| CPC H04L 63/20 (2013.01) [G06F 21/52 (2013.01); H04L 63/1425 (2013.01); G06F 2221/033 (2013.01)] | 20 Claims |

|
1. A computer-implemented method of monitoring applications executing on a plurality of computing nodes, said method comprising:
deploying agents on the computing nodes, at least one agent on each computing node, to detect operations performed on different objects by the executing applications;
at each of the computing nodes, storing by a corresponding one of the agents, records of the operations performed on the different objects by the executing applications, that contain properties of the operations performed on the different objects by the executing applications, in a plurality of program tables that include a first program table for storing the records of the operations performed on the different objects by a first executing application and a second program table for storing the records of the operations performed on the different objects by a second executing application, and associating each of the operations with a set of metadata properties;
organizing the operations having records stored in the plurality of program tables into groups based on the metadata properties;
for one of the groups, generating a monitoring rule based on the properties of the the operations of the one group that are stored in the records thereof; and
configuring the agents according to the generated monitoring rule.
|