine instance 114, which indicates the compute resource usage of compute environment 101 by machine instance 114. Implement a data aggregation module 134 for aggregating data related to interoperability between machine instances 114. For example, aggregated usage data 135 by the data aggregation module 134 may include sampling of CPU usage, GPU usage, bandwidth usage, disk access, memory usage, or other data.

The configuration data aggregated by the data aggregation module 134 may include retrieving routing configuration 137, which defines how network traffic is routed between machine instances 114. For example, routing configuration 137 may define a connection to a load balancer for allocating network traffic. The routing configuration 137 may also define a machine instance 114 or network address to which the machine instance 114 routes traffic to or from it. The routing configuration 137 may also include other data. Obtaining routing configuration 137 means loading routing configuration 137 from a data store and querying the application program interface (API) or other functionality of networking components such as load balancers, switches, or routers. , Or another approach may include making inquiries.

The data aggregation module 134 may also sample network traffic patterns 141 associated with communication between machine instances 114 or between machine instances 114 and external networks 107. Network traffic pattern 141 may include network protocol usage, port usage, packet size, packet content, network traffic source or destination, or other data. The data aggregation module 134 may use, for example, packet inspection functionality in order to extract network packet data (for example, header data, packet size data, etc.), transmission frequency, and the like. Sampling network traffic pattern 141 may also be done by another approach.

In addition, the data aggregation module 134 may also aggregate pre-defined configuration data for one or more of machine instances 114, including instance type 124, network configuration 127, or disk configuration 131. The data aggregation module 134 may also aggregate other usage data 135 or configuration data.

After the data aggregation module 134 aggregates usage data 135 and configuration data for one or more machine instances 114, the data aggregation module 134 then aggregates at least one of the applications 121 running on the machine instance 114. Attempts to identify one. This identification may be a specific application, application type (eg, database application, coding application, website application, etc.), or a set of applications that perform a particular functionality. In some embodiments, this is performed on machine instance 114 in response to calculating scores or probabilities for one or more potential applications 121 and exceeding thresholds, or more than one. May include identifying one of the potential applications 121 as having the highest score or probability of.

Calculating a score or weight for an application 121, at least in part, based on aggregated data is done by querying the identification knowledge base 144, which associates the application 121 with one or more criteria that indicate its execution on the machine instance 114. You may be broken. For example, the Discrimination Knowledge Base 144 may define one or more network ports opened by default when running the associated application 121. The default network port open on machine instance 114 may increase the score or probability that application 121 is running on machine instance. As another embodiment, implementing data redundancy, such as a machine instance 114 with a large amount of free disk space allocated, or a RAID configuration, may indicate a database server running on the machine instance 114. The Distinguished Knowledge Base 144 indicates a known best practice, a known default application 121 configuration or behavior, a grouping of related applications 121 that are easy to run together or interact with, or an application 121 running on machine instance 114. Potentially other data may be embodied.

Aggregate data associated with a plurality of machine instances 114, or a machine instance 114 that is distinctly different from the machine instance 114 from which the application 121 is identified, may also be a factor in identifying the application 121. For example, a first machine instance 114 that accepts traffic from a second machine instance 114 that is not linked to another machine instance 114 that is configured to accept inbound network traffic from the first machine instance 114. Network configuration 127 may indicate a data storage service application 121 running on a database server or first machine instance 114. Aggregate data associated with multiple machine instances 114 may also be used to identify application 121 by another approach.

In addition, application 121 known to run on machine instance 114 or previously identified by inventory application 117 may also be a factor in identifying application 121. For example, if machine instance 114 is known to be running database server application 121, or is in network communication with machine instance 114 running database server application 121, application 121 may be referred to as data analysis application 121. It may be easy to identify. Known or pre-identified application 121 may also be used to identify application 121 by another approach.

In some embodiments, the score or probability for a plurality of potential applications 121 may increase in response to aggregated data indicating that the plurality of applications 121 are running on machine instance 114. For example, the score or probability that the web server application 121 is running may increase as the score of the distinctly different web server front-end application 121 increases, and both the web server and its associated front end Indicates that it is running on machine instance 114. The markings of multiple applications 121 running on machine instance 114 may also be used to identify application 121 by another approach.

