aspects of the present disclosure relate to profiling tasks performed in distributed systems , more particular aspects relate to tracing calls across virtual machines to enable profiling in a distributed computing system . while the present disclosure is not necessarily limited to such applications , various aspects of the disclosure may be appreciated through a discussion of various examples using this context . computing resources are increasingly provided to users through layers of abstraction by distributed computing systems or environments ( herein , distributed systems ). these distributed systems may provide to users conventional computing resources , such as processing , memory , and long - term storage with increased scalability that a singular computing device cannot provide . moreover , distributed systems may provide advantages over installations of multiple computers at a single physical location , such as redundancy , and energy efficiency . for these benefits , and others , distributed systems have been adopted in a variety of industries . in telecommunications services , distributed systems provide the resources to run wireless and wired networks . ubiquity of service , nurtured through the telephone system , demands that the internet be provided seamlessly to end users — an ideal demand for distributed systems to meet . likewise , complex computational problem solving ( alternatively , clustering or grip computing ) requires massive amounts of processing power . distributed systems are often the only systems that can operate on the large data sets required by complex computational problem solving . finally , the ability to take advantage of cloud computing , where ever - present network services meet centralized data and resources , is often not possible without distributed systems . historically , software has been created for a single computer system ( e . g ., a software program that runs on a physical machine ). the software performs tasks requested by the user , such as browsing a collection of files , or calculating a mathematical formula . often , to implement a distributed system , software developers have utilized virtual machines to create software . virtual machines ( alternatively , process virtual machines or system virtual machines ) emulate the resources of a typical physical computer or program execution environment in a software construct . virtual machines provide flexibility and portability to programs , ( e . g ., a computer system of one architecture can execute software written for another architecture by a virtual machine ). profilers have enabled software written for a singular computing machine to be observed . as users request tasks to be performed by a software program , a profiler may be able to analyze the software program and provide information about program execution ( e . g ., memory usage , call patterns , stack information , and timestamps ). additionally , there exist profilers for virtual machines , such that a user may analyze the performance of the software program as it performs tasks . to allow distributed systems to scale upwards in complexity of tasks and number of users , software developers increasingly split tasks into multiple subtasks . this provides a challenge for profilers . in detail , tasks conventionally performed by a single - machine software program , in a distributed system are divided into subtasks that can be performed by a series of virtual machines . traditional approaches to profiling software have various drawbacks when determining the performance of multiple virtual machines . a conventional profiler may be adapted to profile the entire task through multiple virtual machines . however , because all communication internal and external of all virtual machines of the distributed system must be recorded , it may be an impractical way to provide meaningful performance information . additionally , adapted profilers may only record information based on periodic checks , which may exclude some meaningful interaction between virtual machines . an adapted conventional profiler may provide information for a distributed system executing a single task . but as a distributed system scales to perform many tasks concurrently , the information is ineffectual to identify distributed system performance . using a single profiler to provide information about one of many virtual machines is also of limited value . while any subtasks being performed in the profiled virtual machine may be observed the vast majority of subtasks , those sent to other virtual machines , yield no profiled information . finally , existing profiling techniques are inoperable to diagnose distributed systems for a variety of other reasons ( e . g ., unacceptable impact on the function of the distributed system while performing a production - environment load , inability to pinpoint performance problems , inability to provide accurate information , and inability to enable and disable portions of the profiling capability in the middle of a task or tasks being performed ). consistent with various embodiments , a distributed profiler may enable users to determine performance characteristics of a distributed system . a distributed profiler may comprise a profiler controller and multiple profiler instances . it should be appreciated that in instances where a performance problem is identified in a specific virtual machine of a distributed system , a distributed profiler may operate with a single profiler instance . the distributed profiler may operate separately from any existing virtual machine profiler or system profiler . the distributed profiler may operate in concert with an existing virtual machine profiler by altering the default functionality of an existing virtual machine profiler ( e . g ., by utilizing delegation ). the distributed profiler may monitor a virtual machine while minimally altering performance of the virtual machine , which provides the user with meaningful information regarding the distributed system . the distributed profiler may be able to identify a task that has been subdivided into a variety of subtasks as the subtasks are called and results from the subtasks are returned from a multitude of virtual machines . the distributed profiler may be able to operate across a local area network . the distributed profiler may be able to operate across a wide area network , such as the internet . fig1 depicts a distributed profiler 110 operating within an example system 100 consistent with embodiments of the present disclosure . the system 100 may include physical computers 120 a , 120 b , and 120 c ( collectively , 120 ) connected by a network 130 . in some embodiments , the network 130 may be a local area network , and the physical computers 120 may be located in the same datacenter . in some embodiments , the network 130 may be a wide area network ( e . g ., the internet ) and the physical computers 120 may