Monitoring file access of java processes

Patent metadata

Field	Value
Publication number	US-9348624-B2
Application number	US-50797009-A
Country	US
Kind code	B2
Filing date	Jul 23, 2009
Priority date	Jul 23, 2009
Publication date	May 24, 2016
Grant date	May 24, 2016

Abstract

A mechanism for monitoring file accesses by a process running in a Virtual Machine. File access information associated with a monitored process selected in a first view in a debugging interface is obtained from a file activity log and displayed as selectable file access events in a second view of the debugging interface, wherein each file access event represents a read or write operation performed on a file at a particular point in time by the monitored process. An initial content of a file associated with the selected file access event and revisions made to the file by the monitored process within a defined period of time is retrieved from the file activity log upon detecting user selection of a file access event in the second view. The revisions are applied to the initial content of the file and displayed in a third view in the debugging interface.

First claim

What is claimed is:

1. A computer implemented method for monitoring file accesses of a monitored process, the computer implemented method comprising:
responsive to detecting selection of a monitored process in a first view in a debugging interface, obtaining, by a processing unit in a computer, file access information associated with the monitored process from a file activity log;
displaying, by the processing unit, the file access information as selectable file access events in a second view of the debugging interface, wherein each file access event represents a read or write operation performed on a file at a particular point in time by the monitored process;
responsive to detecting user selection of a file access event in the second view, retrieving, by the processing unit, an initial content of a file associated with the selected file access event from the file activity log;
retrieving, by the processing unit, revisions made to the file by the monitored process within a defined period of time from the file activity log;
applying, by the processing unit, the revisions made to the file within the period of time to the initial content of the file to form revised file content, wherein the revised file content comprises a state of the file at the particular point in time; and
displaying, by the processing unit, the revised file content in a third view in the debugging interface, wherein the selectable file access events in the second view comprise all file access events performed by the monitored process.

2. The computer implemented method of claim 1 , further comprising:
repeating the retrieving, applying, and displaying each time a user selection of another file access event in the second view is detected.

3. The computer implemented method of claim 2 , wherein the another file access event is a file access event that occurred at a later point in time than the previously selected file access event.

4. The computer implemented method of claim 2 , wherein the another file access event is a file access event that occurred at an earlier point in time than the previously selected file access event.

5. The computer implemented method of claim 1 , wherein the defined period of time comprises a point in time where execution of the monitored process begins to the particular point in time of the file access event.

6. The computer implemented method of claim 1 , further comprising:
detecting that the monitored process accesses the file;
recording an initial content of the file in the file activity log if the monitored process has previously accessed the file;
monitoring for and recording each read or write operation and changes made by the read or write operation performed on the file by the monitored process in the file activity log.

7. The computer implemented method of claim 6 , wherein recording each read or write operation further comprises recording a path of the file, a point in time the file was accessed by the monitored process, a file access type, and changes to the initial content of the file at the point in time.

8. A computer program product for monitoring file accesses of a monitored process, the computer program product comprising:
a tangible computer recordable storage device having computer executable program code stored thereon, the computer executable program code for execution by a computer, comprising:
computer executable program code for obtaining, in response to detecting selection of a monitored process in a first view in a debugging interface, obtaining file access information associated with the monitored process from a file activity log;
computer executable program code for displaying the file access information as selectable file access events in a second view of the debugging interface, wherein each file access event represents a read or write operation performed on a file at a particular point in time by the monitored process;
computer executable program code for retrieving, in response to detecting user selection of a file access event in the second view, an initial content of a file associated with the selected file access event from the file activity log;
computer executable program code for retrieving revisions made to the file by the monitored process within a defined period of time from the file activity log;
computer executable program code for applying the revisions made to the file within the period of time to the initial content of the file to form revised file content, wherein the revised file content comprises a state of the file at the particular point in time; and
computer executable program code for displaying the revised file content in a third view in the debugging interface, wherein the selectable file access events in the second view comprise all file access events performed by the monitored process.

9. The computer program product of claim 8 , further comprising:
computer executable program code for repeating the retrieving, applying, and displaying each time a user selection of another file access event in the second view is detected.

10. The computer program product of claim 9 , wherein the another file access event is a file access event that occurred at a later point in time than the previously selected file access event.

11. The computer program product of claim 9 , wherein the another file access event is a file access event that occurred at an earlier point in time than the previously selected file access event.

12. The computer program product of claim 8 , wherein the defined period of time comprises a point in time where execution of the monitored process begins to the particular point in time of the file access event.

13. The computer program product of claim 8 , further comprising:
computer executable program code for detecting that the monitored process accesses the file;
computer executable program code for recording an initial content of the file in the file activity log if the monitored process has previously accessed the file;
computer executable program code for monitoring for and recording each read or write operation and changes made by the read or write operation performed on the file by the monitored process in the file activity log.

14. The computer program product of claim 13 , wherein the computer executable program code for recording each read or write operation further comprises recording a path of the file, a point in time the file was accessed by the monitored process, a file access type, and changes to the initial content of the file at the point in time.

15. The computer program product of claim 8 , wherein the computer executable program code is stored in a computer readable storage medium in a data processing system, and wherein the computer executable program code is downloaded over a network from a remote data processing system.

16. The computer program product of claim 8 , wherein the computer executable program code is stored in a computer readable storage medium in a server data processing system, and wherein the computer executable program code is downloaded over a network from a remote data processing system for use in a computer readable storage medium with the remote system.

17. An apparatus, comprising:
a bus;
a storage device connected to the bus, wherein the storage device contains computer executable code;
at least one managed device connected to the bus;
a communications unit connected to the bus; and
a processing unit connected to the bus, wherein the processing unit executes the computer executable code to obtain, in response to detecting selection of a monitored p

Assignees

• Aniszczyk Chris
• King Jennifer E
• Lauridsen Christina K
• Peterson Robert R
• Safabakhsh Borna
• Ulerich Rhys D
• IBM

Inventors

• Aniszczyk Chris
• King Jennifer E
• Lauridsen Christina K
• Peterson Robert R
• Safabakhsh Borna
• Ulerich Rhys D

Classifications

• G06F11/3644

  by instrumenting at runtime · CPC title

• G06F9/445

  Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) · CPC title

• G06F9/45504 Primary

  Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators · CPC title