After one or more applications 121 have been identified as running on machine instance 114, inventory application 117 may then store the identity of application 121 in application profile 147. Application profile 147 embodies which application 121 was identified as running on a particular machine instance 114 at a particular time. Application profile 147 may also include metadata 151 associated with machine instance 114, including machine instance 114 identifiers, customer account identifiers, instance type 124 identifiers, or other data.

After one or more application profiles 147 are stored, the report module 154 may generate report 157 based at least in part on the application profile 147. Report 157 may be generated in response to a query from client 104, in response to the passage of time intervals, or in response to some other criterion. Report 157 may embody, for example, an analysis showing adoption, use, or installation rates of application 121, and potentially other data. The data embodied in Report 157 may be categorized by data center region, application 121 vendors, machine instance 114 customers, or any other category. Other data may also be embodied in Report 157 for understanding.

After generating report 157, report module 154 may propagate report 157 to client 104 over network 107, store report 157 in data store 111, or with respect to generated report 157. , You may do some other act. Report 157 may have been propagated to client 104 and attached within an email message or short message system (SMS) message, otherwise encoded, or communicated by some other approach. It may be communicated to the network page by encoding the report.

The data stored in the data store 111 includes, for example, an identification knowledge base 144, an application profile 147, a routing configuration 137, a network traffic pattern 141, and potentially other data.

The client 104 represents a plurality of client devices that may be attached to the network 107. Client 104 may include a processor-based system, such as a computer system. Such computer systems are desktop computers, laptop computers, mobile terminals, mobile phones, smartphones, set-top boxes, music players, web pads, tablet computer systems, game consoles, ebook readers, or others with similar performance. It may be embodied in the form of a device.

Client 104 may be configured to run various applications such as client application 161 and / or other applications. The client application 161 may be executed on the client 104, for example, to access network content provided by the computing environment 101 and / or other servers. To this end, the client application 161 may include, for example, a browser, a dedicated application, and the like. Client 104 may be configured to run applications beyond client application 161 such as, for example, email applications, social networking applications, word processors, spreadsheets, and / or other applications. Although the client 104 is shown as being outside the computing environment 101, it can be inside the computing environment 101.

Next, a general description of the operation of the various components of the networked environment 100 is provided. First, the data aggregation module 134 of the inventory application 117 aggregates data that embodies interoperability between machine instances 114, such as usage data 135, configuration data, and potentially other data. Aggregate usage data 135 is, for example, sampling CPU usage, GPU usage, memory usage, disk access, or other data related to machine instance 114 accessing compute resources in compute environment 101. May include. The data aggregation module 134 may also record network traffic patterns 141 by sampling network traffic packets transmitted to or from machine instance 114.

Sampling configuration data can be due to allocated CPU usage, free disk space allocation, memory allocation, GPU usage predefined limits, or access to compute resources in compute environment 101 by machine instance 114. It may include obtaining other restrictions. Such restrictions may be embodied in instance type 124 associated with machine instance 114. For example, a customer who purchases access to machine instance 114 allocates a predefined amount of CPU, disk, and memory as part of a purchase transaction, selected 1 in a predefined list of instance type 124. May have one.

Sampling configuration data may also include retrieving routing configuration 137 associated with one or more of machine instances 114. The routing configuration 137 may define, for example, a network traffic routing route between the machine instances 114 or between the machine instances 114 and the external network 107 locations. The routing configuration 137 may define a connection to a load balancer, switch, router, or other networking component of network 107 or computing environment 101.

Retrieving configuration data may also include retrieving the network configuration 127 defined for one or more of machine instances 114, or the interoperability of multiple machine instances 114. Obtaining network configuration 127 may include scanning for the open network port of machine instance 114, loading pre-defined network configuration 127 data associated with machine instance 114, or another approach. Loading of a pre-defined network configuration 127 embodies accessible network ports, allowed network protocols, and allowed network traffic sources, or other data defined for one or more of machine instances 114. It may include loading of the customer-defined security policy to be implemented.

Retrieving configuration data may also include retrieving the disk configuration 131, disk partitioning scheme, data redundancy scheme, or other parameters associated with the machine instance 114, including the RAID configuration.