be located in different geographic locations . a distributed system may operate based upon computers 120 b and 120 c and may comprise virtual machines 140 a , 140 b , and 140 c ( collectively , 140 ). computer 120 b may execute virtual machine 140 a and computer 120 c may execute virtual machine 140 b and virtual machine 140 c . the distributed system may perform tasks for one or more users by dividing each of the tasks into subtasks to be performed by the virtual machines 140 . the virtual machines 140 may perform a single subtask . in some embodiments , one or more of the virtual machines 140 may perform multiple subtasks . the virtual machines 140 may communicate with each other by using one or more communication streams 150 a , 150 b , and 150 c ( collectively , 150 ). virtual machine 140 a may use communication stream 150 a , virtual machine 140 b may use communication stream 150 b , and virtual machine 140 c may use communication stream 150 c , respectively . the communication streams 150 may send data from and receive data for the virtual machines 140 . in some embodiments , the communication streams 150 may be two data streams ( e . g ., an output stream for sending data , and an input stream for receiving data ). in some embodiments , there may be one or more communication streams for each subtask of a given virtual machine . the communication streams 150 may transport subtask calls between the virtual machines 140 . the communication streams 150 may transport subtask calls between subtasks of the same virtual machine ( e . g ., a first subtask on virtual machine 140 c may utilize communication stream 150 c to transport a subtask call to a second subtask on virtual machine 140 c ). the distributed system may provide a service to end users . for example a photo sharing service may be hosted by the distributed system and may be accessible to end users by means of the internet . the photo sharing service may be divided into a multitude of subtasks ( not depicted ). virtual machine 140 a may perform the following subtasks : a first subtask for receiving end - user requests for navigating a user - interface , saving and sharing pictures , creating associations between pictures and altering metadata of pictures , and altering content of pictures ; a second subtask for receiving pictures from end users ; and a third subtask for sharing pictures with services external to the distributed system . virtual machine 140 b may perform the following subtasks : a fourth subtask for detecting faces of humans in pictures and creating metadata based upon the detected faces ; a fifth subtask for saving metadata of pictures ; and a sixth subtask for saving associations between pictures . virtual machine 140 c may perform the following subtasks : a seventh subtask for saving new pictures uploaded from end - users to long - term storage ( not depicted ); an eighth subtask for retrieving pictures from the long - term storage ; a ninth subtask for altering the content of pictures ; and a tenth subtask for rendering the user - interface . the distributed profiler 110 may comprise profiler instances 160 a , 160 b , 160 c ( collectively , 160 ), and a profiler controller 170 . the profiler instances 160 may be capable of profiling the virtual machines 140 as they process subtasks ( e . g ., profiler instance 160 a may profile virtual machine 140 a , profiler instance 160 b may profile virtual machine 140 b , and profiler instance 160 c may profile virtual machine 140 c ). the profiler instances 160 may be able to collect information regarding the virtual machines 140 and any subtasks being performed by the virtual machines 140 . in some embodiments , the profiler instances 160 may be able to collect a set of profiler data ( i . e ., one or more attributes about the virtual machines 140 ). the profiler instances 160 may embed a unique identifier into subtask calls to track an instance of a task executed by the distributed system . the profiler controller 170 of the distributed profiler 110 may instruct the profiler instances 160 to begin operation at the same time . in some embodiments , the profiler controller 170 may instruct the profiler instances 160 to begin operation independently of each other , such as instructing only profiler instance 160 b to begin operation . the profiler controller 170 may execute on computer 120 a and may send communication to the profiler instances 160 through the network 130 . in some embodiments , the profiler controller 170 may execute from computer 120 b or computer 120 c , and communication to one or more of the profiler instances 160 may take place without use of the network 130 . the profiler controller 170 may receive profiler information from the profiler instances 160 and may evaluate performance based upon this information . the profiler controller 170 may instruct the profiler instances 160 based upon the profiler information received from the profiler instances . the profiler controller 170 may know the architecture and topology of the distributed system . the profiler controller 170 may know the interaction between the computers 120 , the virtual machines 140 , and the communication streams 150 of the distributed system . the profiler controller 170 may know when the virtual machines 140 use the communication streams 150 to communicate internally ( e . g ., a subtask on virtual machine 140 a calling another subtask on virtual machine 140 a ). the profiler controller 170 may know when the virtual machines 140 use the communication streams 150 to communicate externally ( e . g ., subtask on virtual machine 140 a calling another subtask on virtual machine 140 b ). the profiler controller 170 may instruct the profiler instances 160 based upon its knowledge . the distributed profiler 110 may analyze tasks performed by the distributed system . to continue the above example , as users begin to operate the described photo sharing service , the virtual machines 140 cooperatively perform subtasks . if a system administrator wants to observe performance of the photo sharing service while users are using the photo sharing service , the system administrator may utilize the distributed profiler 110 . to begin profiling the photo sharing service , the profiler controller 170 may send a first instruction to profiler instance 160 a . profiler instance 160 a may begin to profile the operation of virtual machine 140 a in response to the first instruction . as users navigate the photo sharing service , subtasks may be performed by virtual machine 140 a and attributes of performance may be captured by profiler instance 160 a . profiler instance 160 a may record attributes , such as the start times and end times of instances of the first subtask , second subtask , and third subtask described above . profiler instance 160 a may also record other attributes about instances of the first subtask , second subtask , and third subtask ( e . g ., performance