Monitoring computer process resource usage

• US 9,098,333 B1
• Filed: 05/06/2011
• Issued: 08/04/2015
• Est. Priority Date: 05/07/2010
• Status: Active Grant

• Current Assignee: Fidelis LLC
• Original Assignee: Ziften Technologies Incorporated
• Inventors: Hartmann, Alfred C., Obrecht, Mark E., Myers, Robert P., Alagna, Nick F., Pyle, Kevin N., Sullivan, Scott D., Little, Michael W.
• Primary Examiner(s): Tang, Kenneth
• Application Number:
  US13/102,924
• Time in Patent Office: 1,551 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3442 for planning or managing the needed capacity
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 47/783 Distributed allocation of resources, e.g. bandwidth brokers
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

Techniques are disclosed relating to improving resource usage on a computer system. In one embodiment, a computer system identifies a plurality of processes running on the computer system and determines an importance value and a resource consumption value. In such an embodiment, the importance value is indicative of an importance of an identified process, and the resource consumption value is indicative of a resource consumption of the identified process. The computer system evaluates the importance value and the resource consumption value relative to a usage policy, and takes a corrective action with respect to the identified process based on the evaluating to reconcile resource consumption with process importance value.

Claims

1. A non-transitory computer-readable medium having program instructions stored thereon, wherein the program instructions are executable to cause a computer system of an entity to perform:

accessing a process usage policy of the entity, wherein the process usage policy includes a set of information for determining an importance of a process to the entity, wherein the set of information includes a rule that indicates an importance of a process based on whether a process is associated with a digital signature;

identifying a plurality of processes running on the computer system;

determining an importance value and a resource consumption value for a particular one of the plurality of processes, wherein the importance value is indicative of an importance of the particular process and is determined using the process usage policy, wherein the resource consumption value is indicative of a resource consumption of the particular process, and wherein the importance value is determined without taking into account the resource consumption of the particular process;

evaluating the particular process using the importance value and the resource consumption value of the particular process; and

taking a corrective action with respect to the particular process after the evaluating.

2. The non-transitory computer-readable medium of claim 1, wherein the evaluating includes generating information regarding the particular process, and wherein the taking the correction action includes generating a report that includes the generated information regarding the particular process.

3. The non-transitory computer-readable medium of claim 2, wherein the program instructions are further executable to cause the computer system to perform:

determining an importance value for a different one of the plurality of processes, and wherein the evaluating includes determining that the process usage policy indicates that the different process is extraneous to the entity regardless of its resource consumption.

4. The non-transitory computer-readable medium of claim 1, wherein determining the importance value includes:

classifying a user associated with the computer system into one of a plurality of user types according to a user'"'"'s role within the entity;

wherein the importance value is based on the user type into which the user is classified.

5. The non-transitory computer-readable medium of claim 1, wherein determining the importance value includes:

obtaining provenance information relating to installation of the particular process;

wherein the importance value is determined based on the obtained provenance information.

6. The non-transitory computer-readable medium of claim 1, wherein the corrective action includes temporarily suspending execution of the particular process, reducing resource consumption of the particular process, or allocating additional resources to the particular process.

7. The non-transitory computer-readable medium of claim 1, wherein the program instructions are further executable to cause the computer system to perform:

analyzing processes running on the computer system during a network session with another computer system; and

terminating, suspending, or restricting any processes that cannot be determined to be relevant to the network session.

8. A method, comprising:

a computer system of an entity identifying a plurality of processes running on the computer system;

the computer system determining an importance of a particular one of the plurality of processes to the entity and further determining a resource consumption of the particular process, wherein the importance is determined using a usage policy for processes executing on computer systems of the entity, wherein the usage policy includes a rule that indicates the importance of the particular process based on whether the particular process is associated with a foreground window, and wherein the importance of the particular process is determined without considering its resource consumption;

the computer system calculating a process score for the particular process based on the determined importance and the determined resource consumption; and

the computer system taking a corrective action with respect to the particular process, wherein the corrective action includes use of the calculated process score.

9. The method of claim 8, wherein determining the importance of the particular process is based on whether the computer system loads the identified process during a startup sequence of the computer system.

10. The method of claim 8, wherein determining the resource consumption of the particular process is based on a potential future resource consumption of the particular process.

11. The method of claim 8, wherein determining the importance of the particular process is based on classifying the particular process into one of a plurality of application genres.

12. The method of claim 8, wherein the particular process is associated with one of a plurality of browser sessions of a web browser application, and wherein the importance of the particular process is determined based on the importance to the entity of the associated browser session.

13. The method of claim 8, further comprising:

the computer system establishing a network session with another computer system;

the computer system analyzing processes running on the computer system during the network session; and

the computer system accelerating processes that are determined to be relevant to the network session.

14. The method of claim 8, wherein determining the importance of the particular process includes determining whether the particular process is relevant to a current activity of a user of the computer system.

15. The method of claim 8, wherein taking the corrective action includes generating a report that includes information regarding the particular process, including the process score for the particular process.

16. A non-transitory computer-readable medium having program instructions stored thereon, wherein the program instructions are executable to cause a server computer system to perform:

receiving process information from a plurality of client computer systems of an entity, wherein the process information identifies a plurality of processes executing on ones of the plurality of client computer systems, wherein the received process information includes one or more scores for various ones of the plurality of processes, wherein at least one of the one or more scores for a particular process is based on an importance value and a resource consumption value determined by an agent program running on one of the plurality of client computer systems of the entity, wherein the importance value of a process is calculated by the agent program based on a usage policy and without regard to the resource consumption of that process, wherein the usage policy includes a rule that identifies an importance of a process based on whether the process has one or more files protected by an operating system; and

taking a corrective action that uses received process information for various ones of the plurality of client computer systems, including scores for various ones of the plurality of processes.

17. The non-transitory computer-readable medium of claim 16, wherein the corrective action includes instructing two or more of the plurality of client computer systems to take the same action with respect to corresponding processes operating on those client computer systems.

18. The non-transitory computer-readable medium of claim 16, wherein the program instructions are further executable to cause the server computer system to perform:

providing an updated usage policy of the entity to ones of the plurality of client computer systems, wherein the updated usage policy is usable by the agent programs on ones of the plurality of client computer systems to evaluate processes running on those systems.

19. The non-transitory computer-readable medium of claim 18, wherein the updated usage policy is provided to successively larger portions of the plurality of client computer systems, wherein the program instructions are executable by the server system to perform:

monitoring effects of providing the updated usage policy to successively larger portions of the plurality of client computer systems; and

stopping the providing of the updated usage policy to successively larger portions of the plurality of client computer systems based on detected negative consequences associated with updates that have already been provided.

20. The non-transitory computer-readable medium of claim 16, wherein the taking the corrective action includes generating a report from the received process information, wherein the report includes information based on process scores for various ones of the plurality of processes.