After retrieving usage data 135 and configuration data, the data aggregation module 134 then attempts to identify at least one application 121 running on machine instance 114. In some embodiments, it calculates scores or probabilities for multiple Potential Applications 121 and states that the highest or most reliable of Potential Applications 121 is running within Machine Instance 114. May include identifying. In other embodiments, it calculates scores or probabilities for multiple potential applications 121 and identifies potential applications 121 whose probabilities or scores exceed a threshold while running within machine instance 114. It may include that.

In embodiments where scores or probabilities are calculated for potential applications 121, scores or probabilities are assigned to each potential application 121 based at least in part on aggregated usage data 135, configuration data, or other data. It may be calculated by determining which criteria embodied in the associated discriminant knowledge base 144 entries are met. Scores or probabilities are also based at least in part on application 121 that has been identified in advance or may be known to run on the machine instance 114 or on the machine instance 114 with which the machine instance 114 communicates. It may be calculated or weighted.

In other embodiments, identifying application 121 running on machine instance 114 embodies monitored machine learning algorithms in aggregated usage data 135 and configuration data, as well as in the discriminating knowledge base 144. It may include applying to the knowledge base. Application 121 running on machine instance 114 may also be identified by other approaches.

After at least one application 121 is identified as running on machine instance 114, the identification is stored in the application profile 147 defined for machine instance 114, the time period associated with the data aggregation, or another data point. To. Application profile 147 may also include metadata 151 obtained from an instance metadata web service or application program interface, loaded from data store 111, or obtained by another approach.

Report module 154 may then generate report 157 that embodies the analysis associated with the stored application profile 147. Report 157 may be generated in response to a request from client 104, at predetermined intervals, or in response to some other criterion. The generated report 157 is communicated to client 104 via network 107 as a short message system (SMS) message, email attachment, network page encoded for rendering by browser client application 161 or, as an alternative approach. May be done. The generated report 157 may also be stored in data store 111. Other actions may also be taken with respect to the generated report 157.

Figures 2A-2D represent different levels of detail regarding the data center architecture 200, according to different embodiments. The various components of the data center architecture 200 and their various subcomponents, shown in Figures 2A-2D, are the computing environment 101 (Figure 1) to facilitate the execution of Machine Instance 114 (Figure 1), as described. The implementation of the example of 1) is shown.

FIG. 2A represents a regional level diagram of an example of data center architecture 200 according to various embodiments. Regions 201a-n are a plurality of logical groups including a plurality of available zones 204a-n and 205a-n. Regions 201a-n may be grouped at least in part based on geography, borders, logical or graphical topologies, or some other approach. For example, regions 201a-n may be grouped by United States geographic regions such as Southwest, Midwest, Northwest, or other geographic regions. Other approaches may also be used to define regions 201a-n.

Each region 201a-n includes one or more available zones 204a-n or 205a-n. Each of the available zones 204a-n or 205a-n is a logical group containing one or more data centers 207a-n, 208a-n, 209a-n, and 210a-n. Available zones 204a ~ n or 205a ~ n are defined to be isolated from obstacles in other available zones 204a ~ n or 205a ~ n, and other available zones 204a ~ in the same area 201a ~ n. Defined to optimize the potential cost associated with connectivity to n or 205a ~ n. For example, distinctly different available zones 204a-n or 205a-n may include distinctly different networks, power circuits, generators, or other components. Further, in some embodiments, a single data center 207a-n, 208a-n, 209a-n, or 210a-n may include multiple available zones 204a-n or 205a-n. Regions 201a-n communicate with each other through network 107 (Fig. 1).

In some embodiments, the network traffic pattern 141 (FIG. 1) is a source or destination area 201a-n, an available zone 204a-n or 205a-n, a data center 207a-n, 208a-n, 209a-n, Alternatively, it may embody patterns of network communication with respect to 210a-n, or other components of the data center architecture 200.

FIG. 2B shows a data center level diagram of an example of data center architecture 200. The data center level diagram may represent an architecture implemented in a data center 207a-n, 208a-n, 209a-n, or 210a-n. Data center 207a contains at least one rack collection 211a-n, and each rack collection 211a-n contains at least one corresponding rack 214a-n or 215a-n. Data center 207a may also include at least one service rack collection 216, including racks 217a-n that facilitate the implementation of machine instance 114 (Figure 1).

