Database for a capture system

• US 8,560,534 B2
• Filed: 01/27/2009
• Issued: 10/15/2013
• Est. Priority Date: 08/23/2004
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Lowe, Rick, Brocker, Stephen
• Primary Examiner(s): Vy, Hung T
• Application Number:
  US12/360,537
• Publication Number:
  US 20100191732A1
• Time in Patent Office: 1,722 Days
• Field of Search: 707/737, 707/706, 707/705, 707/758, 707/728, 707/768, 709/203, 709/330, 715/738
• US Class Current: 707/728
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

A tag database storing tags indexing captured object can be searched efficiently. In one embodiment, such a search begins by receiving a query for one or more objects captured by a capture system, and determining whether a query time range exceeds a time range of a set of fast tables. In one embodiment, the invention further includes searching the set of fast tables if the query time range does not exceed the time range of the fast tables, the set of fast tables containing tags having meta-data related to captured objects. In one embodiment, the invention further includes searching a set of hourly tables if the query time range does exceed the time range of the fast tables. In one embodiment, the present invention further includes searching a set of daily tables if the query time range also exceeds the time range of the hourly tables.

Claims

1. A computer implemented method comprising:

receiving a query for one or more objects captured by a capture system, wherein the capture system includes a tag database for storing tags that index captured objects in storage, the tag database comprising;

a first set of tables comprising a first input table for inserting tags within a first time range and a first search table for storing the tags, and

a second set of tables comprising a second input table for inserting tags within a second time range, and a second search table for storing the tags, wherein

the second time range is larger than the first time range;

determining whether a query time range exceeds the first time range;

searching the first set of tables if the query time range does not exceed the first time range;

if the query time range exceeds the first time range, determining whether the query time range exceeds the second time range; and

searching the second set of tables if the query time range exceeds the first time range but does not exceed the second time range.

2. The computer implemented method of claim 1, wherein the first time range is five minutes and the second time range is one hour.

3. The computer implemented method of claim 1, wherein the capture system further comprises a third set of tables for storing tags within a third time range, wherein the third time range is larger than the second time range, and the method further comprises:

if the query time range exceeds the second time range, determining whether the query time range exceeds the third time range; and

searching the third set of tables if the query time range exceeds the second time range but does not exceed the third time range.

4. The computer implemented method of claim 3, wherein the first set of tables have a finer granularity than the second set of tables, and the second set of tables have a finer granularity than the third set of tables.

5. The computer implemented method of claim 3, wherein the third time range is one day.

6. The computer implemented method of claim 3, wherein

each table in the first set of tables is smaller than each table in the second set of tables and

each table in the second set of tables is smaller than each table in the third set of tables.

7. The computer implemented method of claim 1, further comprising:

cascading down the first input table into a search table in the first set of tables at the end of the first time range; and

dropping the oldest search table of the first set of tables.

8. The computer implemented method of claim 1, further comprising:

cascading down the second input table into a search table in the second set of tables at the end of the second time range; and

dropping the oldest search table of the second set of tables.

9. The computer implemented method of claim 1, wherein tags are inserted simultaneously into the first input table and the second input table.

10. The computer implemented method of claim 1, wherein the first set of tables and the second set of tables comprise a fixed number of tables.

11. Logic encoded in non-transitory media that includes instructions for execution and when executed by a processor, is operable to perform operations comprising:

receiving a query for one or more objects captured by a capture system, wherein the capture system includes a tag database for storing tags that index captured objects in storage, the tag database comprising;

a first set of tables comprising a first input table for inserting tags within a first time range and a first search table for storing the tags, and

a second set of tables comprising a second input table for inserting tags within a second time range, and a second search table for storing the tags, wherein

the second time range is larger than the first time range;

determining whether a query time range exceeds the first time range;

searching the first set of tables if the query time range does not exceed the first time range;

if the query time range exceeds the first time range, determining whether the query time range exceeds the second time range; and

searching the second set of tables if the query time range exceeds the first time range but does not exceed the second time range.

12. The logic of claim 11, wherein the capture system further comprises a third set of tables for storing tags within a third time range, wherein the third time range is larger than the second time range, and the operations further comprise:

if the query time range exceeds the second time range, determining whether the query time range exceeds the third time range; and

searching the third set of tables if the query time range exceeds the second time range but does not exceed the third time range.

13. The logic of claim 12, wherein

each table in the first set of tables is smaller than each table in the second set of table, and

each table in the second set of tables is smaller than each table in the third set of tables.

14. The logic of claim 11, the operations further comprising:

cascading down the first input table into a search table in the first set of tables at the end of the first time range; and

dropping the oldest search table of the first set of tables.

15. The logic of claim 11, the operations further comprising:

cascading down the second input table into a search table in the second set of tables at the end of the second time range; and

dropping the oldest search table of the second set of tables.

16. An apparatus comprising:

a memory for storing data; and

a processor operable to execute instructions associated with the data, wherein the processor and the memory cooperate, such that the apparatus is configured for;

receiving a query for one or more objects captured by a capture system, wherein the capture system includes a tag database for storing tags that index captured objects in storage, the tag database comprising;

a first set of tables comprising a first input table for inserting tags within a first time range and a first search table for storing the tags, and

a second set of tables comprising a second input table for inserting tags within a second time range, and a second search table for storing the tags, wherein

the second time range is larger than the first time range;

determining whether a query time range exceeds the first time range;

searching the first set of tables if the query time range does not exceed the first time range;

if the query time range exceeds the first time range, determining whether the query time range exceeds the second time range; and

searching the second set of tables if the query time range exceeds the first time range but does not exceed the second time range.

17. The apparatus of claim 16, wherein the capture system further comprises a third set of tables for storing tags within a third time range, wherein the third time range is larger than the second time range, and the apparatus is further configured for:

if the query time range exceeds the second time range, determining whether the query time range exceeds the third time range; and

searching the third set of tables if the query time range exceeds the second time range but does not exceed the third time range.

18. The apparatus of claim 17, wherein

each table in the first set of tables is smaller than each table in the second set of table, and

each table in the second set of tables is smaller than each table in the third set of tables.

19. The apparatus of claim 16, wherein the apparatus is further configured for:

cascading down the first input table into a search table in the first set of tables at the end of the first time range; and

dropping the oldest search table of the first set of tables.

20. The apparatus of claim 16, wherein the apparatus is further configured for:

cascading down the second input table into a search table in the second set of tables at the end of the second time range; and

dropping the oldest search table of the second set of tables.