PASSIVE MONITORING OF VIRTUAL SYSTEMS USING AGENT-LESS, OFFLINE INDEXING

• US 20130111018A1
• Filed: 06/20/2012
• Published: 05/02/2013
• Est. Priority Date: 10/28/2011
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ammons, Glenn S., Bala, Vasanth, Duri, Sastry S., Mummert, Todd W., Reimer, Darrell C., Renganarayana, Lakshminarayanan, Azab, Ahmed M., Zhang, Xiaolan
• Application Number:
  US13/527,948
• Publication Number:
  US 20130111018A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Aspects of the present invention provide a solution for passively monitoring a computer system. In an embodiment, a virtual server is accessed by an indexing agent that is contained in an indexing appliance. The virtual server is located on a physical server and is one of a plurality of virtual system instances on a common physical server. The indexing appliance is separate from the virtual server and, as such, the indexing agent is not executed within the virtual server, itself. The indexing agent retrieves a virtual image of the virtual server and indexes the virtual image to extract features indicative of changes in the virtual server. These features are analyzed to perform passive monitoring of the virtual server. Since the indexing appliance is separate from the virtual server for which passive monitoring is being performed, the indexing agent can perform the retrieving and the indexing without utilizing agents executing within the virtual server.

Claims

1. A method for passively monitoring a computer system, comprising:

accessing a virtual server by an indexing agent that is contained in an indexing appliance separate from the virtual server, the virtual server being one of a plurality of virtual system instances on a common physical server;

retrieving a virtual image of the virtual server by the indexing agent;

indexing the virtual image by the indexing appliance to extract a set of features indicative of changes in the virtual server; and

analyzing at least one of the set of features to perform passive monitoring of the virtual server,

wherein the retrieving and the indexing are performed without utilizing agents executing within the virtual server.

2. The method of claim 1, further comprising generating the plurality of virtual system instances using a pre-configured software stack.

3. The method of claim 2, wherein the analyzing includes comparing an element of the set of features with at least a portion of the pre-configured software stack.

4. The method of claim 1, the analyzing further comprising:

designating a set of sensitive components of the virtual server; and

informing a user in response to the analyzing indicating a non-compliant change has occurred in the set of sensitive components.

5. The method of claim 1, wherein the indexing appliance is included in a virtual system instance on the common physical server that is different from the virtual server.

6. The method of claim 1, further comprising, prior to the retrieving:

establishing a checkpoint using a built-in snapshot feature of a virtualization layer of the virtual server; and

generating the virtual image containing a file system and a running state of the virtual server at a time of the checkpoint.

7. The method of claim 1, further comprising:

receiving, prior to the retrieving, a request from a central detection server at the indexing appliance, the request requesting the indexing appliance to perform passive monitoring on the virtual server;

forwarding data corresponding to the set of features from the indexing appliance to the central detection server; and

performing the analyzing at the central detection server.

8. The method of claim 1, wherein the set of features is indicative of whether drift has occurred in the virtual server and wherein the analyzing includes determining whether drift has occurred in the virtual server.

9. A system for passively monitoring a computer system, comprising:

a physical server having a plurality of virtual system instances operating thereon; and

an indexing appliance operating on the physical server, which performs a method comprising;

using an indexing agent that is contained in the indexing appliance to access a virtual server from among the plurality of virtual systems instances, the virtual server being separate from the indexing appliance;

retrieving a virtual image of the virtual server by the indexing agent;

indexing the virtual image by the indexing appliance to extract a set of features indicative of changes in the virtual server; and

analyzing at least one of the set of features to perform passive monitoring of the virtual server,

wherein the retrieving and the indexing are performed without utilizing agents executing within the virtual server.

10. The system of claim 9, the method further comprising generating the plurality of virtual system instances using a pre-configured software stack.

11. The system of claim 9, wherein the indexing includes comparing an element of the set of features with at least a portion of the pre-configured software stack.

12. The system of claim 9, the analyzing further comprising:

designating a set of sensitive components of the virtual server; and

informing a user in response to the analyzing indicating a non-compliant change has occurred in the set of sensitive components.

13. The system of claim 9, wherein the indexing appliance is included in a virtual system instance on the common physical server that is different from the virtual server.

14. The system of claim 9, further comprising, prior to the retrieving:

establishing a checkpoint using a built-in snapshot feature of a virtualization layer of the virtual server; and

generating the virtual image containing a file system and a running state of the virtual server at a time of the checkpoint.

15. The system of claim 9, further comprising:

receiving, prior to the retrieving, a request from a central detection server at the indexing appliance, the request requesting the indexing appliance to perform passive monitoring on the virtual server;

forwarding data corresponding to the set of features from the indexing appliance to the central detection server; and

performing the analyzing at the central detection server.

16. The system of claim 9, wherein the set of features is indicative of whether drift has occurred in the virtual server and wherein the analyzing includes determining whether drift has occurred in the virtual server.

17. A computer program product embodied in a computer readable medium for implementing a method for passively monitoring a computer system, the method comprising:

accessing a virtual server by an indexing agent that is contained in an indexing appliance separate from the virtual server, the virtual server being one of a plurality of virtual system instances on a common physical server;

retrieving a virtual image of the virtual server by the indexing agent;

indexing the virtual image by the indexing appliance to extract a set of features indicative of changes in the virtual server; and

analyzing at least one of the set of features to perform passive monitoring of the virtual server,

wherein the retrieving and the indexing are performed without utilizing agents executing within the virtual server.

18. The program product of claim 17, the method further comprising generating the plurality of virtual system instances using a pre-configured software stack.

19. The program product of claim 17, wherein the analyzing includes comparing an element of the set of features with at least a portion of the pre-configured software stack.

20. The program product of claim 17, the analyzing further comprising:

designating a set of sensitive components of the virtual server; and

informing a user in response to the analyzing indicating a non-compliant change has occurred in the set of sensitive components.

21. The program product of claim 17, wherein the indexing appliance is included in a virtual system instance on the common physical server that is different from the virtual server.

22. The program product of claim 17, further comprising, prior to the retrieving:

establishing a checkpoint using a built-in snapshot feature of a virtualization layer of the virtual server; and

generating the virtual image containing a file system and a running state of the virtual server at a time of the checkpoint.

23. The program product of claim 17, further comprising:

receiving, prior to the retrieving, a request from a central detection server at the indexing appliance, the request requesting the indexing appliance to perform passive monitoring on the virtual server;

forwarding data corresponding to the set of features from the indexing appliance to the central detection server; and

performing the analyzing at the central detection server.

24. The program product of claim 17, wherein the set of features is indicative of whether drift has occurred in the virtual server and wherein the analyzing includes determining whether drift has occurred in the virtual server.

25. A method for deploying an application for passively monitoring a computer system, comprising:

providing a computer infrastructure being operable to;

access a virtual server by an indexing agent that is contained in an indexing appliance separate from the virtual server, the virtual server being one of a plurality of virtual system instances on a common physical server;

retrieve a virtual image of the virtual server by the indexing agent;

index the virtual image by the indexing appliance to extract a set of features indicative of changes in the virtual server; and

analyze at least one of the set of features to perform passive monitoring of the virtual server,

wherein the retrieving and the indexing are performed without utilizing agents executing within the virtual server.