Each rack collection 211a-n or 216 also includes at least one power system 218a-n or 219 to which the corresponding group or rack 214a-n, 215a-n, or 217a-n is connected. The power system 218a ~ n or 219 is implemented to facilitate cable laying, switches, batteries, unimpeded power supplies, generators, or power supply of racks 214a ~ n, 215a ~ n, or 217a ~ n. May include other components.

Each rack collection 211a-n or 216 is linked to the local network 221a-n or 222. The local network 221a-n or 222 is implemented to facilitate data communication between the components of the corresponding rack collection 211a-n. The local network 221a-n or 222 also facilitates data communication between the corresponding rack collections 211a-n or 216 and network 107. In some embodiments, the network traffic pattern 141 (FIG. 1) is a source or destination rack collection 211a-n or 216, rack 214a-n, 215a-n, or 217a-n, or other data center architecture 207a. Network communication patterns may be embodied with respect to components.

FIG. 2C illustrates a rack collection level implementation of the data center architecture 200 in various embodiments. Rack collection level implementations may be representative of rack collections 211a-n or 216. For example, rack collection 211a includes a plurality of racks 214a-n that are further subdivided into a subset of racks 214a-g and racks 214h-n. Each rack 214a-n includes a plurality of servers 221a-n, 222a-n, 223a-n, or 224a-n and potentially other functionality. Each server 221a-n, 222a-n, 223a-n, or 224a-n may include shared or distinctly different hardware configurations. Each of the racks 214a-n may also include at least one switch 227a-n to which the corresponding servers 221a-n, 222a-n, 223a-n, or 224a-n connect. Rack collection 211a also includes the hierarchy of aggregate routers 231a-n. Figure 2C shows a two-level hierarchy of aggregate routers 231a-n, but it is understood that one or more levels of aggregate routers 231a-n may be implemented. The highest level of the aggregation routers 231a to n is communicating with the external network 107 (Fig. 1).

Aggregation routers 231a-n facilitate network communication routing to servers 221a-n, 222a-n, 223a-n, or 224a-n. To this end, each of the switches 227a-n is in data communication with the aggregation routers 231a-n.

In some embodiments, network traffic pattern 141 (FIG. 1) relates to servers 221a-n, 222a-n, 223a-n, or 224a-n, racks 214a-n, or other components 211a of the rack collection architecture. , The network communication pattern may be embodied. Further, in some embodiments, the routing configuration 137 (FIG. 1) is a switch 227a-n, server 221a-n, 222a-n, 223a-n, or 224a-n, aggregate router 231a-n or rack collection. The configuration associated with the other components of 211a may be embodied.

Figure 2D illustrates server 221a as implemented in data center architecture 200. Although FIG. 2D is drawn for server 221a, it is understood that FIG. 2D may represent any server 221a-n, 222a-n, 223a-n, or 224a-n.

One or more machine instances 114 run on server 221a. Machine instance 114 includes a virtualized instance of an operating system to facilitate the execution of services, applications, or other functionality. Each machine instance 114 communicates with the virtualization layer 237. Virtualization layer 237 controls access to hardware layer 241 by each of the executed machine instances 114. Virtualization layer 237 further includes privileged domain 244. Privileged domain 244 has distinctly different or high levels of user privileges on other executed machine instances 114 to facilitate interaction between machine instance 114, hardware layer 241 or other components. It may include machine instance 114. Privileged domain 244 may also include restricted access to an authorized subset of users, such as system administrators, and limited behavior of privileged domain 244. Privileged domain 244 may facilitate the creation and management of machine instance 114.

Hardware layer 241 includes various hardware components implemented to facilitate the operation of machine instance 114 and their associated performed functionality. Hardware layer 241 may include network interface cards, network routing components, processors, memory, storage devices, or other components. In some embodiments, the usage data 135 (FIG. 1) may include usage or access rates of other components of virtualization layer 237, hardware layer 241 or server 221a.

Next, with reference to FIG. 3A, an example of report 157 (FIG. 1) encoded by report module 154 (FIG. 1) for communication to client 104 (FIG. 1) is shown. In some embodiments, the user interface shown in FIG. 3A comprises a network page encoded for rendering by the browser client application 161 (FIG. 1). Alternatively, the user interface may include data encoded for rendering by the dedicated client application 161.

