Monitoring system-calls to identify runaway processes within a computer system

• US 20060184669A1
• Filed: 03/24/2006
• Published: 08/17/2006
• Est. Priority Date: 08/13/2004
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Vaidyanathan, Kalyanaraman, Gross, Kenneth C., Thampy, Sajjit
• Granted Patent: US 7,359,834 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 9/485 Task life-cycle, e.g. stopping, restarting, resuming execution G06F9/4881 takes precedence
• CPC Class Codes: G06F 9/54 Interprogram communication

Abstract

One embodiment of the present invention provides a system that monitors system-calls to identify runaway processes within a computer system. First, the system monitors system-calls on the computer system during runtime, to generate a trace of system-calls made. Then, the system analyzes the trace to detect runaway processes.

Claims

1. A method for identifying runaway processes within a computer system, comprising:

monitoring system-calls on the computer system during runtime to generate a trace of system-calls made; and

analyzing the trace of system-calls made to detect runaway processes.

2. The method of claim 1, wherein analyzing the trace of system-calls made to detect runaway processes involves:

computing a metric from the trace of system-calls made; and

using the metric to subsequently identify runaway processes.

3. The method of claim 2, wherein computing the metric involves:

creating a histogram for the trace of system-calls made;

comparing the frequency of the most common system-call in the trace to the mean system-call frequency for the system-calls in the trace.

4. The method of claim 2, wherein the method is performed over a limited time interval to reduce resource usage.

5. The method of claim 4, wherein the method is repeated over multiple time intervals to determine changes in the metric.

6. The method of claim 1, wherein monitoring system-calls on the computer system involves using a dynamic tracing framework.

7. The method of claim 3, wherein identifying a runaway process involves checking a set of secondary characteristics to confirm that a process is likely to be a runaway process.

8. The method of claim 7, wherein checking the set of secondary characteristics involves comparing a process type for the process to a list of culprit process types to determine whether the process is likely to be a runaway process.

9. The method of claim 8, wherein the method further comprises:

killing the runaway process;

alerting a system administrator of the runaway process; and

/or

alerting an owner of the runaway process.

10. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for identifying runaway processes within a computer system, comprising:

monitoring system-calls on the computer system during runtime to generate a trace of system-calls made; and

analyzing the trace of system-calls made to detect runaway processes.

11. The computer-readable storage medium of claim 10, wherein analyzing the trace of system-calls made to detect runaway processes involves:

computing a metric from the trace of system-calls made; and

using the metric to subsequently identify runaway processes.

12. The computer-readable storage medium of claim 11, wherein computing the metric involves:

creating a histogram for the trace of system-calls made;

comparing the frequency of the most common system-call in the trace to the mean system-call frequency for the system-calls in the trace.

13. The computer-readable storage medium of claim 11, wherein the method is performed over a limited time interval to reduce resource usage.

14. The computer-readable storage medium of claim 13, wherein the method is repeated over multiple time intervals to determine changes in the metric.

15. The computer-readable storage medium of claim 10, wherein monitoring system-calls on the computer system involves using a dynamic tracing framework.

16. The computer-readable storage medium of claim 12, wherein identifying a runaway process involves checking a set of secondary characteristics to confirm that a process is likely to be a runaway process.

17. The computer-readable storage medium of claim 16, wherein checking the set of secondary characteristics involves comparing a process type for the process to a list of culprit process types to determine whether the process is likely to be a runaway process.

18. The computer-readable storage medium of claim 17, wherein the method further comprises:

killing the runaway process;

alerting a system administrator of the runaway process; and

/or

alerting an owner of the runaway process.

19. An apparatus that identifies runaway processes within a computer system, comprising:

a monitoring mechanism configured to monitor system-calls on the computer system during runtime to generate a trace of system-calls made; and

an analysis mechanism configured to analyze the trace of system-calls made to detect runaway processes.

20. The apparatus of claim 19, wherein the analysis mechanism further comprises:

a computation mechanism configured to compute a metric from the trace of system-calls made;

wherein the computation mechanism is configured to compute the metric by creating a histogram for the trace of system-calls made and comparing the frequency of the most common system-call in the trace to the mean system-call frequency for the system-calls in the trace; and

a identification mechanism that is configured to use the metric to subsequently identify runaway processes.