of code sections of the subtasks , names of variables created by the subtasks , memory used by the subtasks , processing cycles of the subtasks , processor utilization of the subtasks , etc .). in some embodiments , profiler instance 160 a may also record other attributes about virtual machine 140 a generally ( e . g ., total memory used , total processing time , network utilization , etc .). profiler instance 160 a may transmit the attributes regarding virtual machine 140 a to the profiler controller 170 . the profiler controller 170 may identify a first task of the distributed system ( e . g ., an execution instance of a first user of the photo sharing service ) in response to the attributes received by profiler instance 160 a . in a usage example , if the first user requests to alter the metadata of some photos , virtual machine 140 a may execute a first instance of the first subtask , and profiler instance 160 a may identify that the first instance is related to the first user . virtual machine 140 a may also make a first call to virtual machine 140 c to render the graphical user interface for the first user . virtual machine 140 c may execute a first instance of the tenth subtask to render the user - interface , a first instance of the ninth subtask to retrieve pictures from long - term storage , and then return execution to virtual machine 140 a . the profiler instance 160 a may capture attributes of virtual machine 140 a before the first call to and after a first return from virtual machine 140 c , and may transmit attributes to the profiler controller 170 . however , the profiler controller 170 may be unable to understand any detail regarding virtual machine 140 c after the first call and before the first return ( e . g ., subtask performance of virtual machine 140 c , resource usage by virtual machine 140 c , subtask calls from virtual machine 140 c to virtual machine 140 b , etc .). to fully understand execution of the distributed system the profiler controller 170 may transmit through the network 130 a second instruction to profiler instance 160 b to profile virtual machine 140 b , and a third instruction to profiler instance 160 c to profile virtual machine 140 c . in response to the second instruction , profiler instance 160 b may begin collecting attributes related to the operation of virtual machine 140 b . in response to the third instruction , profiler instance 160 c may begin collecting attributes related to the operation of virtual machine 140 c . based on the first instruction , the second instruction , and the third instruction the profiler instances 160 may begin encoding subtask calls to the virtual machines 140 . the profiler instances 160 may modify the communication streams 150 to encode the subtask calls . this encoding of the subtask calls may include altering the name field of the subtask calls . in some embodiments , the encoding of the subtask calls may include altering other fields , ( e . g ., an altered identification field , an altered header , an altered footer , an altered unused field , an altered debug field , etc .). the format of the altered field may be a fixed length string . the format of the altered field may be a unique identifier , such as a key . the format of the altered field may be a combination of a values . the format of the altered field may be further modified for speed , size , security , or other reason ( e . g ., hashing ). the altered field may be generated by the profiler instances 160 . in some embodiments , the altered field may be generated by the profiler controller 170 . based on the first instruction , the second instruction , and the third instruction the profiler instances 160 may also begin decoding subtask calls from the virtual machines 140 . the profiler instances 160 may modify the communication streams 150 to decode the subtask calls . after a subtask call has been processed by one of the virtual machines 140 , the virtual machines may generate a subtask return . the profiler instances 160 may encode and decode the subtask returns in a similar manner to the encoding and decoding of the subtask calls . referring again to the photo sharing system example above , but prior to the first user requesting to manipulate the metadata of some photos , the profiler controller 170 may transmit instructions to the profiler instances 160 a and 160 c . in response to the instructions , the profiler instances 160 a and 160 c may begin to profile the virtual machines 140 a and 140 c , respectively . in response to the instructions , the profiler instances 160 a and 160 c may profile the communication streams 150 a and 150 c , respectively , by encoding subtask calls with unique identifiers . when the first user requests to alter the metadata of some photos , virtual machine 140 a may execute a first instance of the first subtask , and the profiler instance 160 a may identify that the first instance is related to a first task ( the first user manipulating metadata ). profiler instance 160 a may record attributes of virtual machine 140 a including the execution of the first instance of the first subtask . virtual machine 140 a may make a first call to virtual machine 140 c to render the graphical user interface for the first user . profiler instance 160 a may intercept the first call to virtual machine 140 c and embed a first identifier into the first call , copy the first identifier , and pass the first call to the communication stream 150 a . profiler instance 160 a may associate the recorded attributes with the first identifier , and pass the recorded attributes and the first identifier to the profiler controller 170 . when communication stream 150 c receives the first call for virtual machine 140 c , profiler instance 160 c may intercept the first call . profiler instance 160 c may copy the first identifier from the first call , remove the first identifier from the first call , and pass the first call to virtual machine 140 c . virtual machine 140 c may execute a first instance of the tenth subtask to render the user - interface and a first instance of the ninth subtask to retrieve pictures from long - term storage in response to the first call . profiler instance 160 c may record attributes of virtual machine 140 c including the execution of the first instance of the tenth subtask and the execution of the first instance of the ninth subtask . after execution , virtual machine 140 c may transmit a first return from the first call to virtual machine 140 a . profiler instance 160 c may associate the recorded attributes with the first identifier . profiler instance 160 c may intercept the first return , embed the first identifier into the first return , and pass the first return to communication stream 150 c . profiler instance 160 c may associate the recorded attributes with the first identifier and transmit the attributes of execution by virtual machine 140 c and the first identifier to the profiler