Item 301 details the use of application 121 for a particular vendor as implemented in machine instance 114 (Figure 1) and illustrates report 157 classified by data center region and individual application 121. To do. Item 304 is a uniform resource locator (URL) directed to the network page that embodies Report 157. Item 307 is a text identifier corresponding to the name of the vendor from which Report 157 was generated. Item 311 is a text identifier indicating the data embodied in Report 157.

Item 314 is a column of the table in which the cell defines the data center region and the other cells in the row correspond to it. Item 317 is a column in the table whose cells define three different applications 121 sold by the vendor. Item 321 is the utilization of the corresponding application 121 in the corresponding data center area. Item 324 is the utilization of competing applications 121 in the corresponding data center region. In particular, other statistics, such as the number of running instances of the application, may be available in the same way.

Next, with reference to FIG. 3B, an example of report 157 (FIG. 1) encoded by report module 154 (FIG. 1) for communication to client 104 (FIG. 1) is shown. In some embodiments, the user interface illustrated in FIG. 3B includes a network page encoded for rendering by the browser client application 161 (FIG. 1). Alternatively, the user interface may include data encoded for rendering by the dedicated client application 161.

Item 331 details the use of application 121 as implemented in machine instance 114 (Figure 1) for the eastern US data center region and illustrates report 157 classified by data center region and application 121. .. Item 334 is a uniform resource locator (URL) directed to the network page that embodies Report 157. Item 337 is the text identifier corresponding to the name of the data center area in which Report 157 was generated. Item 341 is a text identifier indicating the data embodied in Report 157.

Item 344 is a column of the table in which the cell defines the vendor corresponding to the application 121 usage. Item 347 is a column of tables in which the cell embodies Application 121 usage in the US Eastern Data Center region for the corresponding vendor. Item 351 is a pie chart generated to embody the data described in items 344 and 347.

Moving on to FIG. 4, a flowchart is shown that provides one embodiment of some of the operations of inventory application 117 (FIG. 1) according to various embodiments. The flowchart of FIG. 4 simply provides examples of many different types of functional arrangements that may be used to implement some behavior of the inventory application 117, as described herein. It is understood that Alternatively, the flowchart of FIG. 4 may be drawn to illustrate an embodiment of the steps of a method implemented in a computing environment 101 (FIG. 1) according to one or more embodiments.

Starting with box 401, the inventory application 117 data aggregation module 134 (Figure 1) generates network traffic pattern 141 (Figure 1) and usage data 135 (Figure 1) for machine instance 114 (Figure 1). Generating usage data 135 is, for example, sampling CPU usage, GPU usage, memory usage, disk access, or other related to machine instance 114 accessing compute resources in compute environment 101. Data may be included. Generating network traffic pattern 141 involves intercepting or monitoring network packets communicating with machine instance 114 to determine networking protocols, source network addresses, destination network addresses, or other information. It may be. Usage data 135 and network traffic pattern 141 may also be generated by other approaches.

Next, in box 404, the data aggregation module 134 acquires the network configuration 127 (FIG. 1), instance type 124 (FIG. 1), and routing configuration 137 (FIG. 1) associated with the machine instance 114. Network configuration 127, instance type 124, and routing configuration 137 may be obtained from data store 111 (FIG. 1). Network configuration 127 may also be generated by performing port scanning, network probing, or other actions on machine instance 114. The routing configuration 137 may also be obtained by querying the application program interface or other functionality of a networking component such as a router, switch, or load balancer. Network configuration 127, instance type 124, and routing configuration 137 may also be obtained by another approach.

In box 407, data aggregation module 134 then acquires the pre-generated identification of application 121 (Figure 1) running on machine instance 114. This may include loading application profile 147 (Figure 1) associated with machine instance 114 from data store 111. This may also include accessing the identification of the application 121 identified by the concurrent processes of the data aggregation module 134 or the identification stored in locally accessible memory. Obtaining the pre-generated identification of application 121 may also be done by another approach.

Then, in box 411, the data aggregation module 134 then identifies at least one application 121 that was executed in one of the machine instances 114. It calculates scores or percentages for multiple potential applications 121, for example, and identifies one of the potential applications 121 with the highest score or percentage, such as running on machine instance 114. And may be included. This may also include identifying potential applications 121 whose score or percentage exceeds a threshold while running on machine instance 114. Scores or percentages are determined by usage data 135, network traffic patterns 141, network configurations 127, instance types 124, routing configurations 137, pre-identified applications 121, or potentially data embodied in other data. It may be calculated at least in part based on the criteria embodied in the Discrimination Knowledge Base 144 (FIG. 1) that is satisfied.

