System and method for writing captured data from kernel-level to a file

• US 20070094643A1
• Filed: 10/25/2005
• Published: 04/26/2007
• Est. Priority Date: 10/25/2005
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Anderson, Eric
• Application Number:
  US11/257,948
• Publication Number:
  US 20070094643A1
• Time in Patent Office: Days
• US Class Current: 709/250
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks

Abstract

According to one embodiment, a system comprises a file stored to a data storage device that is accessible to user space, and a kernel-level data capture tool, such as a kernel-level network tracing tool, that is operable to capture data and directly write the captured data to the file. According to another embodiment, a method comprises providing, by a user-space object, identification of a trace file to a kernel-level network tracing tool. The method further comprises capturing, by the kernel-level network tracing tool, data communicated over a communication network; and writing, by the kernel-level network tracing tool, at least a portion of the captured data directly to the trace file.

Claims

1. A system comprising:

a file stored to a data storage device that is accessible to user space; and

a kernel-level data capture tool operable to capture data and directly write the captured data to said file.

2. The system of claim 1 wherein said file is a network trace file.

3. The system of claim 1 wherein said kernel-level data capture tool comprises a kernel-level network tracing tool that is operable to capture data communicated over a communication network.

4. The system of claim 1 wherein said data storage device comprises one selected from the group consisting of memory and disk.

5. The system of claim 1 wherein said data storage device comprises a persistent data storage device.

6. The system of claim 1 further comprising:

a network stack, wherein said kernel-level data capture tool is operable to write the captured data to said file without first processing the captured data through the network stack.

7. The system of claim 1 further comprising:

a network stack, wherein said kernel-level data capture tool is operable to bypass processing the captured data through the network stack.

8. The system of claim 1 further comprising:

a network interface for receiving said data; and

a network driver that comprises said kernel-level data capture tool.

9. The system of claim 1 further comprising:

an interrupt handler that is operable to receive an interrupt for said captured data and trigger the write of the captured data directly to said file.

10. The system of claim 9 further comprising:

a network stack, wherein said interrupt handler is operable to bypass processing the captured data through the network stack.

11. The system of claim 1 wherein said kernel-level data capture tool is operable to receive information identifying said file to which said kernel-level data capture tool is to write the captured data.

12. The system of claim 1 further comprising:

a user-space object operable to communicate to said kernel-level data capture tool information identifying said file to which said kernel-level data capture tool is to write the captured data.

13. The system of claim 12 wherein said user-space object is operable to create said file.

14. The system of claim 12 wherein said kernel-level data capture tool is operable to communicate notification to said user-space object when said file becomes full.

15. The system of claim 1 wherein said kernel-level data capture tool is operable to write a portion of said captured data directly to an in-memory file and write a portion of said captured data directly to a file stored to disk.

16. The system of claim 15 wherein said kernel-level data capture tool dynamically determines whether to write said captured data to said in-memory file or to said file stored to disk based at least in part on a predetermined criteria.

17. The system of claim 16 wherein said predetermined criteria comprises at least one selected from the group consisting of:

memory utilization, CPU utilization, and whether said captured data is to be compressed before said write.

18. The system of claim 17 wherein whether said captured data is to be compressed before said write is determined at least in part on availability of a CPU for performing compression of said captured data.

19. A method comprising:

a user-space object communicating identification of a file to a kernel-level data capture tool; and

said kernel-level data capture tool capturing data and writing at least a portion of the captured data to said file.

20. The method of claim 19 further comprising:

said user-space object creating said file.

21. The method of claim 19 wherein said kernel-level data capture tool comprises a network tracing tool, and wherein said capturing data comprises:

capturing data communicated over a communication network.

22. The method of claim 21 wherein said data comprises packets.

23. The method of claim 19 further comprising:

said kernel-level data capture tool writing said at least a portion of the captured data to said file without first processing the captured data through a kernel-level network stack.

24. The method of claim 19 further comprising:

said kernel-level data capture tool bypassing processing of the captured data through a kernel-level network stack.

25. The method of claim 19 further comprising:

said kernel-level data capture tool determining whether to write said captured data to an in-memory file or to a file stored to disk based at least in part on a predetermined criteria.

26. The method of claim 25 wherein said predetermined criteria comprises at least one selected from the group consisting of:

memory utilization, CPU utilization, and whether said captured data is to be compressed before said write.

27. The system of claim 26 wherein whether said captured data is to be compressed before said write is determined at least in part on availability of a CPU for performing compression of said captured data.

28. A method comprising:

capturing, by a kernel-level network tracing tool of a system, data communicated over a communication network; and

writing, by said kernel-level network tracing tool, at least a portion of the captured data directly to a trace file stored to data storage that is accessible to user space of said system.

29. The method of claim 28 further comprising:

a user-space object communicating identification of said file to said kernel-level network tracing tool.

30. The method of claim 29 further comprising:

said user-space object creating said file.

31. The method of claim 28 further comprising:

said kernel-level network tracing tool performing said writing without first processing the captured data through a kernel-level network stack.

32. The method of claim 28 further comprising:

said kernel-level network tracing tool bypassing processing of the captured data through a kernel-level network stack.

33. A method comprising:

providing, by a user-space object, identification of a trace file to a kernel-level network tracing tool;

capturing, by said kernel-level network tracing tool, data communicated over a communication network; and

writing, by said kernel-level network tracing tool, at least a portion of the captured data directly to said trace file.

34. The method of claim 33 further comprising:

creating said trace file by said user-space object.

35. The method of claim 33 further comprising:

storing said trace file to data storage that is communicatively accessible by said user-space object.

36. The method of claim 35 wherein said data storage comprises an in-memory file system.

37. The method of claim 36 further comprising:

said user-space object writing said trace file to disk.

38. The method of claim 37 further comprising:

said user-space object receiving notification from said kernel-level network tracing tool when the trace file is full, and said user-space object performing said writing said trace file to disk responsive to receiving said notification that the trace file is full.

39. The method of claim 33 further comprising:

said user-space object compressing said trace file.

40. The method of claim 33 wherein said identification comprises the trace file'"'"'s name.

41. The method of claim 33 further comprising:

when the trace file is full, the kernel-level network tracing tool returning identification of the full trace file to said user-space object.

42. Computer-executable software code for a kernel-level network tracing tool, the computer-executable software code stored to a computer-readable medium, the computer-executable software code comprising:

code for receiving, by said kernel-level network tracing tool, identification of a trace file;

code for capturing, by said kernel-level network tracing tool, data communicated over a communication network; and

code for writing, by said kernel-level network tracing tool, at least a portion of the captured data directly to the identified trace file.

43. The computer-executable software code of claim 42 wherein said code for receiving comprises:

code for receiving said identification of said trace file from a user-space object.

44. The computer-executable software code of claim 42 further comprising:

code for determining, by said kernel-level network tracing tool, when the identified trace file is full.

45. The computer-executable software code of claim 44 further comprising:

code for notifying, by the kernel-level network tracing tool, a user-space object when the identified trace file is full.