Event logging protocol connector systems and methods

Patent metadata

Field	Value
Publication number	US-2024176625-A1
Application number	US-202218071331-A
Country	US
Kind code	A1
Filing date	Nov 29, 2022
Priority date	Nov 29, 2022
Publication date	May 30, 2024
Grant date	—

Abstract

Embodiments provide systems and methods for logging events. A computer-implemented method, for example, includes a syslog connector providing a subscription to a cloud source that collects events from a plurality of data sources, the subscription comprising an event selection criterion, receiving event records from the cloud source according to the subscription, the received event records formatted according to a first format, transforming the event records received from the cloud source from the first format to syslog messages and storing, by the syslog connector, the syslog messages to a syslog data sink.

First claim

What is claimed is:

1 . A computer-implemented method comprising:
providing, by a syslog connector, a subscription to a cloud source that collects events from a plurality of data sources, the subscription comprising an event selection criterion; receiving, by the syslog connector, event records from the cloud source according to the subscription, the received event records formatted according to a first format; transforming, by the syslog connector, the event records received from the cloud source from the first format to syslog messages; and storing, by the syslog connector, the syslog messages to a syslog data sink.

2 . The computer-implemented method of claim 1 , wherein the syslog connector is an on-premises syslog connector.

3 . The computer-implemented method of claim 1 , wherein the event records are pushed from the cloud source to the syslog connector.

4 . The computer-implemented method of claim 1 , wherein the event records are pulled by the syslog connector from the cloud source.

5 . The computer-implemented method of claim 1 , further comprising:
receiving, by the syslog connector, an event logging configuration, the event logging configuration comprising the event selection criterion and a data sink configuration for the syslog data sink.

6 . The computer-implemented method of claim 5 , wherein the event logging configuration further comprises a polling interval and wherein the syslog connector polls the cloud source for additional event records according to the polling interval.

7 . The computer-implemented method of claim 1 , further comprising:
establishing an event store for the subscription; evaluating a new event to determine that the new event is subscribed to according to the subscription; based on the determination that the new event is subscribed to according to the subscription, add an event record for the new event to the event store for the subscription as an unread event record; and sending the unread event record to the syslog connector and changing the unread event record to a read event record.

8 . The computer-implemented method of claim 7 , wherein the unread event record is pushed to the syslog connector.

9 . The computer-implemented method of claim 7 , wherein the unread event record is sent to the syslog connector responsive to the syslog connector pulling the unread event record.

10 . The computer-implemented method of claim 1 , wherein storing the syslog messages to the syslog data sink comprises sending a syslog file containing the syslog messages to the syslog data sink.

11 . A computer program product comprising a non-transitory, computer-readable medium storing thereon computer-executable instructions, the computer-executable instructions comprising instructions for:
providing a subscription to a cloud source that collects events from a plurality of data sources, the subscription comprising an event selection criterion; receiving event records from the cloud source according to the subscription, the received event records formatted according to a first format; transforming the received event records from the first format to syslog messages; and storing the syslog messages to a syslog data sink.

12 . The computer program product of claim 11 , wherein the event records are received from the cloud source because of being pushed from the cloud source.

13 . The computer program product of claim 11 , further comprising instructions for pulling the event records from the cloud source.

14 . The computer program product of claim 11 , wherein the computer-executable instructions further comprise instructions for receiving an event logging configuration, the event logging configuration comprising the event selection criterion and a data sink configuration for the syslog data sink.

15 . The computer program product of claim 14 , wherein the event logging configuration further comprises a polling interval and wherein the computer-executable instructions further comprise instructions for polling the cloud source for new event records according to the polling interval.

16 . The computer program product of claim 11 , wherein storing the syslog messages to the syslog data sink comprises sending a syslog file containing the syslog messages to the syslog data sink.

17 . An event logging system comprising:
a first processor; a first non-transitory, computer-readable medium storing thereon first computer-executable instructions that are executable by the first processor, the first computer-executable instructions comprising instructions for:
providing a subscription to a cloud source that collects events from a plurality of data sources, the subscription comprising an event selection criterion;
receiving event records from the cloud source according to the subscription, the received event records formatted according to a first format;
transforming the received event records from the first format to syslog messages; and
storing the syslog messages to a syslog data sink;
a second processor; and a second non-transitory, computer-readable medium storing thereon second computer-executable instructions that are executable by the second processor, the second computer-executable instructions comprising instructions for:
establishing an event store for the subscription;
determining that a new event is subscribed to according to the subscription;
based on the determination that the new event is a subscribed to according to the subscription, adding an unread event record for the new event to the event store for the subscription; and
sending the unread event record to the first processor and changing the unread event record to a read event record in the event store for the subscription.

18 . The event logging system of claim 17 , wherein the second computer-executable instructions comprise instructions executable by the second processor for pushing the unread event record to the first processor.

19 . The event logging system of claim 17 , wherein the first computer-executable instructions comprise instructions executable by the first processor for pulling the unread event record.

20 . The event logging system of claim 19 , wherein the second computer-executable instructions comprise instructions executable by the second processor for sending the unread event record to the first processor responsive to the first processor pulling the unread event record.

Assignees

• Webroot Inc

Inventors

• Goknel Niyazi Eray
• Fellner Paul
• Mayr Johannes
• Ahmed Aqil

Classifications

• G06F16/254

  Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• G06F9/5072

  Grid computing · CPC title

• G06F9/44505 Primary

  Configuring for program initiating, e.g. using registry, configuration files · CPC title