In box 414, after identifying at least one application 121 running on machine instance 114, the identification of application 121 and metadata 151 (Figure 1) is the application associated with machine instance 114 where application 121 was identified. Stored as profile 147 entries. Metadata 151 may be retrieved by querying a web service that is retrieved from the data store 111 or by another approach.

The embodiments of the present disclosure may be described with the following remarks in mind. Appendix 1. With code to get the disk configuration of one of multiple machine instances running multiple applications, Code that gets the network traffic permission configuration for one of the machine instances so that the network traffic permission configuration accepts network traffic for an open port, a set of network addresses, or for that reason one of the machine instances. The code, which defines at least one of the configured networking protocols, Code that retrieves the network traffic routing configuration associated with one of the machine instances, where the network traffic routing configuration is between one of the machine instances and one of the machine instances that is distinctly different. The code that defines the network traffic flow for Of the application, at least partially based on the disk configuration, network traffic routing configuration, network traffic permission configuration, and the second one of the applications, without internal inspection of one of the machine instances. The code that identifies the first one, A code that stores the identification of the first one of the applications as one of the multiple identifications stored in the data store, A persistent computer-readable medium that embodies a program that can be run on at least one computing device, including code that produces analytical reports that embody identification. Appendix 2. The program It also contains code to determine if one of the machine instances is connected to the load balancing service. The persistent computer-readable medium according to paragraph 1, wherein the first of the identifications is identified at least in part based on the determination. Appendix 3. The program has at least one of the central processing unit (CPU) usage, graphics processing unit (GPU) usage, disk usage, or memory usage associated with one of the machine instances. Includes additional code to determine The first of the applications is identified on a central processing unit (CPU) usage, graphics processing unit (GPU) usage, disk usage, or memory usage, at least in part. Persistent computer-readable medium described in. Appendix 4. With at least one computing device, A system that includes an inventory application that can be run on at least one computing device. The logic of retrieving data that embodies interoperability between at least a subset of machine instances, Includes logic that generates an identification for at least one application running on one of the machine instances, at least in part based on the data. A system in which the inventory application runs outside the machine instance and does not perform an internal check on one of the machine instances. Appendix 5. The logic that generates the identification is With the logic of calculating the probability that the identification corresponds to at least one application, based on at least part of the data, The system according to paragraph 4, further comprising logic that associates the identification with at least one application in response to a probability exceeding a threshold. Appendix 6. The system described in Section 4, where the data contains at least one of an open port, a set of network addresses, or a networking protocol for which one of the machine instances accepts network traffic. Appendix 7. The data contains a network traffic routing configuration associated with one of the machine instances that defines the network traffic flow between one of the machine instances and a distinctly different one of the machine instances. The system according to paragraph 4, wherein the identification is generated at least in part based on the network traffic routing configuration. Appendix 8. The system according to paragraph 4, wherein the identification is generated at least in part based on the previously generated identification. Appendix 9. The system according to paragraph 4, wherein the data contains an open network port and the identification is generated at least in part based on the open network port being the default open network port for at least one application. Appendix 10. The inventory application It further includes the logic to acquire a redundant array (RAID) configuration of independent disks for said one of the machine instances. The system according to paragraph 4, wherein the identification is generated at least in part based on the RAID configuration. Appendix 11. The system described in Section 4, where the data contains a load balancing configuration. Appendix 12. The inventory application Further logic to determine at least one of the central processing unit (CPU) usage, graphics processing unit (GPU) usage, disk usage, or memory usage associated with one of the machine instances. Including The system according to paragraph 4, wherein the identification is generated at least partially based on CPU usage, GPU usage, disk usage, or memory usage. Appendix 13. The system described in Section 4, where identification is generated at least partially based on the disk size of one of the machine instances. Appendix 14. An instance type in which one of the machine instances defines at least one of a memory usage threshold, an input / output (I / O) threshold, a CPU usage threshold, or a GPU usage threshold. The system according to paragraph 4, wherein the identification is generated at least partially based on the instance type associated with. Appendix 15. The system described in Section 4, where the data contains network traffic permissions defined for a subset of machine instances. Appendix 16. The inventory application The logic of storing and storing the identification as one of multiple identifications, The system according to paragraph 4, further comprising the logic of generating an analysis report, at least in part based on the identification. Appendix 17.1 Obtaining data that embodies the interoperability of behavior between a subset of machine instances running at least one application on one or more computing devices. A method that includes, in a computing device, identifying at least one application based on at least part of the data, without internal inspection of multiple machine instances. Appendix 18. Identifying at least one application In computing devices, calculating multiple scores, each corresponding to one of multiple potential application identities, 12. The method of paragraph 14, comprising identifying at least one application as one of the highest scored potential application identities in a computing device. Appendix 19. The method of paragraph 14, wherein the data contains at least one of a RAID configuration, disk size, or disk partition. Appendix 20. An instance type in which one of the machine instances defines at least one of a memory usage threshold, an input / output (I / O) threshold, a CPU usage threshold, or a GPU usage threshold. The method of paragraph 14, wherein the identification is generated at least partially based on the instance type associated with. Appendix 21. Described in Section 14, where the data includes a network traffic authorization configuration that defines at least one of the open ports, network address sets, or networking protocols that one of the machine instances accepts network traffic. the method of. Appendix 22. In computing devices, further including generating network traffic patterns that embody network communication between a subset of machine instances. The method of paragraph 14, wherein the identification of at least one application is at least partially based on network traffic patterns. Appendix 23. In a computing device, remembering the identifier of at least one application in the data store, The method of paragraph 14, further comprising generating an analytical report embodying an identifier and a plurality of pre-stored identifiers in a computing device. Appendix 24. The method described in Section 14, wherein the data contains a network traffic routing configuration that defines the network traffic flow between a subset of machine instances.

