Method and apparatus for detecting process failure

• US 7,733,774 B1
• Filed: 06/07/2007
• Issued: 06/08/2010
• Est. Priority Date: 06/07/2007
• Status: Active Grant

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Jagtap, Asmita, Toke, Harshad, Sasidharan, Prasanth Nalini
• Primary Examiner(s): Pham; Chi H
• Assistant Examiner(s): HYUN, SOON D
• Application Number:
  US11/811,305
• Time in Patent Office: 1,097 Days
• Field of Search: None
• US Class Current: 370/230
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/1443 Transmit or communication errors
• CPC Class Codes: G06F 11/1482 by means of middleware or OS functionality
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A method and apparatus for monitoring a process to determine when an abnormal process exit occurs comprising monitoring events related to the process and detecting a communication connection closing without receiving a notification of an exit event for the process. On detection of an abnormal exit of a process associated with the communication connection, the method and apparatus provide special failover processing including, for example, a TCP connection failover process.

Claims

1. A method executed on a computer of monitoring a computer process, the method comprising:

monitoring events related to the computer process using the computer;

detecting a communication connection closing without receiving a notification of an exit event for the computer process using the computer; and

invoking a special processing on the computer on detection of the communication connection closing, wherein the special processing comprises allowing transmission of data segments to a remote end of the communication connection only on a normal exit of the computer process or the communication connection being intentionally closed by the process.

2. The method of claim 1, wherein the communication connection is an inter-process communication (IPC) channel.

3. The method of claim 1, wherein the communication connection is a transmission control protocol (TCP) connection.

4. The method of claim 1, wherein the special processing is a processing of a TCP connection associated with the process to maintain the connection half open.

5. The method of claim 4, wherein the special processing of a TCP connection associated with the process, and the special processing comprises filtering at least one TCP segment for transmission to the remote end of the TCP connection.

6. The method of claim 5, wherein the data segments are TCP segments.

7. The method of claim 1, wherein the special processing is a failover processing.

8. The method of claim 7, wherein the failover processing comprises

associating a software library to the process;

monitoring events from the software library by an event monitoring entity having access to at least one TCP segment belonging to the TCP connection; and

filtering at least one TCP segment for transmission to the remote end of the TCP connection.

9. The method of claim 8, wherein the data segments are TCP segments.

10. The method of claim 8, wherein the event monitoring entity is a packet filter.

11. Apparatus for monitoring a process comprising:

means for monitoring events related to the process; and

means for providing functionality used to communicate with the means for monitoring through a communication connection,

wherein the means for monitoring detects the communication connection being closed without receiving a notification of an exit event and wherein the means for monitoring has access to at least one data segment belonging to the communication connection and the means for monitoring allows the transmission of data segments to the remote end of the communication connection only on a normal exit of the process.

12. The apparatus of claim 11, wherein the communication connection is an inter-process communication (IPC) channel.

13. The apparatus of claim 11, wherein the communication connection is a TCP connection.

14. The apparatus of claim 13, further comprising at least one TCP connection, wherein the means for monitoring has access to at least one TCP segment belonging to the TCP connection and the event monitoring entity is configured to filter one or more of the at least one TCP segment.

15. The apparatus of claim 14, wherein the TCP segments are chosen from a group consisting of at least one of FIN and RESET flag sets.

16. The apparatus of claim 13, further comprising at least one TCP connection, wherein the data segments are TCP segments.

17. The apparatus of claim 16, wherein the TCP segments are chosen from a group consisting of at least one of FIN and RESET flag sets.

18. A system for monitoring a process comprising:

first computer;

a second computer comprising an event monitoring entity for monitoring events related to the process; and

a software library associated with the process, the software library configured to communicate with the monitoring entity through a communication connection, wherein the event monitoring entity detects the communication connection being closed without receiving a notification of an exit event and wherein the event monitoring entity has access to at least one data segment belonging to the communication connection and the event monitoring entity allows the transmission of data segments to the remote end of the communication connection only on a normal exit of the process; and

a communications network coupling the first computer to the second computer.

19. The apparatus of claim 18, wherein the communication connection is an inter-process communication (IPC) channel.

20. The apparatus of claim 18, wherein the communication connection is a TCP connection between the first computer and the second computer.

21. The apparatus of claim 20, further comprising at least one TCP connection, wherein the event monitoring entity has access to at least one TCP segment belonging to the TCP connection and the event monitoring entity filters one or more of the at least one TCP segment.

22. The apparatus of claim 21, wherein the event monitoring entity comprises a packet filter.

23. The apparatus of claim 21, wherein the TCP segments are chosen from a group consisting of at least one of FIN and RESET flag sets.

24. The apparatus of claim 20, further comprising at least one TCP connection, wherein the data segments are TCP segments.

25. The apparatus of claim 24, wherein the TCP segments are chosen from a group consisting of at least one of FIN and RESET flag sets.