File system for a capture system

• US 7,949,849 B2
• Filed: 06/27/2005
• Issued: 05/24/2011
• Est. Priority Date: 08/24/2004
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Broeker, Stephen, Liu, Weimin, Lowe, Rick
• Primary Examiner(s): PATEL, KAUSHIKKUMAR M
• Application Number:
  US11/168,104
• Publication Number:
  US 20060047675A1
• Time in Patent Office: 2,157 Days
• Field of Search: 711/112
• US Class Current: 711/173
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A file system can be provided in a capture system to efficiently read and write captured objects. In one embodiment, such a file system includes a plurality of queues to queue captured objects to be written to a disk, each queue being associated with one of a plurality of object types, and each queue containing captured objects of the type associated with each queue. A scheduler can be provided to select one of the plurality of queues, and a block manager to select a partition of a disk, the partition being associated with the object type of the captured objects in the selected queue. A disk controller configured to write contiguous blocks of data from the selected queue to the selected partition is connected to the block manager to enable writing to a disk.

Claims

1. A file system for a capture system, the file system comprising:

a plurality of queues to queue captured objects to be written to a disk, each queue being associated with one of a plurality of object types, wherein each queue contains captured objects of the type associated with each queue, and wherein the plurality of queues includes a catchall queue for objects not having their own designated queue, and wherein the object type is determined by a content classification, wherein the captured objects are respective pluralities of packets that are broken down by the capture system and then reassembled, and wherein the object types include a plurality of object types that comprise at least a first object type denoting e-mail objects and a second object type denoting word processing objects, the packets associated with a document that includes the objects, wherein the document is captured based on a capture rule that specifies the objects, and wherein a determination is made as to whether to discard or to store the objects of the document;

a scheduler to select one of the plurality of queues;

a block manager to select a partition of a disk, the partition being associated with the object type of the captured objects in the selected queue; and

a disk controller to write blocks of data from the selected queue to the selected partition such that the captured objects represented by the blocks of data may be retrieved in response to a query to search for a tag included in one or more objects, wherein each captured object has an associated tag that includes the object type associated with each captured object.

2. The file system of claim 1, wherein the scheduler guarantees a threshold level of write performance without regard for read performance.

3. The file system of claim 1, wherein the selected partition comprises a plurality of contiguous blocks of data representing objects of like object type.

4. The file system of claim 1, further comprising an application program interface (API) configured to interface the file system with at least one application being executed by the capture system.

5. A method for storing an object captured over a network, the method comprising:

receiving the captured object from one or more capture modules of a capture system;

determining an object type associated with the captured object based on a content classification, wherein the captured object is a plurality of packets that are broken down by the capture system and then reassembled, and wherein the object type includes a plurality of object types that comprise at least a first object type denoting e-mail objects and a second object type denoting word processing objects, the packets associated with a document that includes the objects, wherein the document is captured based on a capture rule that specifies the objects, and wherein a determination is made as to whether to discard or to store the objects of the document;

queuing the captured object according to the determined object type in a queue associated with the determined object type; and

selecting the queue associated with the determined object type from a plurality of queues, and selecting a partition on a disk, the partition being associated with the determined object type, wherein the plurality of queues includes a catchall queue for objects not having their own designated queue.

6. The method of claim 5, further comprising writing the contents of the selected queue onto the selected partition on the disk in contiguous blocks.

7. The method of claim 5, further comprising receiving a tag associated with the captured object and containing information about the captured object, the information including the object type of the captured object.

8. The method of claim 7, wherein determining the object type associated with the captured object comprises reading a content field of the tag associated with the captured object.

9. The method of claim 7, further comprising:

queuing the tag associated with the captured object according to the determined object type in a tag queue associated with the determined object type.

10. The method of claim 9, further comprising selecting the tag queue associated with the determined object type from a plurality of tag queues, and selecting a partition on a disk, the partition being associated with the determined object type.

11. The method of claim 10, further comprising writing the contents of the selected tag queue onto the selected partition on the disk in contiguous blocks.

12. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving an object captured over a network by a capture system from one or more capture modules of a capture system;

determining an object type associated with the captured object based on a content classification, wherein the captured object is a plurality of packets that are broken down by the capture system and then reassembled, and wherein the object type includes a plurality of object types that comprise at least a first object type denoting e-mail objects and a second object type denoting word processing objects, the packets associated with a document that includes the objects, wherein the document is captured based on a capture rule that specifies the objects, and wherein a determination is made as to whether to discard or to store the objects of the document;

queuing the captured object according to the determined object type in a queue associated with the determined object type, wherein the instructions further cause the processor to select the queue associated with the determined object type from a plurality of queues, and to select a partition on a disk, the partition being associated with the determined object type, and wherein the plurality of queues includes a catchall queue for objects not having their own designated queue.

13. The machine-readable medium of claim 12, wherein the instruction further cause the processor to write the contents of the selected queue onto the selected partition on the disk in contiguous blocks.

14. The machine-readable medium of claim 12, wherein the instruction further cause the processor to receive a tag associated with the captured object and containing information about the captured object, the information including the object type of the captured object.

15. The machine-readable medium of claim 14, wherein determining the object type associated with the captured object comprises reading a content field of the tag associated with the captured object.

16. A capture system comprising:

an object capture module to capture an object over a network;

an object classification module to associate an object type of a plurality of object types with the captured object; and

a file system comprising;

a plurality of queues to queue captured objects to be written to a disk, each queue being associated with one of a plurality of object types, wherein each queue contains captured objects of the type associated with each queue, wherein the captured objects are respective pluralities of packets that are broken down by the capture system and then reassembled, and wherein the plurality of queues includes a catchall queue for objects not having their own designated queue, and wherein the object types include a plurality of object types that comprise at least a first object type denoting e-mail objects and a second object type denoting word processing objects, the packets associated with a document that includes the objects, wherein the document is captured based on a capture rule that specifies the objects, and wherein a determination is made as to whether to discard or to store the objects of the document;

a scheduler to select one of the plurality of queues;

a block manager to select a partition of a disk, the partition being associated with the object type of the captured objects in the selected queue; and

a disk controller to write contiguous blocks of data from the selected queue to the selected partition.