Referring to FIG. 5, a schematic block diagram of the computing environment 101 according to an embodiment of the present disclosure is shown. The computing environment 101 includes one or more computing devices 501. Each computing device 501 includes, for example, at least one processor circuit, both having a processor 502 and a memory 504 coupled to a local interface 507. To this end, each computing device 501 may include, for example, at least one server computer or similar device. The local interface 507 may include, for example, a data bus having an attached address / control bus or other bus structure, as can be understood.

Both the data that can be executed by processor 502 and a few components are stored in memory 504. In particular, the machine instance 114, inventory application 117, and potentially other applications are stored in memory 504 and can be executed by processor 502. Data store 111 for storing usage data 135, routing configuration 137, network traffic patterns 141, identifying the knowledge base 144, an application profile 147, and other data is also good stored in the memory 504 have. In addition, the operating system may be stored in memory 504 and run by processor 502.

As can be understood, it is understood that there may be other applications stored in memory 504 and run by processor 502. When any of the components described in this disclosure is implemented in the form of software, for example, C, C ++, C #, ObjectiveC, Java®, JavaScript®, Perl, PHP, VisualBasic. Any one of several programming languages such as (registered trademark), Python (registered trademark), Ruby, Flash (registered trademark), or other programming languages may be used.

Some software components are stored in memory 504 and can be executed by processor 502. In this regard, the term "executable" means a program file in a format that can ultimately be invoked by processor 502. An example of an executable program can be translated into machine code in a format that can be loaded into the random access section of memory 504, for example, and is loaded into the random access section of memory 504, a copied program launched by processor 502. It is possible to generate an instruction in the source code executed by the processor 502, which may be expressed in an appropriate format such as an object code, or in the random access part of the memory 504 executed by the processor 502 or the like. , May be source code that may be interpreted by another executable program. Executable programs include, for example, optical such as random access memory (RAM), read-only memory (ROM), hard drive, solid state drive, USB flash drive, memory card, compact disk (CD) or digital versatile disk (DVD). It may be stored in any part or component of memory 504, including disks, floppy disks, magnetic tapes, or other memory components.

