Alert Logic, Inc.

Bmc Software, Inc.

Eugene Golovinsky

Paul Fisher

Pavel S Trakhtman

Christopher A Church

Mikhail Govshteyn

Wesley J Noonan

Zsolt Lukacs

Vincent Joseph Kowalski

Anton Lavrik

A log message collection system selects a configured host and fetches a log message. The log message collection system examines the fetched message to identify one or more DLLs necessary to translating the log message and determines whether the necessary DLL(s) have been loaded into a cache. If so, the log message is translated. If the DLLs are not in the cache, the log message collection system fetches from the log message host only the DLLs necessary to translate that fetched message. After the message is translated, the log message collection system fetches the next log message, identifies the necessary DLLs for that log message, and fetches the DLLs necessary to translate that message.

Log message collection employing on-demand loading of message translation libraries

An appliance is co-located on a network with computing devices. Log messages generated by the computing devices are collected by the appliance, filtered based on the content and stored in transmission priority queues based on the content. The appliance packetizes the log messages based on the transmission priority queue and the available bandwidth and compresses the packet. The appliance encrypts the packet, digitally signs the encrypted packet and sends the packet to a first data center over a public network. The first data center stores the packet in reliable storage and performs processing on the data. A copy of the packet is sent to a second data center that stores the copy and performs processing on the copied data. The appliance deletes the packet from its buffer after it has received acknowledgement that the second data center has received the packet.

Log message archiving and processing using a remote internet infrastructure

Systems and methods for correlating log messages into actionable incidents. Some embodiments implement a method which includes comparing a plurality of disparate log messages to a plurality of incident descriptions. The disparate log messages can be parsed. When the messages correlate with an incident description an incident case can be created. Workflow steps can be associated with the incident case and output along with the incident case. Additional disparate log messages can be compared to the incident expressions and, when additional messages correlate with the correlated incident description, the incident case can be adjusted. In some embodiments, the adjustment can include adding workflow steps to the incident case. Results of various workflow steps can be monitored and adjustments can be made accordingly. In some embodiments, the results can include out-of-bounds activities.

Systems and methods for correlating log messages into actionable security incidents and managing human responses

Methods and systems for normalizing log messages. Some methods include obtaining a freeform log message from one of many disparate programs. The methods can include determining which program originated the message and, based on that, determining a signature which matches the message. Using the signature, a parsing expression may be determined with which to extract information from a portion of the message. The time from obtaining the message to extracting the information can be about the same for all messages and can be about 1/40,000of a second. In some embodiments, a generic signature of the message may be output. A version of the message may be reconstructed based on the generic signature and information. When more than one message signatures matches the reconstructed message, one of the matching signatures can be adjusted. The parsing expression can be the first of an ordered list of expressions which successfully evaluates the log message.

Systems and methods for automated log event normalization using three-staged regular expressions

A method for measuring and determining the duplex modes of a network interface. The method assumes the network interface to be operating in a half-duplex mode until the bandwidth utilization reaches a threshold. When the threshold is reached, the method checks the traffic collision in the interface. If there is no collision, then the duplex mode is determined to be full-duplex. If there is collision, then the duplex mode is determined to be half-duplex and an alarm is set off. In another embodiment, the interface type is determined through SNMP. If the interface is a WAN interface, then the interface is determined to be full-duplex.

Heuristic determination of network interface transmission mode

Method of heuristic determination of network interface transmission mode and apparatus implementing such method

A Web Services availability cache is part of a computer system, such as an enterprise system of a business or organization. The availability cache is populated with information from Web Services communicatively connected to the computer system by a network connection. In one embodiment, the availability cache is populated based on each request handled by a server process associated with the availability cache. A server receives a request from a client having an application dependent upon information from the Web Service. The server sends the request to the Web Service and stores returned information in the availability cache. Also, the server sends the returned information to the client, which initiated to request. Once the cache is populated, the server handles subsequent requests for information from the client by using the Web Service if it is available or by using the availability cache if the Web Service is not available.

Growing community of inventors

Houston, TX, United States of America

Eugene Golovinsky