Method and apparatus for efficiently detecting and logging file system changes
First Claim
1. A computer-implemented method, comprising:
- identifying, in real time and at a block level, a change made to a user-selected set of directories or files of a volume of a file system as a result of an I/O request having been processed;
writing to a log file, in real time, block change information indicating one or more blocks from a particular directory or file of a particular volume that have changed as a result of the I/O request having been processed, wherein the log file is structured to store the block change information non-sequentially and grouped by the particular directory or file to which the change relates;
reading block change information from the log file to identify blocks of data to be included in a block-level incremental backup;
responsive to a snapshot event, generating a new log file; and
subsequent to the snapshot event, writing to the new log file, in real time, block change information indicating one or more blocks from the particular directory or file of the particular volume that have changed as a result of an I/O request having been processed after the snapshot event.
1 Assignment
0 Petitions
Accused Products
Abstract
A method and apparatus for efficiently logging changes to a file system are disclosed. A file system filter driver intercepts I/O requests directed to a file system, and analyzes the I/O requests to determine whether the requests are write or modify requests directed to a file included in a list of files to be monitored for changes. If the I/O request is directed to such a file, the file system filter driver logs the I/O request to a b-tree structured change log file. Furthermore, in one embodiment, the file system filter driver is configured to log file system changes to multiple log files to coincide with snapshot operations, such that the file system changes to be included in each snapshot are included in separate log files.
94 Citations
17 Claims
-
1. A computer-implemented method, comprising:
-
identifying, in real time and at a block level, a change made to a user-selected set of directories or files of a volume of a file system as a result of an I/O request having been processed; writing to a log file, in real time, block change information indicating one or more blocks from a particular directory or file of a particular volume that have changed as a result of the I/O request having been processed, wherein the log file is structured to store the block change information non-sequentially and grouped by the particular directory or file to which the change relates; reading block change information from the log file to identify blocks of data to be included in a block-level incremental backup; responsive to a snapshot event, generating a new log file; and subsequent to the snapshot event, writing to the new log file, in real time, block change information indicating one or more blocks from the particular directory or file of the particular volume that have changed as a result of an I/O request having been processed after the snapshot event. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A computer system, comprising:
-
an I/O subsystem configured to service client-initiated I/O requests by writing data blocks to, and reading data blocks from, a disk-based file system; a file system filter driver configured to i) receive, in real time, data selection criteria specifying a user-selected set of directories or files of the disk-based file system to be monitored for changes, ii) identify when an I/O request has caused a change to one or more blocks included in a directory or file of the user-selected set of directories or files to be monitored, and iii) write block change information to a log file when an I/O request has caused a change to one or more blocks included in a directory or file of the user-selected set of directories or files to be monitored, wherein the log file is structured having the block change information grouped within the log file based on the directory or file to which the change relates; a backup agent to prepare an incremental backup by identifying only blocks that have changed since a previous backup operation by reading block change information from the log file; and a snapshot manager configured to generate, in response to a snapshot event, a new log file and subsequent to the snapshot event, to write to the new log file, in real time, block change information indicating one or more blocks from a particular directory or file of a particular volume that have changed as a result of an I/O request having been processed after the snapshot event. - View Dependent Claims (8, 9, 10, 11)
-
-
12. A computer-implemented method, comprising:
-
analyzing I/O requests directed to a file system to determine whether the I/O requests satisfy logging criteria; writing block change information indicating blocks of a directory or file that have changed as a result of processing an I/O request to a log file structured as a b-tree when the logging criteria are satisfied, wherein nodal elements of the b-tree correspond with files or directories for which one or more blocks have changed, and when written to the b-tree the block change information is associated with a nodal element of the b-tree; prior to writing the block change information to the log file structured as the b-tree, storing the block change information in a queue; and when the queue contains a predetermined number of block change information entries, writing all the block change information entries in the queue to the log file structured as the b-tree. - View Dependent Claims (13, 14, 15, 16, 17)
-
Specification