Memory 504 is defined herein to include both volatile and non-volatile memory as well as data storage components. Volatile components are components that do not retain data values in the event of power loss. A non-volatile component is a component that retains data values in the event of power loss. Therefore, the memory 504 is, for example, a random access memory (RAM), a read-only memory (ROM), a hard disk drive, a solid state drive, a USB flash drive, a memory card accessed via a memory card reader, an associated floppy disk. Floppy disks accessed through disk drives, drives optical disks accessed through optical disks, magnetic tapes accessed through appropriate tape drives, and / or other memory components, or of these memory components. It may include a combination of any two or more of them. Further, the RAM may include, for example, static random access memory (SRAM), dynamic random access memory (DRAM), or magnetorandom access memory (MRAM) and other such devices. ROM may include, for example, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or other similar memory device.

Further, the processor 502 may represent a plurality of processors 502 and / or a plurality of processor cores, and the memory 504 may represent a plurality of memories 504 operating in a parallel processing circuit, respectively. In such a case, the local interface 507 is located between any two of the plurality of processors 502, between any of the processors 502 and the memory 504, or any two of the memory 504 and the like. It may be an appropriate network that facilitates communication between them. The local interface 507 may include, for example, an additional system designed to integrate this communication, including performing load balancing. Processor 502 may be of any electrical or other available configuration.

The inventory application 117 and various other systems described herein may be embodied in software or code executed by the general purpose hardware described above, but as an alternative, the same is dedicated. It may be embodied in a combination of hardware or software / general purpose hardware and dedicated hardware. When embodied in dedicated hardware, each can be implemented as a circuit or state machine using any one or combination of several techniques. These technologies provide a variety of logic functions on top of one or more data signal applications, application specific integrated circuits (ASICs) with suitable logic gates, field programmable gate arrays (FPGAs), or other components. It may include, but is not limited to, distinctly different logic circuits having logic gates for implementation. Such techniques are generally well known to those of skill in the art and are not described in detail herein.

The flowchart of FIG. 4 shows the functionality and operation of the implementation of the inventory application 117 part. When embodied in software, each block may represent a module, segment, or piece of code that contains a program instruction to implement a particular logical function (s). Program instructions are embodied in the form of source code, including human-readable state written in a programming language or machine code that contains numerical instructions that can be recognized by a suitable execution system such as processor 502 in a computer system or other system. May be done. The machine code may be converted from the source code or the like. When embodied in hardware, each block may represent a circuit or several interconnect circuits that implement a particular logical function (s).

Although the flowchart of FIG. 4 shows a particular order of execution, it is understood that the order of execution may differ from that shown. For example, the order of execution of two or more blocks may be scrambled in relation to the order shown. Also, the two or more blocks shown consecutively in FIG. 4 may be executed simultaneously or partially simultaneously. Further, in some embodiments, one or more blocks shown in FIG. 4 may be skipped or omitted. In addition, a number of counters, state variables, warning semaphores, or messages have been added to the logical flow described in this disclosure to provide enhanced utilities, accounting, performance measurements, or troubleshooting assistance. May be done. It is understood that all such modifications are within the scope of this disclosure.

Also, any logic or application described in this disclosure, including inventory application 117, including software or code, is used by, or with, for example, an instruction execution system such as processor 502 in a computer system or other system. It can be embodied in any persistent computer-readable medium for related use. In this sense, logic may include, for example, states that include instructions and declarations that can be fetched from a computer-readable medium and executed by an instruction execution system. In the context of this disclosure, "computer-readable medium" includes, stores, or maintains the logic or applications described in this disclosure for use by, or in connection with, an instruction execution system. It can be any possible medium.

A computer-readable medium may include any one of many physical media, such as, for example, magnetic, optical, or semiconductor media. Further specific embodiments of suitable computer-readable media include, but are not limited to, magnetic tapes, magnetic floppy disks, magnetic hard drives, memory cards, solid state drives, USB flash drives, or optical disks. Further, the computer-readable medium may be, for example, a static random access memory (SRAM) and a dynamic random access memory (DRAM), or a random access memory (RAM) including a magnetic random access memory (MRAM). In addition, computer readable media can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or other types of memory. It may be a device.

It should be emphasized that the above-described embodiments of the present disclosure are merely feasible examples of implementation presented to articulate the principles of disclosure. Many modifications and modifications may be made to the embodiments described above, without substantially departing from the spirit and principles of disclosure. All such modifications and modifications are contained herein within the scope of this disclosure and are intended to be protected by the following claims.