Dynatrace LLC

A computer-implemented method for storing and querying application performance monitoring (APM) data in a database, includes receiving data records of APM data, each data record associated to a key; storing the data records in storage containers in the database, each record stored in one storage container and each storage container identified by a unique storage identifier; assigning a unique index value to each unique key; defining a distribution function mapping the keys to the index values; generating a secondary function to approximate the distribution function; defining a mapping function to map the index values to lists of storage identifiers; and in response to a request to retrieve data records for a specified key or keys, querying the database to identify a list of storage identifiers based on the secondary function and the mapping function and retrieving the data records for the specified key or keys.

A computer-implemented method is presented for extracting data from textual records. The objective of the disclosure is to identify the most appropriate pattern in a set of patterns for extracting data from data records and by applying the most appropriate pattern to a plurality of data records, to robustly extract data from textual records.

A unified storage format is presented for received observation data records of various formats, including individual observations or histograms and pre-sampled records describing multiple observations. The proposed storage format also supports various data reduction technologies, including coarsening of time and observation value resolutions, where the proposed data reduction technologies retain data describing the quantity of observations. In addition, sampling-based data reduction approaches are described, which at least retain the statistical expectancy value for the number of observations. Further, a definition and storage format for histogram buckets is provided with guaranteed relative error behavior over the whole value range of observation data, that only requires the definition of a number of significant bits for the recording and interpretation of histogram data. The proposed histogram storage scheme is applicable to integer and floating-point observation data.

A computer-implemented method is presented for storing log data generated in a distributed computing environment. The method includes: receiving a log line from a given storage entity; applying a first tokenization rule to create a plurality of base tokens; applying a second tokenization rule to create a plurality of combination tokens; applying a third tokenization rule to create a plurality of n-gram tokens; combining the plurality of tokens into a set of tokens; for each token in the set of tokens, storing a given token by applying a hash function to the given token to generate a hash value, where the given token is associated with the given storage entity containing the log line; updating a listing of entities with the given storage entity, where entries in the listing of entities are configured to identify more than one storage entity and each entry in the listing of entities specifies a unique set of storage entities; and storing the hash value, along with an address, in a token map table of a probabilistic data structure, where the address maps the hash value to an entry in the listing of entities.

A computer-implemented method is presented for visualizing log data captured in a computer system. The method includes: receiving a plurality of log records, where each log record includes a severity indicator; grouping log records in the plurality of log records into groups of log records, such that log records in a given group of records are chronological; for each group of log records, extracting one or more templates from a given group of log records, where each template is comprised of a text string representing log records in the given group of log records; for each group of log records, computing a similarity measure between a given group of log records and the remaining groups of log records; and visualizing the groups of log records by projecting each group of log records onto a multi-dimensional plane based on the similarity measures for the groups of log records and connecting projections for the groups of log records in chronological order using a line.

A computer-implemented method is presented for storing and querying records from a data segment. The objective of the disclosure is to find computer-implemented methods for storing and querying records from a data segment that are fast and space efficient storing and querying of APM data stored in a segmented database.

The present disclosure relates to the detection of cross-site scripting vulnerabilities in a web application. The objective of the disclosure is to find a computer-implemented method for detecting cross-site scripting vulnerabilities in a web application. The detection of XSS vulnerabilities shall be performed automatically and the number of false positives shall be reduced compared to the prior art.

A computer-implemented method is presented for determining primary keys in a table of a database system. The method includes: determining a number of rows in the table; for a given column of the table, generating a probabilistic data structure for the given column, where the probabilistic data structure is partitioned into a plurality of registers and configuration parameters for the probabilistic data structure includes a first recording parameter, base, that controls recording of data into the probabilistic data structure; computing a cardinality estimate for the given column using the probabilistic data structure; computing a ratio between the cardinality estimate for the given column and the number of rows in the table; comparing the ratio to a threshold; and designating the given column as a primary key for the table in response to the ratio being greater than the threshold.

A prioritized method is presented for updating software in a distributed computing environment. The objective of the disclosure is to find a computer-implemented method for updating software on pods in the distributed computing environment. This is solved by calculating a risk rating for each pod in the manifest, taking into account a vulnerability score of the pod, the minimum number of inbound hops for reaching the pod, and the communication relationship between the given pod and other pods. Pods in the manifest are updated in accordance with the calculated risk ratings.

A technology is disclosed for estimating the impact that heap memory allocations have on the behavior of garbage collection activities. Allocation monitoring data, including type and size of the allocated object and data describing the code location on which the allocation was performed are gathered. Further, when the allocated object is later reclaimed by garbage collection is recorded. Gathered object allocation and reclaim data are used to estimate for individual allocation sites or types of allocated objects, the number of bytes that are allocated, and the number of bytes that survived a garbage collection run. Allocation activity causing frequently garbage collection runs is identified using allocation size data and the survived byte counts are used to identify allocation activity causing long garbage collection runs. Further allocation monitoring data is correlated with transaction trace data to identify the impact of transactions or transaction classes on garbage collection behavior.