Abstract: A cyber threat defense system and a method for detecting a cyber threat may use a predictor, e.g. a Transformer deep learning model, which is configured to predict a next item in the sequence of events and to detect one or more anomalies in the sequence of events. This provides a notification comprising (i) information about the one or more anomalies; and (ii) a prediction of what would have been expected.

Abstract: Disclosed herein are a method and apparatus for managing log information in a machine-to-machine (M2M) system, and a method for operating an M2M device in an M2M system may include receiving a first message for requesting to create a log management rule, creating storage for storing the log management rule and log information to be generated according to the log management rule, and setting a reference relationship between the log management rule and the storage.

Abstract: A memory system includes: a memory device; and a controller suitable for controlling the memory device and including a buffer memory, wherein the controller performs error history logging into the buffer memory in response to a logging start command from a host, stops the error history logging in response to a logging stop command from the host, and provides the host with the logged error history in response to an output command from the host.

Abstract: Techniques are described for end-to-end network tracing involving external services. In one example, a synthetic agent identifies one or more external services that are involved in a process for interacting with a target application server. In response to identifying the one or more external services, the synthetic agent obtains telemetry data associated with the one or more external services. The synthetic agent correlates the telemetry data associated with the one or more external services and telemetry data associated with the target application server to generate an end-to-end network trace associated with the target application server.

Abstract: A method by a network device to enrich database logs. The method includes detecting that a process executing on the network device has created a database connection to a database server, determining contextual information of the process in response to detecting that the process has created the database connection, generating a key associated with the database connection based on information that is known to be included in a database log of the database, and providing the key and the contextual information to a correlator component.

Abstract: The present invention extends to methods, systems, and computer program products for deriving unified insights ad logs from DevOps CI/CD tools and pipeline data. In general, a data transformer facilitates data normalization and serialization converting raw data across multiple DevOps tools and stores the data into a Data Lake in accordance with a customized schema. A continuous orchestrator sequences, aggregates and contextualizes the logs, providing an intuitive way of troubleshooting issues across a DevOps environment, historical data for compliance and audit purposes, and a build manifest for root cause analysis. The continuous orchestrator also processes the logs and leverages a KPI framework, providing intelligent dashboards across 90+ KPI's and a plurality of different dimensions (Planning, Development/pipelines, security, quality, operations, productivity and source code) to help customers make smart decisions and do more with less.

Abstract: In a method of operating a memory system, first security data and a first timestamp for preventing a replay attack are written by a host device to a first memory area which is an external memory area. A second timestamp is updated by the host device based on the first timestamp. The second timestamp corresponding to the first timestamp is stored in a second memory area distinguished from the first memory area. A first notification signal representing a result of updating the second timestamp is received by the host device. A writing operation for the first security data is completed when it is determined, by the host device, based on the first notification signal that the second timestamp is successfully updated.

Abstract: A virtual reality apparatus and method are described for tile-based rendering. For example, one embodiment of an apparatus comprises: a set of on-chip geometry buffers including a first buffer to store geometry data, and a set of pointer buffers to store pointers to the geometry data; a tile-based immediate mode rendering (TBIMR) module to perform tile-based immediate mode rendering using geometry data and pointers stored within the set of on-chip geometry buffers; spill circuitry to determine when the on-chip geometry buffers are over-subscribed and responsively spill additional geometry data and/or pointers to an off-chip memory; and a prefetcher to start prefetching the geometry data from the off-chip memory as space becomes available within the on-chip geometry buffers, the TBIMR module to perform tile-based immediate mode rendering using the geometry data prefetched from the off-chip memory.

Abstract: The present application provides a method, an apparatus and a system for memory dump processing. The method comprises: invoking a first set of processing units to process a first stage of memory dump processing for each of memory blocks; invoking each set of processing units other than the first set of processing units to process a subsequent processing stage after completing the first stage respectively, to write the memory blocks into a storage device. The technical solutions provided in the present application enable processing each stage for each of the memory blocks in a pipeline manner, avoid instantaneous peak flow of disk I/O transmission and improve memory dump performance.

