EXTRACTING AND COLLECTING PLATFORM USE DATA

• US 20100229157A1
• Filed: 03/06/2009
• Published: 09/09/2010
• Est. Priority Date: 03/06/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Earhart, Douglas R., Shivaswamy, Udayasimha, Kochhar, Eric, Brodsky, Micah, Steventon, Justin, Ergan, Cenk
• Granted Patent: US 8,776,027 B2
• Time in Patent Office: Days
• US Class Current: 717/128
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

A system for reporting information about how selected components of an operating system are used by applications on a computing device. A manifest of components is provided from a management server to a computing device. The manifest specifies components of the operating system for which usage information is to be collected. The computing device surveys applications for calls to the components specified in the manifest. Surveys may be performed by static scanning and/or dynamic monitoring. In static scanning, application files are scanned for keyword strings specified in the manifest. Keyword string matches are recorded to a log file. In dynamic monitoring, calls from executing applications to components specified by the manifest are identified and logged. A report is generated from the log and sent to the management server. The management server then aggregates and analyzes reports from multiple computing devices to enable developers to assess how the components are being used.

Claims

1. A computer-readable storage medium comprising computer-executable modules, each module, when executed, configured to perform a respective function, the modules comprising:

an agent module configured to obtain a manifest of components of an operating system;

a logging module configured to identify calls to any of the components in the manifest;

a report generation module configured to generate a report of the identified calls; and

a report delivery module configured to transmit the report over a network to a server.

2. The computer-readable storage medium of claim 1, wherein the logging module is configured to identify calls to each component among the components in the manifest by scanning a file stored in at least one memory of a computing device for calls to the components.

3. The computer-readable storage medium of claim 2, wherein the manifest of components of the operating system comprises a keyword dictionary and the logging module identifies calls to the components by matching a portion of the file to an entry in the keyword dictionary.

4. The computer-readable storage medium of claim 1, wherein:

the logging module is further configured to identify an application executing on a computing device to be monitored and create a hook for the application, the hook configured to detect calls from the application to any of the components in the manifest.

5. The computer-readable storage medium of claim 4, wherein the logging module creates a record for each call detected by the hook to a component among the components in the manifest, the record comprising an indication of the application and the component.

6. The computer-readable storage medium of claim 4, wherein the logging module identifies a plurality of applications to be monitored and creates a hook to monitor each of the plurality of applications.

7. The computer-readable storage medium of claim 1, wherein the agent module is further configured to obtain the manifest over the network from the server.

8. The computer-readable storage medium of claim 1, wherein the agent module is configured to populate a data structure stored in a registry of a computing device with identifiers for the components in the manifest.

9. A method comprising acts of:

(a) downloading data specifying one or more components of an operating system to a computing device;

(b) determining a program to be surveyed;

(c) comparing a call from said program to the data and, when the call is to a component among the one or more specified components, recording an indication of use of said component; and

(d) sending a report to a server, the report comprising information characterizing the recorded indication of use.

10. The method of claim 9, further comprising acts of:

(e) at the server, aggregating a plurality of reports from a plurality of computing devices, the report and the computing device among the plurality of reports and the plurality of computing devices, respectively; and

(f) generating usage statistics from the plurality of reports for the one or more components.

11. The method of claim 9, wherein:

the act (a), the data comprises a plurality of keyword strings for identifying the one or more components;

the determining in the act (b) comprises randomly selecting a file stored on the computing device, the file for executing said application; and

the act (c) comprises scanning the file for a match with one of the plurality of keyword strings and recording the indication of use when the match is identified.

12. The method of claim 9, wherein the act (b), determining the program to be surveyed, comprises generating a random value.

13. The method of claim 9, wherein the indication of use comprises an identifier of the program and an identifier of the component.

14. The method of claim 9, wherein the program to be surveyed is an application executing on the computing device and the call is a request from said executing program to the component of the operating system to perform a function.

15. The method of claim 14, wherein the act (c) is performed by a hook between the program and the operating system.

16. A computing device running an operating system, the computing device comprising:

a computer-readable storage medium to store a manifest and a plurality of applications including a first application and a second application, each application having computer-executable instructions;

a processor configured to execute the first application;

a dynamic monitoring module configured to detect, during execution of the first application, a call from the first application to a component among a plurality of components indexed by the manifest and record a first log entry identifying the first application and the component;

a static scanning module configured to scan a file associated with the second application for a keyword string contained in the manifest and, when the keyword string is identified in the file, record a second log entry;

an agent module to generate at least one report using the first and second log entry; and

a network interface configured to receive the manifest from a server and to transmit the at least one report to the server.

17. The computing device of claim 16, further comprising:

an application selection module to randomly select the first application for monitoring and to assign the dynamic monitoring module to the application.

18. The computing device of claim 16, wherein agent module is further configured to determine if the manifest has expired.

19. The computing device of claim 16, wherein:

the dynamic monitoring module records a plurality of log entries including the first log entry, the plurality of log entries being for calls from the first application to components among the plurality of components indexed by the manifest; and

the agent module generates the at least one report from only a subset of the plurality of log entries.

20. The computing device of claim 16, wherein the dynamic monitoring module is further configured to record in the first log entry a stack and a trace of where application modules are loaded in the first application.