Splunk Inc.

Symantec Corporation

Symantec Operating Corporation

Amazon Technologies, Inc.

Veritas Technologies LLC

Bhavin Thaker

Anish Shrigondekar

Ruochen Zhang

Zhenghui Xie

Shalabh Goyal

Cuong Huu Tran

Veeral P Shah

Carlos Wong

Yuh-Yen Yen

Amol Shivram Katkar

Alexander Johannes Smola

Madan Mohan Rao Jampani

Naveen Mysore Nagendra Swamy

Om Prakash Agarwal

Partha Seetala

As an indexer indexes and groups events, it can generate data slices that include events. Based on a slice rollover policy, the indexer can add a particular slice to an aggregate slice. Based on an aggregate slice backup policy, the indexer can store a copy of the aggregate slice to a shared storage system. The aggregate slice can be used for restore purposes in the event the indexer fails or becomes unresponsive.

Indexing data at a data intake and query system based on a node capacity threshold

An actionable event collector in a server cluster receives information specifying an actionable event instance regarding an actionable event occurrence in the server cluster. The actionable event collector transmits a representation of the actionable event instance to an actionable event queue builder. The actionable event queue builder inserts the representation as an entry into an actionable event queue. The event action dispatcher processes the entry from the actionable event queue, wherein processing the entry comprises determining a responsive action for the entry and causing performance of the responsive action.

Actionable event responder architecture

A data intake and query system can ingest and index large amounts of data using one or more ingestors and indexers. The ingestors can ingest incoming data and use it to generate events. The ingestor can group the events and prepare them for communication to a message bus. The ingestor can determine a size of the group of events. If the size of the group of events satisfies a message size threshold, the ingestor can store the group of events to a data store, obtain a reference to the group of events, and communicate the reference to the group of events to a message queue. An indexer can obtained the reference from the message queue and use the reference to obtain the group of events from the data store.

Using a data store and message queue to ingest data for a data intake and query system

An actionable event responder performs actions including a server cluster determining an actionable event occurrence from a member of a server cluster, determining an event-type code matching the actionable event occurrence, retrieving an event-type response map entry matching the event-type code, and determining, in response to determining that the event-type response map entry matches the event-type code, a response action signifier in the event-type response map entry. The response action signifier indicates a response action performable by the server cluster. The server cluster further detects whether a preauthorization value is set in a dispatch field of the event-type response map entry, and generates an invocation message to a resolution handler based on the preauthorization value being set in the dispatch field of the event-type response map entry. The resolution handler performs the response action to the actionable event occurrence.

Actionable event responder

An operational event processor receives information describing operational events arising in relation to a server cluster of a data intake and query system. Responsive actions are identified for the events that are actionable, and those responsive actions are automatically dispatched. Dispatching may include automatically causing the performance of the actions based on remembered preauthorizations, or automatically causing the performance of the actions based on obtaining real time user authorizations. The operational event processor may employ mechanisms to provide extensibility and a high degree of interoperability with other system components.

Automatic actionable event responder for operational clusters

A cluster formation engine invokes generation of an automatically scalable group (ASG) of virtual machine instances, where the ASG is associated with one or more applications to be run in a cloud computing environment. The cluster formation engine detects a failure to generate a first virtual machine instance to be included in the ASG, and completes the generation of the ASG without including the first virtual machine instance in the ASG.

Virtual machine cluster formation using available instances

The failure of a specific link of a specific node of a cluster is detected, for example through the operating system of the specific node. A notification of the failure of the specific link is disseminated to the nodes of the cluster, such that the nodes receive the notification prior to learning of the link-down event from the expiration of corresponding heartbeats, and process the event in parallel. The notification of the link failure can be disseminated by broadcasting a message notifying the nodes of the failure of the specific link. The notification of the link failure can also be disseminated by transmitting the notification to a centralized computing device which is polled by the nodes of the cluster at a specific frequency for notifications of link failures.

Cluster wide consistent detection of interconnect failures

Method or apparatus for passive process monitoring is described. One aspect of the invention relates to monitoring a process executing on a computer system. An operating system is instructed to report at least one event related to process termination. Termination of the process is detected in response to a reported instance of the at least one event by the operating system. A notification is provided to an agent in the computer system that the process has terminated.

Method and apparatus for passive process monitoring

Method and apparatus for preventing concurrency violations among resources in a clustered computer system is described. In one example, a system call is intercepted at a node in the clustered computer system. The system call identifies a target resource. An assigned state of the target resource with respect to the node is determined. The system call is handled at the node based on the assigned state. For example, the system call may be intended to bring the target resource online. The system call is handled by failing the system call at the node if the assigned state indicates that the target resource should be offline at the node. The target resource is allowed to be brought online if the assigned state indicates that the target resource can be online.

Method and apparatus for preventing concurrency violation among resources

Various methods and systems for ending a communication protocol connection in response to detecting the failure of a cluster node are disclosed. One method involves detecting a failed node within a cluster. The failed node communicates with a client via a communication protocol connection. In response to detecting the failed node, a communication protocol message is sent to the client. Receipt of the communication protocol message causes the client to terminate the communication protocol connection.

System and method for rapidly ending communication protocol connections in response to node failure

Various methods and systems for maintaining a communication protocol connection during a failover are disclosed. One method involves obtaining a first value of a parameter associated with a communication protocol connection between a primary node and a client and sending a flow control message to the client, in response to detecting that the primary node is failed. The flow control message includes the parameter.

System and method for maintaining communication protocol connections during failover

A system for connection failover using redirection includes a primary server comprising a primary connection failover driver (CFD), a shadow server comprising a shadow CFD, and a client. The primary and shadow servers and the client are coupled via a network. The primary server and the client are configured to cooperate to establish a network connection. The primary CFD is configured to redirect a first message packet, targeted for transmission to the client over the network connection, to the shadow server. The shadow CFD is configured to copy contents of the first message packet into a log, and forward the first message packet to the client after the contents have been copied.

Growing community of inventors

Sunnyvale, CA, United States of America

Bhavin Thaker