Abstract: Generation of diagnostic information of a computer-implemented system is made early so that the data is closer to the causation of errors or for performance analysis. At least one selected activity of the system is monitored from initiation of the activity, and the monitoring is for successful completion. Early collection of diagnostic information is provided by comparing the time of the activity without successful completion to an initial trigger, where the initial trigger is less than the time period for a time-out for the activity. If the time of the activity without successful completion exceeds the initial trigger, diagnostic information is collected and an initial dump of the diagnostic information is taken. In one example, a notification that the dump of diagnostic information has been taken is directed to the host or diagnostic terminal.

Abstract: A method includes generating trace data at a device associated with data communication to and from a computer storage device through an appropriate communication link therefor and transmitting the trace data through the appropriate communication link. The trace data is configured to enable debugging of a set of instructions associated with the device. The method also includes capturing the trace data transmitted through the appropriate communication link through a protocol analyzer, a host system or the protocol analyzer coupled to the host system and analyzing the trace data therein to obtain information associated with the set of instructions associated with the device. The protocol analyzer, the host system or the protocol analyzer coupled to the host system is configured to be external to the device associated with the data communication to and from the computer storage device.

Abstract: A log collecting apparatus includes: a response data forwarding unit to respond to a trace log request; a determining unit determines whether the ratio of error logs versus unsent trace logs is equal to or greater than a predetermined threshold value; a differential trace log creator configured to create differential trace logs, wherein the duplicate error logs have been deleted from the unsent trace logs, when it is determined that the error log ratio is equal to or greater than the predetermined threshold value; and a response data configuration unit configured to set response data with the differential trace logs, and to set the response data with the unsent trace logs when the error log ratio is not equal to or greater than the predetermined threshold value.

Abstract: A memory cartridge is described that includes a non-volatile memory. The cartridge also includes logic to concentrate memory operations on particular areas of the non-volatile memory to cause the areas of concentration to wear out at an accelerated rate relative to non areas of concentration, and logic to track wear on the non-volatile memory resulting from one or both of erases and writes.

Abstract: The present invention generally relates to log message processing such that events can be detected and alarms can be generated. For example, log messages are generated by a variety of network platforms (e.g., Windows servers, Linux servers, UNIX servers, databases, workstations, etc.). Often, relatively large numbers of logs are generated from these platforms in different formats. A log manager described herein collects such log data using various protocols (e.g., Syslog, SNMP, SMTP, etc.) to determine events. That is, the log manager may communicate with the network platforms using appropriate protocols to collect log messages therefrom. The log manager may then determine events (e.g., unauthorized access, logins, etc.) from the log data and transfer the events to an event manager. The event manager may analyze the events and determine whether alarms should be generated therefrom.

Abstract: Various embodiments for intelligent dump suppression in a computing environment following an error are provided. A plurality of historical information is considered in view of a current alert level to generate an output decision. The current alert level is one of an available plurality of alert levels configurable by a user. The current alert level is selectable by the user for a predetermined data collection restrictiveness. Data capture is performed according to the output decision.

Abstract: A system and method are provided for determining problem conditions in an IT infrastructure using aggregate anomaly analysis. The anomalies in the metrics occurring in the monitored IT infrastructure are aggregated from all resources reporting metrics as a function of time. The aggregated metric anomalies are then normalized to account for the state of the monitored IT infrastructure to provide a normalized aggregate anomaly count. A threshold noise level is then determined utilizing a variably selectable desired level of confidence such that a problem event is only determined to likely be occurring in the IT infrastructure when the normalized aggregate anomaly count exceeds the threshold noise level. The normalized aggregate anomaly count is monitored against the threshold noise level as a function of time, such that a problem event in the IT infrastructure is identified when the normalized aggregate anomaly count exceeds the threshold noise level at a given time.

Abstract: An apparatus, system, and method are disclosed for multi-address space tracing. A trigger module establishes a trigger event with a trace level. The trigger event occurs in at least a first address space of a plurality of address spaces. The trace level defines trace data to be stored from the plurality of address spaces. A monitor monitors messages communicated within and between the plurality of address spaces. A detection module detects the trigger event. A log module logs the trace data from the plurality of address spaces defined by the trace level in response to detecting the trigger event.

