FILE SYSTEM FOR A CAPTURE SYSTEM

• US 20110167212A1
• Filed: 03/16/2011
• Published: 07/07/2011
• Est. Priority Date: 08/24/2004
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Broeker, Stephen, Liu, Weimin, Lowe, Rick
• Granted Patent: US 8,707,008 B2
• Time in Patent Office: Days
• US Class Current: 711/112
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A file system can be provided in a capture system to efficiently read and write captured objects. In one embodiment, such a file system includes a plurality of queues to queue captured objects to be written to a disk, each queue being associated with one of a plurality of object types, and each queue containing captured objects of the type associated with each queue. A scheduler can be provided to select one of the plurality of queues, and a block manager to select a partition of a disk, the partition being associated with the object type of the captured objects in the selected queue. A disk controller configured to write contiguous blocks of data from the selected queue to the selected partition is connected to the block manager to enable writing to a disk.

Claims

1-19. -19. (canceled)

20. A capture system, comprising:

a file system configured to organize data on a disk and to regulate read and write accesses;

a plurality of queues associated with captured objects that are received through the capture system via network traffic, wherein the queues are associated with captured objects having a common trait, and wherein the disk is divided into a plurality of partitions for storing at least some of the captured objects;

a scheduler configured to select one of the plurality of queues for performing a particular write operation; and

a block manager configured to select one of the partitions of the disk, wherein blocks of data are written from the selected queue to the selected partition.

21. The capture system of claim 20, wherein the file system is a block-based file system including contiguous blocks that form the plurality of partitions.

22. The capture system of claim 20, wherein the file system includes an application program interface (API) for interfacing with an operating system of the capture system.

23. The capture system of claim 20, wherein the plurality of queues includes a catchall queue for objects not having their own designated queue.

24. The capture system of claim 20, wherein object type determinations are performed by identifying a content field of a tag associated with a particular captured object.

25. The capture system of claim 20, wherein at least one of the queues is associated with e-mails or word processing documents.

26. The capture system of claim 20, wherein the scheduler implements a write policy that designates a certain write performance without regard to read performance.

27. The capture system of claim 20, wherein the captured objects represented by particular blocks of data can be retrieved in response to a query to search for a tag included in one or more of the captured objects.

28. A method, comprising:

receiving network traffic via a capture system configured for capturing objects, wherein the capture system includes a file system configured to organize data on a disk and to regulate read and write accesses, and wherein the capture system further includes a plurality of queues associated with captured objects that are received through the capture system via network traffic, wherein the queues are associated with captured objects having a common trait, and wherein the disk is divided into a plurality of partitions for storing at least some of the captured objects;

selecting one of the plurality of queues for performing a particular write operation; and

selecting one of the partitions of the disk, wherein blocks of data are written from the selected queue to the selected partition.

29. The method of claim 28, wherein the file system is a block-based file system including contiguous blocks that form the plurality of partitions.

30. The method of claim 28, wherein the file system includes an application program interface (API) for interfacing with an operating system of the capture system.

31. The method of claim 28, wherein the plurality of queues includes a catchall queue for objects not having their own designated queue.

32. The method of claim 28, wherein object type determinations are performed by identifying a content field of a tag associated with a particular captured object.

33. The method of claim 28, wherein at least one of the queues is associated with e-mails or word processing documents.

34. The method of claim 28, wherein the captured objects represented by particular blocks of data can be retrieved in response to a query to search for a tag included in one or more of the captured objects.

35. The method of claim 28, further comprising:

implementing a write policy that designates a certain write performance without regard to read performance.

36. Logic encoded in non-transitory media that includes code for execution and when executed by a processor operable to perform operations comprising:

receiving network traffic via a capture system configured for capturing objects, wherein the capture system includes a file system configured to organize data on a disk and to regulate read and write accesses, and wherein the capture system further includes a plurality of queues associated with captured objects that are received through the capture system via network traffic, wherein the queues are associated with captured objects having a common trait, and wherein the disk is divided into a plurality of partitions for storing at least some of the captured objects;

selecting one of the plurality of queues for performing a particular write operation; and

selecting one of the partitions of the disk, wherein blocks of data are written from the selected queue to the selected partition.

37. The logic of claim 36, wherein the file system is a block-based file system including contiguous blocks that form the plurality of partitions, and wherein the file system includes an application program interface (API) for interfacing with an operating system of the capture system.

38. The logic of claim 36, wherein the plurality of queues includes a catchall queue for objects not having their own designated queue, and wherein the captured objects represented by particular blocks of data can be retrieved in response to a query to search for a tag included in one or more of the captured objects.

39. The logic of claim 36, wherein object type determinations are performed by observing a content field of a tag associated with a particular captured object.