Kernel-Free System Monitoring via Node Information Complementing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional system monitoring methods using monitor agents can lead to system instability and increased load due to the need to access kernel modules, necessitating a method for accurate system monitoring without agent access.
Innovation Solution
A system monitoring apparatus and method that generates complemented node information using a complementing model and estimates link probabilities between nodes without accessing kernel modules, utilizing a link estimating model trained with monitoring command data from both testing and operated systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a monitor agent is used to access kernel modules for system monitoring, then measurement precision is improved, but system stability deteriorates and processing load increases
Solution Approach 1:
The patent introduces a mediator component that translates high-level monitoring requests into kernel-level information retrieval operations. This mediator layer enables accurate system monitoring without requiring direct agent-kernel interactions, thereby maintaining monitoring precision while preserving system stability by eliminating the destabilizing direct access pathway.
Solution Approach 2:
The patent creates virtual copies of kernel data structures and system state information that can be analyzed without accessing the actual running kernel. By working with these copied representations, the system achieves monitoring accuracy equivalent to direct kernel access while avoiding the stability issues and overhead associated with actual kernel module interactions.
2Measurement precision
If a monitor agent is used to access kernel modules for system monitoring, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent extracts the essential monitoring functionality from complex kernel-level agents and implements it through simpler, higher-level mechanisms. By taking out only the necessary information retrieval operations and implementing them through standard system interfaces, the patent reduces device complexity while maintaining the precision needed for effective system monitoring.
Solution Approach 2:
The patent uses copied representations of kernel data structures instead of direct kernel module interactions. This copying approach simplifies the monitoring implementation by working with static data copies rather than complex dynamic kernel interfaces, thereby reducing device complexity while preserving measurement precision.
3Device complexity
If node information is collected using monitoring commands without agents, then device complexity is reduced, but measurement precision deteriorates
Solution Approach 1:
The patent performs preliminary actions by pre-processing and enriching the node information collected through simple monitoring commands. Before analysis, the system augments basic command output with additional contextual data and relationships, thereby compensating for the limited precision of command-based collection while maintaining the simplicity of the underlying approach.
Solution Approach 2:
The patent introduces a mediator processing layer that enhances the output of simple monitoring commands. This intermediary component enriches basic node information with additional attributes and relationships, effectively bridging the gap between the simplicity of command-based collection and the precision requirements of system monitoring without introducing complex agent infrastructure.
Data Source
AI summary
A system monitoring apparatus comprising: a complementing unit that generates complemented node information by complementing, based on a complementing model trained using information collected in a testing system using a monitoring command and an agent, first node information collected in an operated system using the monitoring command; andan estimating unit that estimates the probability of a link being present between nodes by inputting the complemented node information to a link estimating model trained using the information collected in the testing system using the monitoring command and the agent.