Method and apparatus for creating and using a policy-based access/change log

• US 7,636,736 B1
• Filed: 09/21/2005
• Issued: 12/22/2009
• Est. Priority Date: 09/21/2005
• Status: Expired due to Fees

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Operating Corporation (NortonLifeLock Inc.)
• Inventors: Kumar, Nookala Sunder Phani, Nagaralu, Sree Hari, Nagaraj, Murali, Borate, Milind
• Primary Examiner(s): Woo; Isaac M
• Application Number:
  US11/232,253
• Time in Patent Office: 1,553 Days
• Field of Search: 707 1- 10, 707100-1041, 707200-206
• US Class Current: 1/1
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 707/99944 Object-oriented database structure
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

A method and apparatus for creating and using a policy-based file access/change log. Using the policy-based techniques, specific objects within the file system are selected for logging within an access/change log. These selected objects are then processed to identify attributes of the selected objects that are to be logged such that a policy is created regarding the objects to be logged and the attributes of those objects. Lastly, the policy is applied to the object either by having a separate object (file) created that is related to the object to be logged that identifies the policy for logging, or by attaching certain attributes directly to the object such that access to the object identifies the logging policy for that object. When an object that uses policy-based logging is changed, the object access/change log policy is utilized to log only the information that is identified in the policy. In this manner, the amount of information that is logged is controlled by the logging policy, limiting the size of the access/change log.

Claims

1. A method for creating a logging policy for an access/change log, comprising:

selecting at least one object of a file system executing on a computer system to be logged;

identifying at least one attribute of the selected at least one object to be logged; and

generating a logging policy based upon the selected at least one object and the at least one attribute wherein the at least one attribute comprises at least one of user name/identifier, group name/identifier, application name/identifier, computer identity information, file access time, file modification time, file creation time, file allocation/reallocation/reservation policies, file name/path/inode number, size of the file, number of links to a file, offset/length of access/modification, access control lists, filed named data streams.

2. The method of claim 1 further comprising:

associating the logging policy with the at least one object.

3. The method of claim 2 further comprising storing the logging policy in a file.

4. The method of claim 2 further comprising storing the logging policy in metadata related to the at least one object.

5. The method of claim 1 further comprising:

detecting at least one of a change or access associated with the at least one object;

accessing the logging policy; and

updating a access/change log in accordance with the logging policy.

6. The method of claim 1 wherein the selected at least one object forms a subset of less than all objects that are available for logging.

7. A method of using a policy-based access/change log comprising;

detecting at least one of a change or access associated with at least one object of a file system executing on a computer system;

accessing a logging policy associated with the at least one object; and

updating a access/change log in accordance with the logging policy, wherein the logging policy was generated based upon at least one attribute of the at least one object wherein the at least one attribute comprises at least one of user name/identifier, group name/identifier, application name/identifier, computer identity information, file access time, file modification time, file creation time, file allocation/reallocation/reservation policies, file name/path/inode number, size of the file, number of links to a file, offset/length of access/modification, access control lists, filed named data streams.

8. The method of claim 7 wherein the updating step further comprises:

logging at least one attribute of the at least one object in accordance with the logging policy.

9. A computer readable medium comprising software that, when executed by a processor within a computer system, causes the computer system to perform a method for creating a logging policy for an access/change log, comprising:

selecting at least one object of a file system executing on a computer system to be logged;

identifying at least one attribute of the selected at least one object to be logged; and

generating a logging policy based upon the selected at least one object and the at least one attribute wherein the at least one attribute comprises at least one of user name/identifier, group name/identifier, application name/identifier, computer identity information, file access time, file modification time, file creation time, file allocation/reallocation/reservation policies, file name/path/inode number, size of the file, number of links to a file, offset/length of access/modification, access control lists, filed named data streams.

10. The method of claim 9 further comprising:

associating the logging policy with the at least one object.

11. The method of claim 10 further comprising storing the logging policy in a file.

12. The method of claim 10 further comprising storing the logging policy in metadata related to the at least one object.

13. The method of claim 9 further comprising:

detecting at least one of a change or access associated with the at least one object;

accessing the logging policy; and

updating a access/change log in accordance with the logging policy.

14. A computer readable medium comprising software that, when executed by a processor within a computer system, causes the computer system to perform a method of using a policy-based access/change log comprising;

detecting at least one of a change or access associated with at least one object of a file system executing on a computer system;

accessing a logging policy associated with the at least one object; and

updating a access/change log in accordance with the logging policy, wherein the logging policy was generated based upon at least one attribute of the at least one object wherein the at least one attribute comprises at least one of user name/identifier, group name/identifier, application name/identifier, computer identity information, file access time, file modification time, file creation time, file allocation/reallocation/reservation policies, file name/path/inode number, size of the file, number of links to a file, offset/length of access/modification, access control lists, filed named data streams.

15. The method of claim 14 wherein the updating step further comprises:

logging at least one attribute of the at least one object in accordance with the logging policy.