controller 170 . when communication stream 150 a receives the first return for virtual machine 140 a , profiler instance 160 a may intercept the first return . profiler instance 160 a may copy the first identifier from the first return , remove the first identifier from the first return , and pass the first return to virtual machine 140 a . as virtual machine 140 a continues performing subtasks for the first user , the profiler instance 160 a may continue to record attributes and associate the attributes with the first identifier . profiler instance 160 a may transmit the attributes of execution by virtual machine 140 a and the first identifier to the profiler controller 170 . the profiler controller 170 may identify an instance of the task ( the first user manipulating metadata ) being executed based upon the attributes and the copies of the first identifier sent from profiler instances 160 a and 160 c . as execution continues and other subtasks are executed by the virtual machines 140 a and 140 c , the profiler instances 160 a and 160 c may continue to associate subtasks and subtask calls with the task , and the profiler controller 170 may continue to identify the execution instance of the task and sets of profiler data related to the task . during execution of the distributed profiler 110 , if the administrator wants to capture performance of virtual machine 140 b , the profiler controller 170 may transmit an instruction to profiler instance 160 b . in response to the instruction , operation of profiler instance 160 b may commence similarly to operation of profiler instances 160 a and 160 c . if multiple users are executing tasks on the distributed system at the same time , the distributed profiler 110 may coordinate execution of the subtasks by the distributed system in the same way ( e . g ., a second task comprised of a second set of subtasks executed by the virtual machines 140 is identified by the profiler controller 170 , a third task comprised of a third set of subtasks executed by the virtual machines is identified by the profiler controller , etc .). as they are identified each task may be associated with a different unique identifier to ensure the profiler controller 170 may be able to evaluate the performance of each task in the distributed system . fig2 a depicts a flowchart of a first example method 200 of using a first socket profiler consistent with embodiments of the present disclosure . a first profiler instance of a distributed profiler may include the first socket profiler and a first local profiler . the first socket profiler may operate by modifying code segments of a first virtual machine . the first socket profiler may embed one or more socket monitors into one or more communication sockets of the first virtual machine . the first socket profiler may operate based on one or more instructions from a profiler controller . each profiler instance of a distributed profiler may include a socket profiler and a local profiler . in some embodiments , method 200 of using the socket profiler may be executed by each profiler instance of the distributed profiler . further , some operations of method 200 may be executed by both each of the profiler instances and the profiler controller of the distributed profiler . the method 200 may comprise only a portion of execution of each profiler instance and additional methods ( not depicted ) may also be performed . at start 205 , the first profiler instance may begin to intercept calls 210 of communication from the first virtual machine , ( e . g ., from an outbound communication socket of the first virtual machine ). this ability to intercept calls 210 may be enabled by altering the code of the first virtual machine , such as embedding an outbound communication monitor . the outbound communication monitor may operate based on a network socket application programming interface . because the outbound communication monitor may operate at the socket level , any higher level communication may be captured by the intercepting of calls 210 . at 220 , a determination may be made as to whether a call should be altered . the determination of call alteration at operation 220 may be based upon a set of rules ( e . g ., one or more values related to the distributed system , one or more values related to the distributed profiler ). the set of rules may be received from the profiler controller . the set of rules may be based upon whether a call is intended for a different virtual machine . the set of rules may be based upon the name of a subtask being called by the call . the set of rules may be based upon a network address in the call . the set of rules may be based upon whether the virtual machine specified in the call is also being profiled by the distributed profiler . if a determination is made that the call should be altered , at 220 , a call token is generated by the first socket profiler at 222 . in some embodiments , the call token may be generated by the profiler controller . the call token may be a unique identifier . the call token may be generated by altering an existing value of the first virtual machine , such as a date field or name field . the call token may be generated by combining multiple fields or values together . the newly generated call token may be embedded into the call at 224 . the call token may be embedded by overwriting an entire field , such as the name field of the call . the call token may be embedded by appending a field , such as by being inserted into the beginning of the id field of the call . at 226 , the first socket profiler may update a local record cache of the first profiler instance with a set of profiler data regarding the call . the record may also be updated with the token from the call . the updated record may be transmitted by the first profiler instance to the profiler controller . after the call record is updated , per 226 ( or after 220 if it is determined that the call should not be altered ), the first socket profiler will instruct the socket monitor to pass the call to the output communication functionality of the first virtual machine at 228 . the first virtual machine may then pass the call to an appropriate second virtual machine , and the second virtual machine may execute subtasks based upon the call . the second virtual machine may generate a call return and may transmit the call return to the first virtual machine . the first socket profiler may intercept call returns , at 230 , of communication from the second virtual machine . the functionality of intercepting call returns , at 230 , may be enabled by altering the code of an inbound communication socket of the first virtual machine , such as by inserting an inbound communication monitor . the inbound communication monitor may operate based on the network socket application programming interface . at 232 , a determination if the call return contains a token may be performed . in some embodiments , the determination at 232 may be made as to whether a call return should be altered . the determination of call return alteration at 232 may be based upon a set of rules similar to the rules for determining call alteration at 220 . the determination of call return alteration , at 232 , may also be based upon the record kept by the first profiler instance . for example , if the call was altered by having a call token embedded , the first socket profiler may compare the intercepted call return with the record and determine if the token exists . if a determination is made that the call return contains a token , at 232 , the token may be stripped from the call return at 234 . at 236 , the first socket profiler may update the local records of the first profiler instance with a set of profiler data regarding the call return . the record may also be updated with the token from the call return . after the records are updated , per 236 ( or after 232 if the determination is made that the call return does not contain the call token ), the call return is passed to the first virtual machine for execution at 238 and method 200 ends at 245 . fig2 b depicts a flowchart of a second example method 250 of using a second socket profiler consistent with embodiments of the present disclosure . a second profiler instance of a distributed profiler may include the second socket profiler and a second local profiler . the second socket profiler may operate by modifying code segments of a second virtual machine ( e . g ., the second virtual machine in the description of fig2 a ). the second socket profiler may embed one or more socket monitors into one or more communication sockets of the second virtual machine . the second socket profiler may operate based on one or more instructions from a profiler controller ( e . g ., the profiler controller in the description of fig2 a ). each profiler instance of a distributed profiler may include a socket profiler and a local profiler . in some embodiments , method 250 of using the socket profiler may be executed by each profiler instance of the distributed profiler . further , some operations of method 250 may be executed by both each of the profiler instances and the profiler controller of the distributed profiler . the method 250 may comprise only a portion of execution of each profiler instance and additional methods ( not depicted ) may also be performed . at start 255 , a second profiler instance may begin to intercept requests 260 of communication transmitted to the second virtual machine , ( e . g ., from an inbound communication socket of the second virtual machine ). this ability to intercept requests 260 may be enabled by altering the code of the second virtual machine , such as embedding an inbound communication monitor . the inbound communication monitor may operate based on a network socket application programming interface . at 262 , a determination may be made as to whether a request ( e . g ., the call in the description of fig2 a ) contains a token . the determination at operation 262 may be based upon a second set of rules ( e . g ., one or more values related to the distributed system , one or more values related to the second distributed profiler ). the second set of rules may be received from the profiler controller . if a determination is made that the request contains a token , at 262 , the request token is stripped by the second socket profiler at 264 . at 266 , the second socket profiler may update a second local record cache of the second profiler instance with a set of profiler data regarding the request . the second record may also be updated with the token from the request ( e . g ., a copy of the token in the description of fig2 a ). the updated second record may be transmitted by the second profiler instance to the profiler controller . the second socket profiler may then pass the request to the second virtual machine at 268 . if it is determined that the request does not contain a token , at 262 , then the second socket profiler will instruct the second socket monitor to pass the request to the second virtual machine at 268 . the second virtual machine may then execute subtasks based upon the request . the second virtual machine may generate a request return ( e . g ., the call return in the description of fig2 a ) and may transmit the request return to the first virtual machine . the second socket profiler may intercept request returns , at 270 , of communication from the second virtual machine . the functionality of intercepting request returns , at 270 , may be enabled by altering the code of an outbound communication socket of the second virtual machine , such as by inserting an outbound communication monitor . the outbound communication monitor may operate based on the network socket application programming interface . at 272 , a determination if the request return should be altered may be made based upon the second record kept by the second profiler instance . for example , whether the request related to the request return contained a token . if a determination is made that the request return should be altered , at 272 , the token may be embedded in the request return at 274 . at 276 , the second socket profiler may update the second local records of the second profiler instance with a set of profiler data regarding the request return . the second record may also be updated with the token from the request return . after the second local records are updated , per 226 ( or if it is determined at 272 that the request return should not be altered ), then the second socket profiler may instruct the second socket monitor to pass the request return to the output communication functionality of the second virtual machine at 228 and method 250 ends at 285 . fig3 depicts the details of a distributed profiler operating within an example system 300 consistent with embodiments of the present disclosure . the distributed profiler may profile a distributed system that includes virtual machines 310 a , 310 b , and 310 c ( collectively , 310 ). the virtual machines 310 may execute subtasks 312 a , 312 b , 312 c , 312 d , 312 e , and 312 f ( collectively , 312 ). the virtual machines 310 may utilize communication streams 314 a , 314 b , and 314 c ( collectively , 314 ) to transmit subtask requests and responses between one another . it should be appreciated that the distributed system is provided for example purposes and may vary in its architecture ( e . g ., the number of virtual machines , the number of subtasks , the assignment of subtasks to virtual machines , the configuration of the communication streams , etc .). the distributed profiler may comprise profiler instances 320 a and 320 b ( collectively , 320 ) and a profiler controller 330 . profiler instance 320 a may comprise a profiler loader 322 a , a local profiler 324 a , and a socket profiler 326 a . local profiler 324 a and socket profiler 326 a may record