Abstract: A processing apparatus that can accept logs from external processing apparatuses efficiently without degrading the performance of its own. The processing apparatus is connected with a plurality of external processing apparatuses for sending a first log including information on frequency of usage and a second log including information on an error, and collects the first and second logs from the external processing apparatuses. A receiving unit receives the first log sent from each of the external processing apparatuses. A calculation unit calculates a priority of each the external processing apparatuses based on the operating situation of each of the external processing apparatuses determined from the first log received by the receiving unit. A determination unit determines whether or not the second log sent by each of the external processing apparatuses should be stored based on the priority calculated by the calculation unit.

Abstract: Methods for collection of device reset history from a network communication device comprising: (a) determining whether a reset condition is triggered by software or hardware, (b) for a software triggered reset: (i) upon a software exception, retrieving related reset information, (ii) upon an operator initiation, retrieving related reset information, (iii) allocating space in non-volatile memory, (iv) storing retrieved current reset information together with a corresponding reset time, and (v) adding the current reset information to historical reset information, (c) proceeding with the reset, (d) executing startup code during reboot, (e) upon a hardware triggered reset; (i) retrieving hardware registry and other residual hardware information still present, (ii) allocating space in non-volatile memory, (iii) storing the current retrieved reset information together with a current time that corresponds approximately to the reset and (iv) adding the reset information to historical reset information, and (f) contin

Abstract: Provided are a large-scale cluster monitoring system and a method for automatically building/restoring the same, which can automatically build a large-scale monitoring system and can automatically build a monitoring environment when a failure occurs in nodes. The large-scale cluster monitoring system includes a CM server, a BD server, GM nodes, NA nodes, and a DB agent. The CM server manages nodes in a large-scale cluster system. The DB server stores monitoring information that is state information of nodes in groups. The GM nodes respectively collect the monitoring information that is the state information of the nodes in the corresponding groups to store the collected monitoring information in the DB server. The NA nodes access the CM server to obtain GM node information and respectively collect the state information of the nodes in the corresponding groups to transfer the collected state information to the corresponding GM nodes.

Abstract: A data processing apparatus having a memory for storing program code and a processor for processing the program code, the data processing apparatus comprising: a radio module to communicatively couple the data processing apparatus to a wireless network, the radio module generating a plurality of debug data in a plurality of signal classes; a set of debug data filtering rules specifying certain debug data within the plurality of signal classes to be collected from the radio module; and a debug application executed on the data processing apparatus, the debug application to apply the set of filtering rules, thereby causing only the specified set of debug data to be collected from the radio module.

Abstract: A storage medium reproducing apparatus includes a storage unit, a correction history storage unit, a correction history implementing unit, and a correcting unit. The storage unit includes a plurality of information storage units storing information depending on whether a charge quantity is greater than a predetermined charge quantity threshold value, and a correction code storage unit storing error correction codes for the information stored in the information storage units. The correction history storage unit stores a correction history containing identification information for the information storage unit corrected with an error correction code is performed, and a content of the correction. The correction history implementing unit corrects information in compliance with the content of the correction when the information is read from the information storage unit.

Abstract: Embodiments of the present invention allow the prevention and/or mitigation of damage caused by server failure by predicting future failures based on historic failures. Statistical data for server parameters may be collected for a period of time immediately preceding a historic server failure. The data may be clustered to identify cluster profiles indicating strong pre-fault clustering patterns. Real time statistics collected during normal operation of the server may be applied to the cluster profiles to determine whether real time statistics show pre-fault clustering. If such a pattern is detected, measures to prevent or mitigate server failure may be initiated.

Abstract: A process for monitoring memory growth of a software application includes measuring a baseline memory usage for processes operating on a computer system. A background memory logging script is then executed to log process memory usage. At some later time, a trending script is executed which outputs a list showing how memory usage has changed for each process operating on the system.