US Patent 11470172 Using network connections to monitor a data center

An agent executes in user space on a machine and monitors for network connections. In response to detecting an initiation of a network connection, data associated with a process associated with the network connection is collected, e.g., by the agent. At least a portion of the collected process data is reported to an external node. The reported information can be used to detect anomalies in a network environment.