one or more attributes regarding virtual machine 310 a into a local runtime record 328 a . profiler instance 320 b may comprise a profiler loader 322 b , a local profiler 324 b , and a socket profiler 326 b . local profiler 324 b and socket profiler 326 b may record one or more attributes regarding virtual machine 310 b into a local runtime record 328 b . the profiler loaders 322 a and 322 b ( collectively , 322 ) may direct operation of local profilers 324 a and 324 b ( collectively , 324 ), respectively . the profile loaders 322 a and 322 b may also direct operation of socket profilers 326 a and 326 b ( collectively , 326 ), respectively . the profiler loaders 322 may direct operation based on standard byte code instrumentation . the profiler loaders 322 may receive communication from the profiler controller 330 . the profiler loaders 322 may direct operation of the local profilers 324 and the socket profilers 326 independently . the local profilers 324 may profile virtual machines 310 . in detail , local profiler 324 a may profile virtual machine 310 a and subtask 312 a . local profiler 324 b may profile virtual machine 310 b and subtasks 312 b and 312 c . the local profilers 324 may profile by collecting attributes of the virtual machines 310 a and 310 b , such as subtask call times and frequencies of function execution . the local profilers 324 a and 324 b may record the attributes into the local runtime records 328 a and 328 b ( collectively , 328 ), respectively . in some embodiments , the local profilers 324 may keep track of the subtasks and subtask calls to identify a call - chain ( alternatively , execution instance ) corresponding to a task executed by the distributed system . in some embodiments , the local profilers 324 may associate the call - chains and other attributes with a unique identifier . the socket profilers 326 may profile the communication streams 314 . in detail , socket profiler 326 a may profile communication stream 314 a . socket profiler 326 b may profile communication streams 314 b and 314 c . the socket profilers 324 may profile by collecting attributes of the communication streams 314 , such as subtask calls , subtask call identifiers , and called virtual machine names or identifiers . the socket profilers 326 a and 326 b may record the attributes into the local runtime records 328 a and 328 b , respectively . in some embodiments , the local profilers 326 may add to , append , or modify the call - chains and other attributes in the local runtime records 328 . the socket profilers 326 may intercept the communication streams 314 and alter subtask calls . the socket profilers 326 may use a modified version of stream monitors 316 a , 316 b , and 316 c ( collectively , 316 ) of the communication streams 314 . the socket profilers 326 may use modified versions of input stream monitor code segments and output stream monitor code segments of the stream monitors 316 to intercept and alter subtask calls . the modified version of the stream monitors 316 may utilize code delegation techniques . the stream monitors 316 may be existing code segments that are a part of the communication streams 314 that are associated with the virtual machines 312 . the modified version of the output stream monitor of the stream monitors 316 may generate the unique identifier . the unique identifier may be in a standardized form recognized by all of the profiler instances 320 . the unique identifier may be generated using known coding techniques , such as fixed length keys , random number generators , multiple field combinations , field prefixes and suffixes , combinations of existing fields and newly generated unique identifiers , etc . the profiler controller 330 of the distributed profiler may comprise a master controller 332 , a system deployment architecture 334 ( herein , sda ), and a statistics collector 336 . the profiler controller 330 may unify and categorize data from the profiler instances 320 to provide meaningful information regarding the distributed system , such as call - chains of the subtasks 312 across virtual machines 310 . the master controller 332 may transmit instructions to the profiler loaders 322 . the instructions from the master controller 332 may command the local profilers 324 or the socket profilers 326 to begin or cease operation . the master controller 332 may instruct the operation of the various components of the profiler instances 320 independently of each other . the master controller 332 may instruct the operation of profiler instance 320 a independently of profiler instance 320 b . in some embodiments , the master controller 332 may transmit operation of a given profiler instance to the sda 334 . the master controller 332 may receive requests from an end - user of the distributed profiler ( e . g ., a system administrator ). the sda 334 of the profiler controller 330 may retrieve operation of a given profiler instance from the master controller 332 . the sda 334 may have knowledge of the layout and operation of the distributed system , such as which virtual machines execute which subtasks and which communication streams are used by which virtual machines for external communication to other virtual machines . in some embodiments , the sda 334 may have knowledge of the operation of the distributed system that is not directly profiled by the distributed profiler ( e . g ., the organization of virtual machine 310 c and of subtasks 312 d , 312 e , and 312 f ). the sda 334 may have knowledge of operation of the profiler instances 320 . the sda 334 may instruct the profiled output stream monitor of the stream monitors 316 . the sda 334 may instruct a given profiled output stream monitor to embed unique identifiers into subtask calls . the sda 334 may instruct the stream monitors 316 based upon the knowledge of the distributed system and the knowledge of operation of the profiler instances 320 . the statistics collector 336 of the profiler controller 330 may generate profiler information for the end - user . the statistics collector 336 may retrieve attributes and associated unique identifiers from the local runtime records 328 . the statistics collector 336 may analyze the attributes and unique identifiers from the local runtime records 328 to generated profiler information . the statistics collector 336 may generate summaries based upon information collected from the local runtime records 328 ( e . g ., execution instances , subtask call - chains , identified tasks across virtual machines 310 , aggregate execution time , etc .). the statistics collector 336 may output the profiler information to a profiler results 340 file or table . the distributed profiler may be able to identify patterns of execution that slow operation of the distributed system . for example , the distributed system may be performing three different tasks . the tasks may be comprised of a series of subtasks 312 , subtask calls , and subtask returns . the first task may comprise the following : subtask 312 a , a call to subtask 312 b , subtask 312 b , a call to subtask 312 d , subtask 312 d , a return to subtask 312 b , and a return to subtask 312 a . the second task may comprise the following : subtask 312 a , a call to subtask 312 b , subtask 312 b , a call to subtask 312 e , subtask 312 e , a call to subtask 312 b , subtask 312 b , a return to subtask 312 e , a return to subtask 312 b , and a return to subtask 312 a . the third task may comprise the following : subtask 312 a , a call to subtask 312 c , subtask 312 c , a call to subtask 312 b , subtask 312 b , a call to subtask 312 f , subtask 312 f , a return to subtask 312 b , a return to subtask 312 c , a call to subtask 312 e , subtask 312 e , a return to subtask 312 c , and a return to subtask 312 a . to continue the example , the master controller 332 may instruct profiler instance 320 a to begin profiling virtual machine 310 a . the local profiler 324 a may monitor subtask 312 a and record profiling information into local runtime record 328 a . as the first task , the second task , and the third task are performed , the local profiler 324 a may only profile subtask 312 a and record any calls to subtasks located on virtual machine 310 b . ( e . g ., calls to subtasks 312 b and 312 c ). but , the distributed profiler may not record any profiling information of the distributed system until a return to subtask 312 a occurs . the master controller 332 may instruct profiler instance 320 b to begin profiling virtual machine 310 b . the sda 334 may detect that profiler instance 320 b has been instructed to begin profiling virtual machine 310 b , and may instruct stream monitor 316 a to encode unique identifiers into subtask calls to virtual machine 310 b . as the profiler instances 320 profile virtual machines 310 a and 310 b , the local profilers 324 and socket profilers 326 may record and associate profiling information with the unique identifiers . as execution of the distributed system occurs now the local profilers 324 and the socket profilers 326 of profiler instance 320 a and 320 b may record profiling information of the distributed system into the local runtime records 328 a and 328 b , respectively . the statistics collector 336 may retrieve the profiler information from the local runtime records 328 and may generate call - chains and other performance related data about the execution of the first , second , and third tasks by the distributed system . the statistics collector 336 may record the call - chains and performance related data into the profile results 340 . from the profile results 340 , an end user may be able to see execution time of all subtasks 312 that make up each of the first , second , and third tasks . an issue related to performance may be observed from this information ( e . g ., execution of the third task while three instances of the first task are being performed causes the distributed system to run out of memory ). fig4 depicts the representative major components of an exemplary computer system 001 that may be used in accordance with embodiments of the invention . it is appreciated that individual components may have greater complexity than represented in fig4 , components other than or in addition to those shown in fig4 may be present , and the number , type , and configuration of such components may vary . several particular examples of such complexities or additional variations are disclosed herein . the particular examples disclosed are for exemplar purposes only and are not necessarily the only such variations . the computer system 001 may comprise a processor 010 , memory 020 , an input / output interface ( herein i / o or i / o interface ) 030 , and a main bus 040 . the main bus 040 may provide communication pathways for the other components of the computer system 001 . in some embodiments , the main bus 040 may connect to other components such as a specialized digital signal processor ( not depicted ). the processor 010 of the computer system 001 may be comprised of one or more cpus 012 a , 012 b , 012 c , 012 d ( herein 012 ). the processor 010 may additionally be comprised of one or more memory buffers or caches ( not depicted ) that provide temporary storage of instructions and data for the cpus 012 . the cpus 012 may perform instructions on input provided from the caches or from the memory 020 and output the result to caches or the memory . the cpus 012 may be comprised of one or more circuits configured to perform one or methods consistent with embodiments of the invention . in some embodiments , the computer system 001 may contain multiple processors 010 typical of a relatively large system ; however , in other embodiments the computer system may alternatively be a single processor with a singular cpu 012 . the memory 020 of the computer system 001 may be comprised of a memory controller 022 and one or more memory modules 024 a , 024 b , 024 c , 024 d ( herein 024 ). in some embodiments , the memory 020 may comprise a random - access semiconductor memory , storage device , or storage medium ( either volatile or non - volatile ) for storing data and programs . the memory controller 022 may communicate with the processor 010 facilitating storage and retrieval of information in the memory modules 024 . the memory controller 022 may communicate with the i / o interface 030 facilitating storage and retrieval of input or output in the memory modules 024 . in some embodiments , the memory modules 024 may be dual in - line memory modules ( dimms ). the i / o interface 030 may comprise an i / o bus 050 , a terminal interface 052 , a storage interface 054 , an i / o device interface 056 , and a network interface 058 . the i / o interface 030 may connect the main bus 040 to the i / o bus 050 . the i / o interface 030 may direct instructions and data from the processor 010 and memory 030 to the various interfaces of the i / o bus 050 . the i / o interface 030 may also direct instructions and data from the various interfaces of the i / o bus 050 to the processor 010 and memory 030 . the various interfaces may comprise the terminal interface 052 , the storage interface 054 , the i / o device interface 056 , and the network interface 058 . in some embodiments , the various interfaces may comprise a subset of the aforementioned interfaces ( e . g ., an embedded computer system in an industrial application may not include the terminal interface 052 and the storage interface 054 ). logic modules throughout the computer system 001 — including but not limited to the memory 020 , the processor 010 , and the i / o interface 030 — may communicate failures and changes to one or more components to a hypervisor or operating system ( not depicted ). the hypervisor or the operating system may be allocate the various resources available in the computer system 001 and track the location of data in memory 020 and of processes assigned