Log data extraction from data chunks of an isolated execution environment
AssigneeSplunk Inc.
InventorsZhimin Liang, Matthew Modestino, David Christopher Baldwin, Marc Andre Chéné, Blaine Wastell
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed for processing data associated with isolated execution environments. A chunk of data associated with an isolated execution environment can include log data and non-log data. At least a portion of the log data can include log data generated by the isolated execution environment. The system can parse the chunk of data to identify the log data and the non-log data and extract at least a portion of the log data from the chunk of data. The extracted data can be further processed to generate one or more events.
Claims28
A method, comprising:
- obtaining, at a computing device that is remotely located from a data intake and query system, a chunk of data generated by an isolated execution environment manager executing on one or more processing devices of a host computing device, wherein the isolated execution environment manager manages allocation of computing resources of the host computing device between a plurality of isolated execution environments, the plurality of isolated execution environments configured to share the computing resources of the host computing device;
- parsing, at the computing device, the chunk of data to identify first data generated by an isolated execution environment of the plurality of isolated execution environments and second data generated by the isolated execution environment manager, wherein the first data is log data;
- extracting, at the computing device, at least a portion of the first data from the chunk of data;
- and
- communicating, from the computing device, the extracted at least a portion of the first data to the data intake and query system, wherein one or more components of the data intake and query system generate one or more events based on the extracted at least a portion of the first data.
A computing system remotely located from a data intake and query system, the computing system comprising:
- memory;
- and
- one or more processing devices coupled to the memory and configured to:
- obtain a chunk of data generated by an isolated execution environment manager executing on one or more processing devices of a host computing device, wherein the isolated execution environment manager manages allocation of computing resources of the host computing device between a plurality of isolated execution environments, the plurality of isolated execution environments configured to share the computing resources of the host computing device;
- parse the chunk of data to identify first data generated by an isolated execution environment of the plurality of isolated execution environments and second data generated by the isolated execution environment manager, wherein the first data is log data;
- extract at least a portion of the first data from the chunk of data;
- and
- communicate the extracted at least a portion of the first data to the data intake and query system, wherein one or more components of the data intake and query system generate one or more events based on the extracted at least a portion of the first data.
Non-transitory computer readable media comprising computer-executable instructions that, when executed by a computing system remotely located from a data intake and query system, cause the computing system to:
- obtain a chunk of data generated by an isolated execution environment manager executing on one or more processing devices of a host computing device, wherein the isolated execution environment manager manages allocation of computing resources of the host computing device between a plurality of isolated execution environments, the plurality of isolated execution environments configured to share the computing resources of the host computing device;
- parse the chunk of data to identify first data generated by an isolated execution environment of the plurality of isolated execution environments and second data generated by the isolated execution environment manager, wherein the first data is log data;
- extract at least a portion of the first data from the chunk of data;
- and
- communicate the extracted at least a portion of the first data to the data intake and query system, wherein one or more components of the data intake and query system generate one or more events based on the extracted at least a portion of the first data.
Dependencies are inferred from the claim text.