Passive monitoring of virtual systems using extensible indexing

Patent metadata

Field	Value
Publication number	US-9229758-B2
Application number	US-201213527994-A
Country	US
Kind code	B2
Filing date	Jun 20, 2012
Priority date	Oct 28, 2011
Publication date	Jan 5, 2016
Grant date	Jan 5, 2016

Abstract

Aspects of the present invention provide a solution for passively monitoring a computer system. In an embodiment, an indexing agent operates on a physical server having a plurality of virtual servers. The indexing agent has a framework having a plurality of indexing layers. Each of these indexing layers is adapted to index a virtual server along a different abstraction level to extract abstraction level features indicative of changes in the virtual server. Further, each of the indexing layers has an application programming interface, which is adapted to receive one or more external indexing modules to be plugged into the framework. Each indexing module is adapted to provide instructions to the indexing agent while the indexing layer to which it is plugged is indexing the associated abstraction level of the virtual machine.

First claim

What is claimed is:

1. A method for passively monitoring a computer system, comprising:
accessing a virtual server by an indexing agent external to the virtual server, the indexing agent comprising:
an indexing framework having a plurality of indexing layers, each of the plurality of indexing layers having an application programming interface (API); and
a first indexing module plugged into a first indexing layer of the plurality of indexing layers using an API of the first indexing layer;
a second indexing module plugged into a second indexing layer of the indexing agent using an API of the second indexing layer, wherein the second indexing module includes a timing instruction for executing the second indexing module subsequent to the first indexing module;

retrieving a virtual image of the virtual server by the indexing agent;
indexing, for each of the plurality of indexing layers, a corresponding abstraction level of the virtual image by the indexing agent to extract abstraction level features indicative of changes in the virtual server relative to a pre-configured software stack, the indexing including the first indexing module providing instructions to the indexing agent while the first indexing layer is indexing a first abstraction level of the virtual server indexed by the first indexing layer;
in response to completion of the indexing by the first indexing module, indexing a second abstraction level of the virtual server indexed by the second indexing layer using instructions provided by the second indexing module to the second indexing layer; and
analyzing at least one of the abstraction level features to perform passive monitoring of the virtual server.

2. The method of claim 1 , wherein the indexing agent is contained in an indexing appliance separate from the virtual server and wherein the retrieving and the indexing are performed without utilizing an internal indexing agent executing within the virtual server.

3. The method of claim 1 , further comprising plugging, prior to the accessing, the first indexing module into the first indexing layer using the API of the first indexing layer.

4. The method of claim 3 , the analyzing further comprising:
plugging, prior to the accessing, the second indexing module into the second indexing layer of the indexing agent using an API of the second indexing layer.

5. The method of claim 1 , wherein the corresponding abstraction level is selected from a different one of a group consisting of: an individual disk block level, a disk partitions level, a physical properties level, a software packages level, an operating system level, a middle level, a virus detection level, a file structure level, a file contents level, and a file contents hash level.

6. The method of claim 1 , further comprising, prior to the retrieving:
establishing a checkpoint using a built-in snapshot feature of a virtualization layer of the virtual server; and
generating the virtual image that contains data corresponding to a file system and a running state of the virtual server at a time of the checkpoint.

7. The method of claim 1 , further comprising:
aggregating the abstraction level features for a plurality of the levels to obtain extracted features;
forwarding data corresponding to the extracted abstraction level features from the indexing to a central detection server; and
performing the analyzing at the central detection server.

8. The method of claim 1 , wherein the abstraction level features are indicative of whether drift has occurred in the virtual server and wherein the analyzing includes determining whether drift has occurred in the virtual server.

9. A system for passively monitoring a computer system, comprising:
a physical server including a processor and a memory therein, and having a plurality of virtual system instances operating thereon; and
an indexing appliance including an indexing agent operating on the physical server and external to the plurality of virtual system instances, the indexing agent comprising:
an indexing framework having a plurality of indexing layers, each of plurality of indexing layers adapted to index a virtual system instance of the plurality of virtual system instances along a unique abstraction level to extract abstraction level features indicative of changes in the virtual system instance relative to a pre-configured software stack, and having an application programming interface (API);
a first indexing module being adapted to plug into a first layer of the plurality of indexing layers using an API of the first layer and adapted to provide instructions to the indexing agent while the first layer is indexing a first abstraction level of the virtual system instance indexed by the first layer; and
a second indexing module being adapted to plug into a second layer of the plurality of indexing layers using an API of the second layer, wherein the second indexing module includes a timing instruction for executing the second indexing module subsequent to the first indexing module;
in response to completion of the indexing by the first indexing module, indexing a second abstraction level of the virtual system instance indexed by the second layer using instructions provided by the second indexing module to the second layer.

10. The system of claim 9 , wherein the indexing agent performs a method for passively monitoring the computer system, comprising:
retrieving a virtual image of the virtual system instance;
indexing, for each of the plurality of indexing layers, a corresponding abstraction level of the virtual image to extract the abstraction level features that indicate whether drift has occurred in the virtual system instance, the indexing including the first module providing instructions to the indexing agent while the first layer is indexing the first abstraction level of the virtual system instance indexed by the first layer;
and
analyzing the abstraction level features to perform passive monitoring of the virtual system instance.

11. The system of claim 10 , wherein the indexing agent is contained in an indexing appliance separate from the virtual system instance and wherein the retrieving and the indexing are performed without utilizing an internal indexing agent executing within the virtual system instance.

12. The system of claim 10 , the method further comprising plugging, prior to the indexing, the first indexing module into the first layer using the API of the first layer.

13. The system of claim 12 , the analyzing further comprising:
plugging, prior to the accessing, the second indexing module into the second layer of the indexing agent using an API of the second layer.

14. The system of claim 9 , wherein each of the plurality of unique abstraction levels is selected from a different one of a group consisting of: an individual disk block level, a disk partitions level, a physical properties level, a software packages level, an operating system level, a middle level, a virus detection level, a file structure level, a file contents level, and a file contents hash level.

15. The system of claim 10 , further comprising, prior to the retrieving:
establishing a checkpoint using a built-in snapshot feature of a virtualization layer of the virtual system instance; and
generating the virtual image that contains data corresponding to a file system and a running state of the virtual system instance at a time of the checkpoint.

16. The system of claim 10 , further comprising:
aggregating the abstraction level features for a plurality of the levels to obtain extracted features;
forwarding data corresponding

Assignees

• Ammons Glenn S
• Bala Vasanth
• Duri Sastry S
• Mummert Todd W
• Reimer Darrell C
• IBM

Inventors

• Ammons Glenn S
• Bala Vasanth
• Duri Sastry S
• Mummert Todd W
• Reimer Darrell C

Classifications

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title