Method and system for identifying uncorrelated suspicious events during an attack
US-2017171240-A1 · Jun 15, 2017 · US
US11561681B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-11561681-B2 |
| Application number | US-201916440097-A |
| Country | US |
| Kind code | B2 |
| Filing date | Jun 13, 2019 |
| Priority date | Dec 20, 2013 |
| Publication date | Jan 24, 2023 |
| Grant date | Jan 24, 2023 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
A system for displaying a performance dashboard comprises an input interface, a processor, and an output interface. The input interface is configured to receive log data. The log data comprises a set of process log entries. The processor is configured to determine one or more daemon response times and to determine dashboard information. The dashboard information is based at least in part on the log data and the one or more daemon response times. The output interface is configured to provide the dashboard information.
Opening claim text (preview).
What is claimed is: 1. A system for displaying a performance dashboard comprising: an input interface configured to receive log data, wherein the log data comprises a set of process log entries; a processor configured to: determine whether one or more criteria for checking a daemon response time is satisfied, wherein the one or more criteria include a system condition corresponding to a change in network traffic in relation to a threshold and an indication that a full backup is requested by at least one client system; determine one or more daemons with active processes based on an analysis of the log data, including at least process start and end times; in response to a determination that the one or more criteria for checking the daemon response time is satisfied, determine one or more daemon response times in real-time, including querying one or more active processes of the determined one or more daemons, wherein querying the one or more active processes comprises querying the one or more active processes at a predetermined rate; determine dashboard information associated with one or more of at least one client system and at least one storage system, wherein the determined dashboard information is based on log data and the one or more daemon response times; and an output interface configured to provide the dashboard information. 2. The system of claim 1 , wherein the system condition includes one or more of a change in network traffic in relation to a threshold, and an indication that a full backup is requested by at least one client system. 3. The system of claim 1 , wherein to determine the one or more daemon response times in real-time comprises measuring the daemon response time. 4. The system of claim 1 , wherein the dashboard information is based at least in part on the log data and the one or more daemon response times. 5. The method of claim 1 , wherein the log data comprises a set of process log entries. 6. The system of claim 5 , wherein a process log entry of the set of process log entries comprises a process name. 7. The system of claim 6 , wherein a process log entry comprises a process identifier. 8. The system of claim 6 , wherein a process log entry comprises a process start time. 9. The system of claim 6 , wherein a process log entry comprises a process end time. 10. The system of claim 1 , wherein each daemon response time of the one or more daemon response times comprises a time between a time a daemon query is sent and a time a daemon response is received. 11. The system of claim 1 , wherein determining a daemon response time of the one or more daemon response times comprises: sending a query to a daemon; determining a start time; receiving a response to the query from the daemon; determining a stop time; and calculating the daemon response time based at least in part on the start time and the stop time. 12. The system of claim 1 , wherein one daemon response time of the one or more daemon response times are determined for one of the following: nsrd, nsrexecd, nsrmmdbd, nsrindexd, or nsrjobd. 13. The system of claim 1 , wherein the processor is further configured to determine configuration information. 14. The system of claim 13 , wherein the configuration information comprises one or more of the following: client system information, client software information, backup storage system information, backup storage software information, backup server system information, and backup server software information. 15. The system of claim 13 , wherein the dashboard information is determined based at least in part on the configuration information. 16. The system of claim 1 , wherein the processor is further configured to determine system sizing information. 17. The system of claim 16 , wherein the system sizing information comprises one or more of the following: configuration database information, media database information, index database information, and jobs database information. 18. The system of claim 16 , wherein the dashboard information is determined based at least in part on the system sizing information. 19. The system of claim 1 , wherein the log data corresponds to information on a process run on one or more of the at least one client system and the at least one storage system. 20. The system of claim 1 , wherein the dashboard information provides an indication of an ability of an active process to respond to an inquiry, the at least one client system, and the at least one storage system. 21. The system of claim 1 , wherein to determine the one or more daemon response times further comprises measuring an amount of time for the one or more processes to respond to the querying of the one or more active processes. 22. The system of claim 1 , wherein the querying the one or more active processes is performed in response to determining that the one or more criteria for checking the daemon response time is satisfied. 23. A method for displaying a performance dashboard, comprising: receiving log data pertaining to a system comprising at least one client system and at least one storage system, wherein the log data comprises a set of process log entries; determining whether one or more criteria for checking a daemon response time is satisfied, wherein the one or more criteria include a system condition corresponding to a change in network traffic in relation to a threshold and an indication that a full backup is requested by at least one client system; determining one or more daemons with active processes based on an analysis of the log data, including at least process start and end times; in response to a determination that the one or more criteria for checking the daemon response time is satisfied, determining one or more daemon response times using a processor in real-time, including querying one or more active processes of the determined one or more daemons, wherein queryingthe one or more active processes comprises querying the one or more active processes at a predetermined rate; determining dashboard information associated with one or more of at least one client system and at least one storage system, wherein the determined dashboard information is based on log data and the one or more daemon response times; and providing the dashboard information. 24. A computer program product for displaying a performance dashboard, the computer program product being embodied in a non-transitory computer- readable storage medium and comprising computer instructions for: receiving log data pertaining to a system comprising at least one client system and at least one storage system, wherein the log data comprises a set of process log entries; determining whether one or more criteria for checking a daemon response time is satisfied, wherein the one or more criteria include a system condition corresponding to a change in network traffic in relation to a threshold and an indication that a full backup is requested by at least one client system; determining one or more daemons with active processes based on an analysis of the log data, including at least process start and end times; in response to a determination that the one or more criteria for checking the daemon response time is satisfied, determining one or more daemon response times in real-time, including querying one or more active processes of the determined one or more daemons, wherein querying the one or more active processes comprises querying the one or mor
for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range · CPC title
Query processing · CPC title
for performance assessment · CPC title
Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title
where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.