Data collection and transmission

• US 9,646,088 B1
• Filed: 02/05/2015
• Issued: 05/09/2017
• Est. Priority Date: 06/30/2011
• Status: Active Grant

• Current Assignee: Sumo Logic, Inc.
• Original Assignee: Sumo Logic, Inc.
• Inventors: Beedgen, Christian Friedrich, Saurabh, Kumar, Kurtic, Bruno
• Primary Examiner(s): LE, THU NGUYET T
• Application Number:
  US14/615,390
• Time in Patent Office: 824 Days
• Field of Search: 707661, 707771
• CPC Class Codes: G06F 16/40 of multimedia data, e.g. slideshows comprising image and additional audio data retrieval of still image data G06F16/50; retrieval of audio data G06F16/60; retrieval of video data G06F16/70
• CPC Class Codes: G06F 16/95 Retrieval from the web
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Data collection and transmission is disclosed. A server is configured to receive, from a remote device, a message including raw information, and to parse at least a portion of the received raw information. The raw information is received by the system from an information reporting module interface of the remote device. The information reporting module of the remote device is configured to receive information from at least one separately installed information reporting module. A client device includes an information reporting module interface and a server interface. The client device is configured to receive configuration information from a remote server.

Claims

1. A system, comprising:

one or more processors configured to;

receive, from a collector installed on a remote device, one or more messages including raw information, wherein the raw information is provided to the collector by a set of blades associated with the collector, wherein each blade in the set of blades is configured to access a particular type of data, wherein the set of blades is installed separately from the collector, and wherein the set of blades associated with the collector is modifiable without modifying the collector;

wherein the collector is configured to package the raw information provided by the set of blades into the one or more messages;

wherein the collector is configured to receive information usable to modify the collector or the set of blades that is associated with the collector;

parse, at the system, at least a portion of the raw information included in the one or more messages received from the collector installed on the remote device; and

a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

2. The system of claim 1 wherein the one or more processors is further configured to store at least a portion of the raw information.

3. The system of claim 2 wherein the one or more processors is configured to store the raw information in a short term storage and in a long term storage.

4. The system of claim 2 wherein the one or more processors is further configured to transmit an acknowledgement of durable writing to the collector.

5. The system of claim 1 wherein the system is configured to store parsed information obtained as a result of the parsing of the received raw information separately from the received raw information.

6. The system of claim 5 wherein the stored parsed information is not used as a system of record and wherein stored raw information is used as a system of record.

7. The system of claim 1 wherein the one or more processors is further configured to receive heartbeat information from the remote device.

8. The system of claim 1 wherein the one or more processors is further configured to receive heartbeat information from the collector.

9. The system of claim 1 wherein the one or messages includes an identifier of a blade in the set of blades.

10. The system of claim 1 wherein the one or more processors is further configured to enrich a message in the received one or more messages at least in part by adding a time stamp, creating a digest, or adding meta data.

11. The system of claim 10 wherein the enriched message includes a plurality of timestamps.

12. The system of claim 1 wherein the one or more processors is further configured to push an update to the remote device.

13. The system of claim 1 wherein the one or more processors is further configured to push an update to a blade in the set of blades.

14. The system of claim 1 wherein which blades are installed on the remote device is configurable by the one or more processors.

15. The system of claim 1 wherein the system is configured to cause an additional blade to be installed by sending a communication to the collector installed on the remote device.

16. The system of claim 1 wherein the parsing of raw data is performed asynchronously with the collection of that data by the set of blades.

17. The system of claim 1 wherein a receiver of the received one or more messages is configured to provide the one or more messages to a plurality of queues.

18. The system of claim 1 wherein the one or more processors is further configured to receive, from at least one third party service supplier, information associated with the owner of the remote device.

19. The system of claim 18 wherein the one or more processors is further configured to evaluate information received from the supplier with information received from the owner to determine whether a threat is indicated.

20. The system of claim 1 wherein the one or more processors is further configured to receive, from at least one third party service supplier, information associated with an owner of an account.

21. The system of claim 1 wherein the collector is configurable via a third party website.

22. The system of claim 1 wherein the information usable to modify the collector or the set of blades that is associated with the collector is obtained via one or more user interfaces provided by the system.

23. A method, comprising:

receiving, at a server, one or more messages from a collector installed on a remote device including raw information, wherein the raw information is provided to the collector by a set of blades associated with the collector, wherein each blade in the set of blades is configured to access a particular type of data, wherein the set of blades is installed separately from the collector, and wherein the set of blades associated with the collector is modifiable without modifying the collector;

wherein the collector is configured to package the raw information provided by the set of blades into the one or more messages; and

wherein the collector is configured to receive information usable to modify the collector or the set of blades that is associated with the collector;

parsing, at the server and using a set of one or more processors, at least a portion of the raw information included in the one or more messages received from the collector installed on the remote device.

24. A system, comprising:

a collector installed on a device, wherein the collector is configured to receive raw information from a set of blades that is associated with the collector, wherein each blade in the set of blades is configured to access a particular type of data, wherein the set of blades is installed separately from the collector, and wherein the set of blades associated with the collector is modifiable without modifying the collector; and

wherein the collector is configured to, using one or more processors, package the raw information provided by the set of blades into one or more messages and provide the one or more messages including the raw information to a remote server;

wherein the remote server is configured to parse at least a portion of the raw information included in the one or more messages; and

wherein the collector is configured to receive information usable to modify the collector or the set of blades that is associated with the collector.