Non-Intrusive Application Event Logging via System Call Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for recording and replaying events in applications are resource-intensive, leading to performance slowdowns and are difficult to implement, especially in networked environments, and often require system modifications that can introduce errors and instabilities.
Innovation Solution
A method that records internal events in a software application by using a system call to log operations outside the executable file, minimizing intervention in the application's structure and programming, and utilizing a library function to record and replay events without modifying the operating system, thus reducing performance impact and simplifying implementation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current methods of recording events are used, then event logging and replay capability are achieved, but performance slowdown increases and worktime consumption increases
Solution Approach 1:
The patent introduces an intermediary logging mechanism that operates at the system call interface level, between the application and the operating system kernel. This intermediary captures events through system calls without requiring modification of the application code itself, thereby achieving reliable event logging while minimizing performance impact by leveraging existing system infrastructure.
Solution Approach 2:
The patent extracts the logging functionality from the application code and places it at the system call interface level. By taking out the logging responsibility from the application itself and implementing it at the OS interface, the system achieves event recording without burdening the application's execution path, thus reducing performance slowdown.
2Productivity
If intrusive methods are used to detect race conditions and limit recording, then performance fall-off is reduced, but implementation complexity increases and error risk increases
Solution Approach 1:
The patent makes the system call interface universal for event capture, allowing any system call to be logged without requiring application-specific intrusive detection mechanisms. This multi-functional approach enables performance maintenance across different applications without increasing implementation complexity, as the same interface-based mechanism works for all applications.
3Ease of operation
If system modifications are made to enable monitoring, then external monitoring capability is achieved, but system stability decreases and heterogeneity increases
Solution Approach 1:
The patent uses the system call interface as an intermediary layer that enables external monitoring without modifying the core system or application. This intermediary approach allows monitoring functionality to be added at the interface level, maintaining system stability while achieving the desired monitoring capability.
Solution Approach 2:
The patent performs preliminary action by establishing the logging mechanism at the system call interface level before the application executes. This preliminary setup enables event capture without requiring dynamic system modifications during runtime, thereby maintaining system stability and avoiding heterogeneity issues.
4Loss of information
If logging operations are performed during application execution, then event recording is achieved, but work load on operational node increases
Solution Approach 1:
The patent uses the system call interface as an efficient intermediary that enables event recording with minimal overhead. By capturing events at this interface level, the system achieves complete event recording while the workload on the operational node remains manageable due to the efficient nature of system call processing.
Data Source
AI summary
A method and computer system logs events occurring in an application in a single or multi-computer environment, functioning non-intrusively and transparently vis-á-vis this application. A first computer node receives a communication from a client; the first computer node executes a transactional application that provides services to the client. A process of the transactional application includes a call to a first function. In response to the call to the first function, a modified function is executed that calls both the first function and second recording function. The call to the recording function is detected at a secondary computer node, different from the first computer node. The recording function executes at the second node to store logged data at the second computer node, the logged data representing execution of the first process.