Abstract: A processor of a central authority separate from a client and a service provider may receive an access request from the client. The access request may identify at least one of a client user and a client process. The processor may evaluate the access request to determine that the at least one of the client user and the client process complies with an access policy for the service provider. In response to determining that the at least one of the client user and the client process complies with the access policy, the processor may generate a credential including a key. The processor may send the credential to the client. The processor may receive the credential from the service provider. The processor may validate the key included in the credential. In response to the validating, the processor may cause the service provider to provide the client with access to the service.

Abstract: A method and system provides access control encryption for a file system. A resource management module manages access to data on a storage container and hosts a virtual file system including files representing the data on the storage container. An access control and encryption module encrypts each of the files with a respective file encryption key. The access control module generates a plurality of application containers each associated with a respective user and that include respective lists of files that the respective user is authorized to access. The access control and encryption module generates decrypts the files and allows access to files based on the lists of files in the application containers.

Abstract: A method and system provides access control encryption for a file system. A resource management module manages access to data on a storage container and hosts a virtual file system including files representing the data on the storage container. An access control and encryption module encrypts each of the files with a respective file encryption key. The access control module generates a plurality of application containers each associated with a respective user and that include respective lists of files that the respective user is authorized to access. The access control and encryption module generates decrypts the files and allows access to files based on the lists of files in the application containers.

Abstract: A log message collection system selects a configured host and fetches a log message. The log message collection system examines the fetched message to identify one or more DLLs necessary to translating the log message and determines whether the necessary DLL(s) have been loaded into a cache. If so, the log message is translated. If the DLLs are not in the cache, the log message collection system fetches from the log message host only the DLLs necessary to translate that fetched message. After the message is translated, the log message collection system fetches the next log message, identifies the necessary DLLs for that log message, and fetches the DLLs necessary to translate that message.

Abstract: An appliance is co-located on a network with computing devices. Log messages generated by the computing devices are collected by the appliance, filtered based on the content and stored in transmission priority queues based on the content. The appliance packetizes the log messages based on the transmission priority queue and the available bandwidth and compresses the packet. The appliance encrypts the packet, digitally signs the encrypted packet and sends the packet to a first data center over a public network. The first data center stores the packet in reliable storage and performs processing on the data. A copy of the packet is sent to a second data center that stores the copy and performs processing on the copied data. The appliance deletes the packet from its buffer after it has received acknowledgement that the second data center has received the packet.

Abstract: Systems and methods for correlating log messages into actionable incidents. Some embodiments implement a method which includes comparing a plurality of disparate log messages to a plurality of incident descriptions. The disparate log messages can be parsed. When the messages correlate with an incident description an incident case can be created. Workflow steps can be associated with the incident case and output along with the incident case. Additional disparate log messages can be compared to the incident expressions and, when additional messages correlate with the correlated incident description, the incident case can be adjusted. In some embodiments, the adjustment can include adding workflow steps to the incident case. Results of various workflow steps can be monitored and adjustments can be made accordingly. In some embodiments, the results can include out-of-bounds activities.

Abstract: Methods and systems for normalizing log messages. Some methods include obtaining a freeform log message from one of many disparate programs. The methods can include determining which program originated the message and, based on that, determining a signature which matches the message. Using the signature, a parsing expression may be determined with which to extract information from a portion of the message. The time from obtaining the message to extracting the information can be about the same for all messages and can be about 1/40,000th of a second. In some embodiments, a generic signature of the message may be output. A version of the message may be reconstructed based on the generic signature and information. When more than one message signatures matches the reconstructed message, one of the matching signatures can be adjusted. The parsing expression can be the first of an ordered list of expressions which successfully evaluates the log message.

Abstract: A method for measuring and determining the duplex modes of a network interface. The method assumes the network interface to be operating in a half-duplex mode until the bandwidth utilization reaches a threshold. When the threshold is reached, the method checks the traffic collision in the interface. If there is no collision, then the duplex mode is determined to be full-duplex. If there is collision, then the duplex mode is determined to be half-duplex and an alarm is set off. In another embodiment, the interface type is determined through SNMP. If the interface is a WAN interface, then the interface is determined to be full-duplex.

Abstract: A method for measuring and determining the duplex modes of a network interface. The method assumes the network interface to be operating in a half-duplex mode until the bandwidth utilization reaches a threshold. When the threshold is reached, the method checks the traffic collision in the interface. If there is no collision, then the duplex mode is determined to be full-duplex. If there is collision, then the duplex mode is determined to be half-duplex and an alarm is set off. In another embodiment, the interface type is determined through SNMP. If the interface is a WAN interface, then the interface is determined to be full-duplex.

Abstract: A method for measuring and determining the duplex modes of a network interface. The method assumes the network interface to be operating in a half-duplex mode until the bandwidth utilization reaches a threshold. When the threshold is reached, the method checks the traffic collision in the interface. If there is no collision, then the duplex mode is determined to be full-duplex. If there is collision, then the duplex mode is determined to be half-duplex and an alarm is set off. In another embodiment, the interface type is determined through SNMP. If the interface is a WAN interface, then the interface is determined to be full-duplex.

Abstract: A Web Services availability cache is part of a computer system, such as an enterprise system of a business or organization. The availability cache is populated with information from Web Services communicatively connected to the computer system by a network connection. In one embodiment, the availability cache is populated based on each request handled by a server process associated with the availability cache. A server receives a request from a client having an application dependent upon information from the Web Service. The server sends the request to the Web Service and stores returned information in the availability cache. Also, the server sends the returned information to the client, which initiated to request. Once the cache is populated, the server handles subsequent requests for information from the client by using the Web Service if it is available or by using the availability cache if the Web Service is not available.

Abstract: A Web Services availability cache is part of a computer system, such as an enterprise system of a business or organization. The availability cache is populated with information from Web Services communicatively connected to the computer system by a network connection. In one embodiment, the availability cache is populated based on each request handled by a server process associated with the availability cache. A server receives a request from a client having an application dependent upon information from the Web Service. The server sends the request to the Web Service and stores returned information in the availability cache. Also, the server sends the returned information to the client, which initiated to request. Once the cache is populated, the server handles subsequent requests for information from the client by using the Web Service if it is available or by using the availability cache if the Web Service is not available.

Abstract: A method for measuring and determining the duplex modes of a network interface. The method assumes the network interface to be operating in a half-duplex mode until the bandwidth utilization reaches a threshold. When the threshold is reached, the method checks the traffic collision in the interface. If there is no collision, then the duplex mode is determined to be full-duplex. If there is collision, then the duplex mode is determined to be half-duplex and an alarm is set off. In another embodiment, the interface type is determined through SNMP. If the interface is a WAN interface, then the interface is determined to be full-duplex.

Abstract: An improved method and system for converting data structures. A definition (e.g., a management information base definition) may be read. The definition may include definition objects. A mapping of the definition objects to a second set of objects may be created. The second set of objects may be common object system (COS) objects. A structure of information to be acquired from one or more agents may be determined, in response to reading the definition. The structure of the information may be metadata. The one or more agents may be simple network management protocol agents, or other types of agents, as desired. Information may be acquired from the one or more agents, in response to determining the structure of the information. At least a subset of the second set of objects may be created, using the acquired information and the mapping. The second set of objects may be accessed.