to various cpus 012 . in embodiments that combine or rearrange elements , aspects of the logic modules capabilities may be combined or redistributed . these variations would be apparent to one skilled in the art . the present invention may be a system , a method , and / or a computer program product . the computer program product may include a computer readable storage medium ( or media ) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention . the computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device . the computer readable storage medium may be , for example , but is not limited to , an electronic storage device , a magnetic storage device , an optical storage device , an electromagnetic storage device , a semiconductor storage device , or any suitable combination of the foregoing . a non - exhaustive list of more specific examples of the computer readable storage medium includes the following : a portable computer diskette , a hard disk , a random access memory ( ram ), a read - only memory ( rom ), an erasable programmable read - only memory ( eprom or flash memory ), a static random access memory ( sram ), a portable compact disc read - only memory ( cd - rom ), a digital versatile disk ( dvd ), a memory stick , a floppy disk , a mechanically encoded device such as punch - cards or raised structures in a groove having instructions recorded thereon , and any suitable combination of the foregoing . a computer readable storage medium , as used herein , is not to be construed as being transitory signals per se , such as radio waves or other freely propagating electromagnetic waves , electromagnetic waves propagating through a waveguide or other transmission media ( e . g ., light pulses passing through a fiber - optic cable ), or electrical signals transmitted through a wire . computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network , for example , the internet , a local area network , a wide area network and / or a wireless network . the network may comprise copper transmission cables , optical transmission fibers , wireless transmission , routers , firewalls , switches , gateway computers and / or edge servers . a network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device . computer readable program instructions for carrying out operations of the present invention may be assembler instructions , instruction - set - architecture ( isa ) instructions , machine instructions , machine dependent instructions , microcode , firmware instructions , state - setting data , or either source code or object code written in any combination of one or more programming languages , including an object oriented programming language such as smalltalk , c ++ or the like , and conventional procedural programming languages , such as the “ c ” programming language or similar programming languages . the computer readable program instructions may execute entirely on the user &# 39 ; s computer , partly on the user &# 39 ; s computer , as a stand - alone software package , partly on the user &# 39 ; s computer and partly on a remote computer or entirely on the remote computer or server . in the latter scenario , the remote computer may be connected to the user &# 39 ; s computer through any type of network , including a local area network ( lan ) or a wide area network ( wan ), or the connection may be made to an external computer ( for example , through the internet using an internet service provider ). in some embodiments , electronic circuitry including , for example , programmable logic circuitry , field - programmable gate arrays ( fpga ), or programmable logic arrays ( pla ) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry , in order to perform aspects of the present invention . aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods , apparatus ( systems ), and computer program products according to embodiments of the invention . it will be understood that each block of the flowchart illustrations and / or block diagrams , and combinations of blocks in the flowchart illustrations and / or block diagrams , can be implemented by computer readable program instructions . these computer readable program instructions may be provided to a processor of a general purpose computer , special purpose computer , or other programmable data processing apparatus to produce a machine , such that the instructions , which execute via the processor of the computer or other programmable data processing apparatus , create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks . these computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer , a programmable data processing apparatus , and / or other devices to function in a particular manner , such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function / act specified in the flowchart and / or block diagram block or blocks . the computer readable program instructions may also be loaded onto a computer , other programmable data processing apparatus , or other device to cause a series of operational steps to be performed on the computer , other programmable apparatus or other device to produce a computer implemented process , such that the instructions which execute on the computer , other programmable apparatus , or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks . the flowchart and block diagrams in the figures illustrate the architecture , functionality , and operation of possible implementations of systems , methods , and computer program products according to various embodiments of the present invention . in this regard , each block in the flowchart or block diagrams may represent a module , segment , or portion of instructions , which comprises one or more executable instructions for implementing the specified logical function ( s ). in some alternative implementations , the functions noted in the block may occur out of the order noted in the figures . for example , two blocks shown in succession may , in fact , be executed substantially concurrently , or the blocks may sometimes be executed in the reverse order , depending upon the functionality involved . it will also be noted that each block of the block diagrams and / or flowchart illustration , and combinations of blocks in the block diagrams and / or flowchart illustration , can be implemented by special purpose hardware - based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions . the descriptions of the various embodiments of the present disclosure have been presented for purposes of illustration , but are not intended to be exhaustive or limited to the embodiments disclosed . many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments . the terminology used herein was chosen to explain the principles of the embodiments , the practical application or technical improvement over technologies found in the marketplace , or to enable others of ordinary skill in the art to understand the embodiments disclosed herein .