File alteration monitor for computer operating and file management system
First Claim
1. In a computer system having application programs, an operating system, and files, apparatus for providing notification of alterations to monitored files to client application programs that request such notification, notification being provided to said client application programs upon a calling application program initiating a procedure call for alteration to said monitored file, said apparatus comprising:
- first storage means for storing an imon function pointers list including imon function pointers for pointing to executable code;
first pointer means coupled to said first storage means for selecting executable code from said imon function pointers list;
second storage means for storing a system code function pointers list including code for altering said files;
second pointer means coupled to said second storage means for selecting code for altering files;
imon means coupled to said first and second storage means for intercepting said procedure call;
an event queue resident in said imon means for storing a record of the initiation of said procedure call for alteration to said monitored file,request storing means resident in said imon means for storing said request for notification of alteration to said monitored file;
means for alteration detection resident in said imon means for correlating said request for notification of alteration to said monitored file with said record of the initiation of said procedure call for alteration to said monitored file; and
means resident in said imon means for providing notification to said client application program of said procedure call for alteration to said monitored file;
said imon means first rerouting said intercepted procedure call through said imon function pointers list, and then rerouting said procedure call to its original destination for executing said procedure call to alter said monitored file.
6 Assignments
0 Petitions
Accused Products
Abstract
A server to which clients subscribe for on-the fly notice of alterations to files and directories in a computer having an operating and file management system. The server also provides status of the execution state of executable code, alteration detection for multiple requests from multiple clients, and tracks files and directories on a user'"'"'s local station. In addition, the server monitors network-mounted files on remote computers even though events are only generated for local activity on network files.
169 Citations
31 Claims
-
1. In a computer system having application programs, an operating system, and files, apparatus for providing notification of alterations to monitored files to client application programs that request such notification, notification being provided to said client application programs upon a calling application program initiating a procedure call for alteration to said monitored file, said apparatus comprising:
-
first storage means for storing an imon function pointers list including imon function pointers for pointing to executable code; first pointer means coupled to said first storage means for selecting executable code from said imon function pointers list; second storage means for storing a system code function pointers list including code for altering said files; second pointer means coupled to said second storage means for selecting code for altering files; imon means coupled to said first and second storage means for intercepting said procedure call; an event queue resident in said imon means for storing a record of the initiation of said procedure call for alteration to said monitored file, request storing means resident in said imon means for storing said request for notification of alteration to said monitored file; means for alteration detection resident in said imon means for correlating said request for notification of alteration to said monitored file with said record of the initiation of said procedure call for alteration to said monitored file; and means resident in said imon means for providing notification to said client application program of said procedure call for alteration to said monitored file;
said imon means first rerouting said intercepted procedure call through said imon function pointers list, and then rerouting said procedure call to its original destination for executing said procedure call to alter said monitored file. - View Dependent Claims (2, 3)
-
-
4. In a computer system having application programs, an operating system, and files, apparatus for providing notification of alterations to monitored files to client application programs that request such notification, notification being provided to said client application programs upon a calling application program initiating a procedure call for alteration to said monitored file, said apparatus comprising:
-
storage means for storing function pointers for pointing to executable code; selection means coupled to said storage means for selecting designated code therefrom; imon means coupled to said storage means for intercepting said procedure call; an event queue resident in said imon means for storing a record of the initiation of said procedure call for alteration to said monitored file; request storing means resident in said imon means for storing said request for notification of alteration to said monitored file; means for alteration detection resident in said imon means for correlating said request for notification of alteration to said monitored file with said record of the initiation of said procedure call for alteration to said monitored file; and means resident in said imon means for providing notification to said client application program of said procedure call for alteration to said monitored file;
said imon means first rerouting said intercepted procedure call through said storage means, and then rerouting said procedure call to its original destination for executing said procedure call to alter said monitored file. - View Dependent Claims (5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 21, 22, 23, 24)
-
-
16. In a computer system having application programs, an operating system, and files, a method for providing notification of alterations to monitored files to client application programs that request such notification, notification being provided to said client application programs upon a calling application program initiating a procedure call for alteration to said monitored file, said method comprising the following steps:
-
storing an imon function pointers list including imon function pointers for pointing to executable code; selecting executable code from said imon function pointers list; storing a system code function pointers list including code for altering said files; selecting code for altering files; intercepting said procedure call; storing a record of the initiation of said procedure call for alteration to said monitored file; storing said request for notification of alteration to said monitored file; correlating said request for notification of alteration to said monitored file with said record of the initiation of said procedure call for alteration to said monitored file; and providing notification to said client application program of said procedure call for alteration to said monitored file; first rerouting said intercepted procedure call through said imon function pointers list; and then rerouting said procedure call to its original destination for executing said procedure call to alter said monitored file. - View Dependent Claims (17, 18)
-
-
19. In a computer system having application programs, an operating system, and files, a method for providing notification of alterations to monitored files to client application programs that request such notification, notification being provided to said client application programs upon a calling application program initiating a procedure call for alteration to said monitored file, said method comprising the following steps:
-
storing a plurality of function pointers that point to executable code; selecting designated function pointers; intercepting said procedure call; storing a record of the initiation of said procedure call for alteration to said monitored file; storing said request for notification of alteration to said monitored file; correlating said request for notification of alteration to said monitored file with said record of the initiation of said procedure call for alteration to said monitored file; and providing notification to said client application program of said procedure call for alteration to said monitored file; first rerouting said intercepted procedure call through said function pointers; and then rerouting said procedure call to its original destination for executing said procedure call to alter said monitored file. - View Dependent Claims (20, 25, 26, 27, 28, 29, 30)
-
-
31. A file alteration monitor for use in a computer system having an existing structure kernel, said computer system having a point where file operations change from being a file system independent portion of said kernel to being a file system dependent portion of said kernel, said file alteration monitor comprising:
-
a plurality of active files resident in said computer system, each of said active files having a file node known as an inode; an application program resident in said computer system, said application program expressing interest in file system activity in a specific file by means of a first system call; a file system switch located at the interface between said file system independent portion of said kernel and said file system dependent portion of said kernel, said file system switch being a set of program instructions used to determine which system code to call to execute file access and manipulation; an inode monitor driver known as an imon and which comprises a pseudo device driver which cooperates with said application program to monitor file system activity, said inode monitor driver maintaining an inode cache of file nodes describing the state of every one of said active files resident in said computer system, said inode cache having a cache fill routine, said inode monitor driver inserting hooks into said inode cache fill routine so that a drive function is called every time a new file node is brought into said inode cache, said cache fill routine then looks up the new file node to determine whether it is said specific file in which interest has been expressed; said file alteration monitor being hooked into said kernel at said file system switch and using said file system switch to preselect code that generates a queue representing events based on access and manipulation of said specific file in which interest has been expressed, as various types of actions take place on said specific file in which interest has been expressed, said monitor driver posts events through said queue that may be read by a second system call; after said queue has been created, said file alteration monitor releases said specific file in which interest has been expressed and routes said specific file back through said file system switch to its original destination.
-
Specification