International Business Machines Corporation

Sean Christopher Foley

Ury Segal

Shidong Shan

Berthold Martin Lebert

Christopher J Berube

Sagi Shechter

Steven Buschman

Minhui Yang

Curtis E Hrischuk

Andrew Russell Low

Mike Stephen Fulton

Peter Duncan Shipton

Henry W Adams, Iii

Shuyan He

Centralized monitoring of plural file systems that operate within or in association with an enterprise computing environment is provided. Each of the plural file systems are provided with a security policy, wherein the security policy defines one or more file system access activities to be monitored at the file system. Each file system is instrumented with a software agent that intercepts the relevant file system access activity. A centralized collector component is operative to receive from each of the plural file systems audit trail data, wherein the audit trail data is data that has been generated locally as file system access activity is intercepted at the file system by the local software agent in accordance with the applicable security policy. The collector applies the security policy against the audit trail data received from at least one of the plural file systems and, in response thereto, takes a given action.

File system monitoring and auditing via monitor system having user-configured policies

A system of computers in network communication where: (i) an end user's computer accesses an instantiation of a virtual machine using remote console software; (ii) the access to the VM is performed through a proxy server; and (iii) by using the proxy server, when the VM instantiation is moved from one physical host computer to another physical host computer, there is no substantial interruption in the access of the VM by the end user through the remote console software.

Remote virtual machine console access with persistent and seamless client connections during virtual machine migration

Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for providing classification job estimation for a data security platform comprising one or more data sources, the method comprising: for each of the one or more data sources: counting the number of databases; counting the number of tables in each database; selecting a random database; selecting a random table within the random database; retrieving a database data sample from the random table; measuring one or more latencies associated with issuing and retrieving the database data sample; measuring a processing time required to evaluate the database data sample against one or more policy rules; compiling one or more mean times for the latencies and processing times; and calculating a data source scan time using the one or more mean times and the number of tables in each database; and calculating a total estimation time through summation of each of the one or more data source scan times compiled for each of the one or more data sources.

System and method for dynamically estimating data classification job progress and execution time

Data traffic is monitored on a network with data access elements thereof collected and compared to security rules. An audit data collection is sent to a repository responsive to data access elements matching a condition of the security rules, where security rules having the condition designate the audit data collection and repository. A tag to data traffic is applied responsive to the matching condition. Comparing of collected data access elements to the corresponding security rules having the matching condition is discontinued responsive to applying the tag. The tag indicates a repository and the data traffic includes a connection and session. An audit data collection is sent to the repository indicated by the tag for a data access responsive to the tag in the tagged data traffic. The method continues sending audit data for future data accesses in the tagged data traffic without comparing to the corresponding security rules again.

Directing audited data traffic to specific repositories

Data traffic is monitored on a network and data access elements thereof are collected. The collected data access elements are compared to security rules. A first audit data collection is sent to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules. The one of the security rules having the first condition designates the first audit data collection and the first repository. A second audit data collection is sent to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules. The one of the security rules having the second condition designates the second audit data collection and the second repository.

A method, system, and/or computer program product revises a policy that provides rules on how to alter statements to access or manipulate data in a database. A user interface (UI) has a field containing a sample database query statement. The sample database query statement is parsed into clauses, where each clause depicts a specific type of grammatical structure. A different hyperlink is associated with each of the clauses. In response to receiving a signal activating a particular hyperlink for a particular clause, change options, for the particular clause, are presented from a resource that presents change options for the specific type of grammatical structure. User-selected changes to the particular clause are incorporated into a new rule, which causes a clause of the particular type of grammatical structure in any database query statement to be changed. Each change becomes a new rule in a revised policy.

Revising policy statements using hyperlinks

An application that runs in a process virtual machine is monitored by injecting listening code into a target class of the application. The listening code collects and forwards data to a monitoring agent. The target class is configured for monitoring according to alternative embodiments. In response to the process virtual machine providing notification of an event, such a loading the target class, the listening code may be injected into the target class. In another embodiment, the process virtual machine is configured to load a first mirror class containing a mirror entry point to the application. A mirror target class is loaded in response to a request to load the target class. The mirror target class contains a mirror entry point to the target class and the listening code. In another embodiment, listening code may be added to the target class before running the application.

Monitoring an application in a process virtual machine

According to an aspect, a user interface is provided for assisting a user with identifying parameters for starting an application that utilizes real-time garbage collection (GC). The parameters include a fixed heap size and a GC central processing unit (CPU) utilization. Responsive to receiving a request from the user, the user is provided with options for profiling the application. The profiling includes executing the application. The options include targeting the GC CPU utilization to meet real-time requirements, targeting the heap size to meet the real-time requirements, and targeting a balance between the GC CPU utilization and the heap size to meet the real-time requirements. Responsive to detecting a selection of an option by the user, the application is profiled according to the option selected. The user is presented with results of the profiling via the user interface. The results include values for the parameters.

Tuning utilization and heap memory size for real-time garbage collection

An application that runs in a process virtual machine is monitored by injecting listening code into a target class of the application. The listening code collects and forwards data to a monitoring agent. The target class is configured for monitoring according to alternative embodiments. In response to the process virtual machine providing notification of an event, such a loading the target class, the listening code may be injected into the target class. In another embodiment, the process virtual machine is configured to load a first minor class containing a minor entry point to the application. A mirror target class is loaded in response to a request to load the target class. The minor target class contains a minor entry point to the target class and the listening code. In another embodiment, listening code may be added to the target class before running the application.

Data traffic is monitored on a network and data access elements thereof are collected. The collected data access elements are compared to security rules providing sets of predefined data access elements for identifying predefined data accesses. First audit data collections for data accesses are sent to a first repository. For a data access that matches one of the rules, a second audit data collection defined by the matching rule is sent to at least a second repository designated by the matching rule.

Growing community of inventors

Chelmsford, MA, United States of America

Sean Christopher Foley