Method and system for implementing an operating system hook in a log analytics system

Patent metadata

Field	Value
Publication number	US-2016378577-A1
Application number	US-201615089049-A
Country	US
Kind code	A1
Filing date	Apr 1, 2016
Priority date	Apr 3, 2015
Publication date	Dec 29, 2016
Grant date	—

Abstract

Disclosed is a system, method, and computer program product for implementing a log analytics method and system that can configure, collect, and analyze log records in an efficient manner. An improved approach is provided for identifying log files that have undergone a change in status that would require retrieve of its log data, by including a module directly into the operating system that allows the log collection component to be reactively notified of any changes to pertinent log files.

First claim

What is claimed is:

1 . A method implemented with a processor, comprising:
to monitor for changes to one or more log files, configuring an operating system (OS) module to generate an event within an event log when any of a target set of operating-system-level system calls is made; loading the OS module into an operating system of a host computing system; operating the OS module within the operating system of the host computing system to detect an invocation of any of the target set of operating-system-level system calls and to execute the invocation of the any of the operating-system-level system calls, wherein the OS module does not detect invocation of untargeted operating-system-level system calls, and wherein the one or more log files are changed by one or more processes associated with one or more particular calls in the target set of operating-system-level system calls; and identifying one or more events corresponding to the one or more log files changed by invocation of the any of the target set of operating-system-level system calls, wherein the one or more events correspond to a filtered subset of all log files that are changed by invocation of the any of the target set of operating-system-level system calls, and the one or more events are reviewable by a log collector to collect the one or more log files for a log analytics system.

2 . The method of claim 1 , wherein a filter is applied to generate the filtered subset that is recorded into an event log, the filtered subset identifiable based upon application of a filtering criteria to the invocation of the any of the target set of operating-system-level system calls.

3 . The method of claim 2 , wherein (a) the filter is applied before the one or more events are recorded into the event log, (b) the filter is applied asynchronously to remove filtered items from the event log, or (c) the filter is applied both before the one or more events are recorded into the event log and asynchronously to remove the filtered items from the event log.

4 . The method of claim 2 , wherein both a filtered event log and an unfiltered event log are maintained, the filtered event log storing events that meet the filtering criteria, and the unfiltered event log storing events regardless of whether the events meet the filtering criteria.

5 . The method of claim 2 , wherein the filtering criteria comprises at least one of a filename pattern, a pathname pattern, or an operation pattern.

6 . The method of claim 2 , wherein the event log corresponds to a named pipe.

7 . The method of claim 1 , wherein the OS module corresponds to a loadable kernel module, and the OS module is inserted within an operating system kernel.

8 . The method of claim 1 , further comprising determining whether the invocation of the any of the target set of operating-system-level system calls has successfully completed, and recording an event after determining successful completion.

9 . The method of claim 1 , wherein the one or more events are reviewed by the log collector on a periodic basis.

10 . The method of claim 1 , wherein the OS module is operated within the operating system of the host computing system to detect the change to the log file by:
saving an original address of an operating system function; intercepting a call by an application to the operating system function; and calling the operating system function from the OS module, wherein a function call parameter from the application is passed to the operating system function.

11 . The method of claim 10 , wherein the operating system function comprises at least one of a write function, a rename function, a delete function, or a move function.

12 . The method of claim 1 , wherein the target set of operating-system-level system calls comprise one or more calls that indicate a possible change to the log file being monitored and exclude one or more calls that do not indicate a change to any file.

13 . A computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a method, the method comprising:
to monitor for changes to one or more log files, configuring an operating system (OS) module to generate an event within an event log when any of a target set of operating-system-level system calls is made; loading the OS module into an operating system of a host computing system; operating the OS module within the operating system of the host computing system to detect an invocation of any of the target set of operating-system-level system calls and to execute the invocation of the any of the operating-system-level system calls, wherein the OS module does not detect invocation of untargeted operating-system-level system calls, and wherein the one or more log files are changed by one or more processes associated with one or more particular calls in the target set of operating-system-level system calls; and identifying one or more events corresponding to the one or more log files changed by invocation of the any of the target set of operating-system-level system calls, wherein the one or more events correspond to a filtered subset of all log files that are changed by invocation of the any of the target set of operating-system-level system calls, and the one or more events are reviewable by a log collector to collect the one or more log files for a log analytics system.

14 . The computer readable medium of claim 13 , wherein a filter is applied to generate the filtered subset that is recorded into an event log, the filtered subset identifiable based upon application of a filtering criteria to the invocation of the any of the target set of operating-system-level system calls.

15 . The computer readable medium of claim 14 , wherein the filtering criteria comprises at least one of a filename pattern, a pathname pattern, or an operation pattern.

16 . The computer readable medium of claim 13 , wherein the OS module corresponds to a loadable kernel module, and the OS module is inserted within an operating system kernel.

17 . The computer readable medium of claim 13 , further comprising determining whether the invocation of the any of the target set of operating-system-level system calls has successfully completed, and recording an event after determining successful completion.

18 . The computer readable medium of claim 13 , wherein the OS module is operated within the operating system of the host computing system to detect the change to the log file by:
saving an original address of an operating system function; intercepting a call by an application to the operating system function; and calling the operating system function from the OS module, wherein a function call parameter from the application is passed to the operating system function.

19 . A system, comprising:
a processor; a memory having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute operations comprising: monitoring for changes to a log file by configuring an operating system (OS) module to generate an event within an event log when any of a target set of operating-system-level system calls is made; loading the OS module into an operating system of a host computing system; operating the OS module within the operating system of the host computing system to detect an invocation of any of the target set of operating-system-level system calls and to execute the invocation of the any of the operating-system-level system calls, wherein the OS module do

Assignees

• Oracle Int Corp

Inventors

• Russell Jerry Paul
• He Haobo
• MA Greg
• Xu Xin

Classifications

• G06F3/04842

  Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L41/5074

  Handling of user complaints or trouble tickets · CPC title

• G06F11/3086

  where the reporting involves the use of self describing data formats, i.e. metadata, markup languages, human readable formats · CPC title