Method and system for implementing an operating system hook in a log analytics system
AssigneeOracle International Corporation
InventorsJerry Paul Russell, Haobo He, Greg Ma, Xin Xu
Life of this patent
Estimating the term…
Abstract
Disclosed is a system, method, and computer program product for implementing a log analytics method and system that can configure, collect, and analyze log records in an efficient manner. An improved approach is provided for identifying log files that have undergone a change in status that would require retrieve of its log data, by including a module directly into the operating system that allows the log collection component to be reactively notified of any changes to pertinent log files.
Claims20
A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:
- identifying a target subset of OS calls from a plurality of OS calls;
- intercepting a plurality of invocations of one or more OS calls in the target subset of OS calls;
- identifying a plurality of log file changes corresponding respectively to the plurality of invocations;
- identifying a plurality of events corresponding to the plurality log file changes;
- filtering the plurality of events, based on one or more event filtering criteria, to obtain a subset of events corresponding to a subset from the plurality of log file changes;
- and
- writing the subset of events to an event list.
A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:
- identifying a target subset of OS calls from a plurality of OS calls;
- intercepting a plurality of invocations of one or more OS calls in the target subset of OS calls;
- identifying a plurality of log file changes corresponding respectively to the plurality of invocations;
- writing, to an event list, a plurality of events corresponding to the plurality of log file changes;
- and
- filtering the event list, based on one or more event filtering criteria, to obtain a filtered event list comprising events corresponding to a subset of the plurality of log file changes.
Dependencies are inferred from the claim text.