Always-On Monitoring in the Cloud

• US 20150295800A1
• Filed: 04/10/2014
• Published: 10/15/2015
• Est. Priority Date: 04/10/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bala, Vasanth, Mummert, Todd W., Suneja, Sahil, Isci, Canturk
• Granted Patent: US 10,530,837 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/562 Brokering proxy services
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

A mechanism is provided in a data processing system for monitoring a virtual machine in a distributed computing system. An out-of-virtual machine monitor receives, via an out-of-band path, disk and memory state data of the virtual machine exposed in a hypervisor hosting the virtual machine. The out-of-virtual machine monitor interprets logical information from the virtual machine disk and memory state data. The out-of-virtual machine monitor parses the logical information to extract related system or log information for a monitoring endpoint. The out-of-virtual machine monitor translates the system or log information to a standard format expected by the monitoring endpoint. The out-of-virtual machine monitor forwards a monitoring data stream to the monitoring endpoint.

Claims

1. A method, in a data processing system, for monitoring a virtual machine in a distributed computing system, the method comprising:

receiving, via an out-of-band path, exposed disk and memory state data of the virtual machine;

interpreting logical information from the exposed disk and memory state data;

parsing the logical information to extract related system or log information for a monitoring endpoint; and

forwarding a monitoring data stream including the related system or log information to the monitoring endpoint.

2. The method of claim 1, wherein the disk state data are represented as a file on the hypervisor filesystem, a direct-mapped local or remote block device, or a virtual disk format.

3. The method of claim 1, wherein attach logic in a hypervisor hosting the virtual machine creates a local block device wrapper or network attached device wrapper around the disk.

4. The method of claim 1, wherein the memory state data are exposed in a hypervisor hosting the virtual machine by dumping the memory, migrating the memory to file, snapshotting the memory, remote direct memory access, or a hypervisor-level application programming interface.

5. The method of claim 1, wherein interpreting logical information from the exposed disk and memory state data comprises mounting a filesystem of the disk, inspecting blocks of the disk to discover file-level information, mapping well-known operating data structures on an address space of the memory, or using heuristics to discover data structures in the memory.

6. The method of claim 1, further comprising:

receiving, via an in-band path, an in-band data stream from the virtual machine;

normalizing the in-band data stream and the out-of-band data stream to a common format; and

determining the monitoring data stream, selected between the in-band data stream and the out-of-band data stream, to forward to the monitoring endpoint.

7. The method of claim 6, further comprising:

using the out-of-band data stream to monitor a footprint of the in-band path;

responsive to determining a failure of the in-band path based on the footprint of the in-band path, selecting the out-of-band data stream to forward to the monitoring endpoint and alerting the monitoring endpoint to revive the in-band path.

8. The method of claim 6, further comprising:

responsive to determining the in-band data stream and the out-of-band data stream substantially deviate, alerting a security solution of a potential compromise of the in-band path and quarantining the virtual machine.

9. The method of claim 1, further comprising translating the system or log information to a standard format expected by the monitoring endpoint.

10. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

receive, via an out-of-band path, exposed disk and memory state data of the virtual machine;

interpret logical information from the exposed disk and memory state data;

parse the logical information to extract related system or log information for a monitoring endpoint; and

forward a monitoring data stream including the related system or log information to the monitoring endpoint.

11. The computer program product of claim 10, wherein the computer readable program further causes the computing device to:

receive, via an in-band path, an in-band data stream from the virtual machine;

normalize the in-band data stream and the out-of-band data stream to a common format; and

determine the monitoring data stream, selected between the in-band data stream and the out-of-band data stream, to forward to the monitoring endpoint.

12. The computer program product of claim 11, wherein the computer readable program further causes the computing device to:

use the out-of-band data stream to monitor a footprint of the in-band path;

responsive to determining a failure of the in-band path based on the footprint of the in-band path, select the out-of-band data stream to forward to the monitoring endpoint and alert the monitoring endpoint to revive the in-band path.

13. The computer program product of claim 11, wherein the computer readable program further causes the computing device to:

responsive to determining the in-band data stream and the out-of-band data stream substantially deviate, alert a security solution of a potential compromise of the in-band path and quarantine the virtual machine.

14. An apparatus, comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to;

receive, via an out-of-band path, exposed disk and memory state data of the virtual machine;

interpret logical information from the exposed disk and memory state data;

parse the logical information to extract related system or log information for a monitoring endpoint; and

forward a monitoring data stream including the related system or log information to the monitoring endpoint.

15. The apparatus of claim 14, wherein the instructions further cause the processor to:

receive, via an in-band path, an in-band data stream from the virtual machine;

normalize the in-band data stream and the out-of-band data stream to a common format; and

determine the monitoring data stream, selected between the in-band data stream and the out-of-band data stream, to forward to the monitoring endpoint.

16. The apparatus of claim 15, wherein the instructions further cause the processor to:

use the out-of-band data stream to monitor a footprint of the in-band path;

responsive to determining a failure of the in-band path based on the footprint of the in-band path, select the out-of-band data stream to forward to the monitoring endpoint and alert the monitoring endpoint to revive the in-band path.

17. The apparatus of claim 15, wherein the instructions further cause the processor to:

responsive to determining the in-band data stream and the out-of-band data stream substantially deviate, alert a security solution of a potential compromise of the in-band path and quarantine the virtual machine.

18. A method, in a data processing system, for monitoring a virtual machine in a distributed computing system, the method comprising:

receiving, via an out-of-band path, exposed disk and memory state data of the virtual machine as an out-of-band data stream;

receiving, via an in-band path, an in-band data stream from the virtual machine;

normalizing the in-band data stream and the out-of-band data stream to a common format; and

determining the monitoring data stream, selected between the in-band data stream and the out-of-band data stream, to forward to a monitoring endpoint.

19. The method of claim 18, wherein receiving an in-band data stream from the virtual machine comprises receiving the in-band data stream from a software agent executing within the virtual machine.

20. The method of claim 18, wherein receiving an in-band data stream from the virtual machine comprises receiving the in-band data stream via remote access into the virtual machine.

21. The method of claim 18, wherein determining the monitoring data stream comprises:

responsive to the in-band-data stream and the out-of-band data stream being substantially equivalent, selecting an earliest received data stream between the in-band data stream and the out-of-band data stream.

22. The method of claim 18, wherein determining the monitoring data stream comprises:

responsive to a given data stream between the in-band data stream and the out-of-band data stream being more feature rich, selecting the given data stream.

23. The method of claim 18, further comprising:

using the out-of-band data stream to monitor a footprint of the in-band path;

responsive to determining a failure of the in-band path based on the footprint of the in-band path, selecting the out-of-band data stream to forward to the monitoring endpoint and alerting the monitoring endpoint to revive the in-band path.

24. The method of claim 18, further comprising:

responsive to determining the in-band data stream and the out-of-band data stream substantially deviate, alerting a security solution of a potential compromise of the in-band path and quarantining the virtual machine.