Systems and methods for processing hypervisor-generated event data

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of:

• for each server of a plurality servers identified in a server list:
• determining, based on a mapping of servers to hypervisor types, a type of hypervisor running on the server;
• and
• further determining, based on a mapping of hypervisor types to event definitions, a set of event definitions associated with the determined type of hypervisor running on the server;
• wherein each event definition of the set of event definitions indicates whether occurrences of hypervisor events corresponding to the event definition are detected based on one of a push operation or a pull operation;
• detecting, based on the set of event definitions, occurrences of a plurality of hypervisor events;
• determining whether an occurrence of one or more hypervisor events of the plurality of hypervisor events satisfies a defined event list, the defined event list representing a normalized event;
• and
• in response to determining that the occurrence of the one or more hypervisor events satisfies an internal event list, generating a normalized event.

An apparatus, comprising:

• one or more processors;
• a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:
• for each server of a plurality servers identified in a server list:
• determine, based on a mapping of servers to hypervisor types, a type of hypervisor running on the server;
• and
• further determine, based on a mapping of hypervisor types to event definitions, a set of event definitions associated with the determined type of hypervisor running on the server;
• wherein each event definition of the set of event definitions indicates whether occurrences of hypervisor events corresponding to the event definition are detected based on one of a push operation or a pull operation;
• detect, based on the set of event definitions, occurrences of a plurality of hypervisor events;
• determine whether an occurrence of one or more hypervisor events of the plurality of hypervisor events satisfies a defined event list, the defined event list representing a normalized event;
• and
• in response to determining that the occurrence of the one or more hypervisor events satisfies an internal event list, generate a normalized event.