Data collection and transmission

• US 8,983,912 B1
• Filed: 06/30/2011
• Issued: 03/17/2015
• Est. Priority Date: 06/30/2011
• Status: Active Grant

• Current Assignee: Sumo Logic, Sumo Logic, Inc.
• Original Assignee: Sumo Logic, Inc.
• Inventors: Beedgen, Christian Friedrich, Saurabh, Kumar, Kurtic, Bruno
• Primary Examiner(s): LE, THU NGUYET T
• Application Number:
  US13/173,882
• Time in Patent Office: 1,356 Days
• Field of Search: 707/661, 707/771
• US Class Current: 707/661
• CPC Class Codes: G06F 16/40 of multimedia data, e.g. slideshows comprising image and additional audio data retrieval of still image data G06F16/50; retrieval of audio data G06F16/60; retrieval of video data G06F16/70
• CPC Class Codes: G06F 16/95 Retrieval from the web
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Data collection and transmission is disclosed. A server is configured to receive, from a remote device, a message including raw information, and to parse at least a portion of the received raw information. The raw information is received by the system from an information reporting module interface of the remote device. The information reporting module of the remote device is configured to receive information from at least one separately installed information reporting module. A client device includes an information reporting module interface and a server interface. The client device is configured to receive configuration information from a remote server.

Claims

1. A system, comprising:

a first interface configured to receive blade module configuration information for configuring at least one blade module, wherein the blade module configuration information is based at least in part on user input provided via a blade module configuration user interface, wherein the at least one blade module is instantiated in an installed collector, and wherein the instantiated at least one blade module is configured, according to the received blade module configuration information, to retrieve a particular type of raw information from a remote device and transmit the raw information to the installed collector;

a second interface configured to receive collector configuration information for configuring the installed collector, wherein the collector configuration information is based at least in part on user input provided via a collector configuration user interface, wherein the installed collector is configured, according to the received collector configuration information, to receive the raw information and to package the raw information received from the instantiated at least one blade module into a message, and wherein the installed collector is installed on one of a node to be monitored and a node that is in communication with a device to be monitored;

a third interface configured to receive, from the installed collector, over a network, the message including the packaged raw information; and

a set of one or more processors configured to parse at least a portion of the received packaged raw information, including by identifying at least one source that generated raw information included in the packaged raw information.

2. The system of claim 1 wherein the processor is further configured to store at least a portion of the raw information.

3. The system of claim 2 wherein the processor is configured to store the raw information in a short term storage and in a long term storage.

4. The system of claim 2 wherein the processor is further configured to transmit an acknowledgement of durable writing to the collector.

5. The system of claim 1 wherein the processor is configured to store parsed information obtained as a result of the parsing of the received raw information separately from the received raw information.

6. The system of claim 5 wherein the stored parsed information is not used as a system of record and wherein stored raw information is used as a system of record.

7. The system of claim 1 wherein the processor is further configured to receive heartbeat information from the remote device.

8. The system of claim 1 wherein the processor is further configured to receive heartbeat information from the blade module.

9. The system of claim 1 wherein the message includes an identifier of the blade module.

10. The system of claim 1 wherein the processor is further configured to enrich the received message at least in part by adding a time stamp, creating a digest, or adding meta data.

11. The system of claim 10 wherein the enriched message includes a plurality of timestamps.

12. The system of claim 1 wherein the processor is further configured to push an update to the remote device.

13. The system of claim 1 wherein the processor is further configured to push an update to the blade module.

14. The system of claim 1 wherein which blade modules are installed on the remote device is configurable by the processor.

15. The system of claim 1 wherein the processor is configured to cause an additional blade module to be installed by sending a communication to the remote device.

16. The system of claim 1 wherein the parsing of raw information is performed asynchronously with the collection of the raw information by the blade module.

17. The system of claim 1 further comprising a receiver that is configured to provide the message to a plurality of queues.

18. The system of claim 1 wherein the processor is further configured to receive, from at least one third party service supplier, information associated with the owner of the remote device.

19. The system of claim 18 wherein the processor is further configured to evaluate information received from the supplier with information received from the owner to determine whether a threat is indicated.

20. The system of claim 1 wherein the processor is further configured to receive, from at least one third party service supplier, information associated with an owner of an account.

21. The system of claim 1 wherein the collector is configurable via a third party website.

22. A method, comprising:

receiving, via a first interface, blade configuration information for configuring at least one blade module, wherein the blade module configuration information is based at least in part on user input provided via a blade module configuration user interface, wherein the at least one blade module is instantiated in an installed collector, and wherein the instantiated at least one blade module is configured, according to the received blade module configuration information, to retrieve a particular type of raw information from a remote device and transmit the raw information to the installed collector;

receiving, via a second interface, collector configuration information for configuring the installed collector, wherein the collector configuration information is based at least in part on user input provided via a collector configuration user interface, wherein the installed collector is configured, according to the received collector configuration information, to receive the raw information and to package the raw information received from the instantiated at least one blade module into a message, and wherein the installed collector is installed on one of a node to be monitored and a node that is in communication with a device to be monitored;

receiving, via a third interface and from the installed collector, over a network, a remote device, the message including the packaged raw information; and

parsing, by a set of one or more processors, at least a portion of the received packaged raw information, including by identifying at least one source that generated raw information included in the packaged raw information.

23. A system, comprising:

a collector installed on one of a node to be monitored and a node that is in communication with a device to be monitored, wherein the collector is associated with a first device that is configured to generate one or more messages at least in part by packaging raw information received from a first blade module instantiated in the collector and from a second blade module instantiated in the collector, wherein at least the first instantiated blade module is configured to acquire a first type of raw information from the first device, wherein the collector is configured separately from at least one of the first instantiated blade module and the second instantiated blade module, wherein the collector is configured according to collector configuration information that is based at least in part on user input provided via a collector configuration user interface, the first instantiated blade module is configured according to first blade module configuration information that is based at least in part on first user input provided via a first blade module configuration user interface, and wherein the second instantiated blade module is configured according to second blade module configuration information that is based at least in part on second user input provided via a second blade module configuration user interface;

one or more processors configured to;

send to the remote data collection and analysis platform, via a server interface and over a network, one or more messages that include raw information acquired from at least the first instantiated blade module; and

receive configuration information from the remote data collection and analysis platform; and

a memory coupled to the processor and configured to provide the processor with instructions.