Abstract: A behavior detection system has access to a collection of behavior definitions that each describe a functional behavior of a system. Each behavior definition includes multiple basic operations, each of which includes an identifier and one or more parameters. The behavior definition also includes, explicitly or inherently, a basic operation combination definition that describes a sequence or other manner in which the basic operations are combined. The behavior detection system analyzes events in an event log for the system and determines whether the events in the event log satisfy any of the behavior definitions. An appropriate responsive action is taken in response to detecting that the events in the event log satisfy a behavior definition. The collection of behavior definitions is scalable, allowing behavior definitions to be added or deleted, and allowing basic operations in a behavior definition to be changed (e.g., adding, removing, and/or modifying basic operation parameters).

Abstract: A behavior detection system has access to a collection of behavior definitions that each describe a functional behavior of a system. Each behavior definition includes multiple basic operations, each of which includes an identifier and one or more parameters. The behavior definition also includes, explicitly or inherently, a basic operation combination definition that describes a sequence or other manner in which the basic operations are combined. The behavior detection system analyzes events in an event log for the system and determines whether the events in the event log satisfy any of the behavior definitions. An appropriate responsive action is taken in response to detecting that the events in the event log satisfy a behavior definition. The collection of behavior definitions is scalable, allowing behavior definitions to be added or deleted, and allowing basic operations in a behavior definition to be changed (e.g., adding, removing, and/or modifying basic operation parameters).

Abstract: A behavior detection system has access to a collection of behavior definitions that each describe a functional behavior of a system. Each behavior definition includes multiple basic operations, each of which includes an identifier and one or more parameters. The behavior definition also includes, explicitly or inherently, a basic operation combination definition that describes a sequence or other manner in which the basic operations are combined. The behavior detection system analyzes events in an event log for the system and determines whether the events in the event log satisfy any of the behavior definitions. An appropriate responsive action is taken in response to detecting that the events in the event log satisfy a behavior definition. The collection of behavior definitions is scalable, allowing behavior definitions to be added or deleted, and allowing basic operations in a behavior definition to be changed (e.g., adding, removing, and/or modifying basic operation parameters).

Abstract: A collaborative diagnostic system monitors events in a system and identifies a causality chain from a detected performance issue to the root cause of that performance issue. The collaborative diagnostic system includes multiple issue detectors, multiple analysis core modules, and multiple scenario modules that work together to identify the causality chain and root cause. Each issue detector is a module or component that includes logic to detect known behaviors in the system, such as performance issues in the system. Each analysis core module includes logic to analyze and correlate low level system behavior within a conceptual area. Within each analysis core module are one or more diagnostic modules that are specific to that analysis core module to help determine what is happening in the system. Each scenario module includes logic to take an appropriate responsive action in response to the root cause of a performance issue being determined.

Abstract: A collaborative diagnostic system monitors events in a system and identifies a causality chain from a detected performance issue to the root cause of that performance issue. The collaborative diagnostic system includes multiple issue detectors, multiple analysis core modules, and multiple scenario modules that work together to identify the causality chain and root cause. Each issue detector is a module or component that includes logic to detect known behaviors in the system, such as performance issues in the system. Each analysis core module includes logic to analyze and correlate low level system behavior within a conceptual area. Within each analysis core module are one or more diagnostic modules that are specific to that analysis core module to help determine what is happening in the system. Each scenario module includes logic to take an appropriate responsive action in response to the root cause of a performance issue being determined.

Abstract: A behavior detection system has access to a collection of behavior definitions that each describe a functional behavior of a system. Each behavior definition includes multiple basic operations, each of which includes an identifier and one or more parameters. The behavior definition also includes, explicitly or inherently, a basic operation combination definition that describes a sequence or other manner in which the basic operations are combined. The behavior detection system analyzes events in an event log for the system and determines whether the events in the event log satisfy any of the behavior definitions. An appropriate responsive action is taken in response to detecting that the events in the event log satisfy a behavior definition. The collection of behavior definitions is scalable, allowing behavior definitions to be added or deleted, and allowing basic operations in a behavior definition to be changed (e.g., adding, removing, and/or modifying basic operation parameters).

Abstract: The invention is directed towards a system and method that utilizes external memory devices to cache sectors from a rotating storage device (e.g., a hard drive) to improve system performance. When an external memory device (EMD) is plugged into the computing device or onto a network in which the computing device is connected, the system recognizes the EMD and populates the EMD with disk sectors. The system routes I/O read requests directed to the disk sector to the EMD cache instead of the actual disk sector. The use of EMDs increases performance and productivity on the computing device systems for a fraction of the cost of adding memory to the computing device.

Abstract: The invention is directed towards a system and method that utilizes external memory devices to cache sectors from a rotating storage device (e.g., a hard drive to improve system performance. When an external memory device (EMD) is plugged into the computing device or onto a network in which the computing device is connected, the system recognizes the EMD and populates the EMD with disk sectors. The system routes I/O read requests directed to the disk sector to the EMD cache instead of the actual disk sector. The use of EMDs increases performance and productivity on the computing device systems for a fraction of the cost of adding memory to the computing device.

Abstract: The invention is directed towards a system and method that utilizes external memory devices to cache sectors from a rotating storage device (e.g., a hard drive) to improve system performance. When an external memory device (EMD) is plugged into the computing device or onto a network in which the computing device is connected, the system recognizes the EMD and populates the EMD with disk sectors. The system routes I/O read requests directed to the disk sector to the EMD cache instead of the actual disk sector. The use of EMDs increases performance and productivity on the computing device systems for a fraction of the cost of adding memory to the computing device.

Abstract: To ensure that the contents of a non-volatile memory device cache may be relied upon as accurately reflecting data stored on disk storage, it may be determined whether the cache contents and/or disk contents are modified during a power transition, causing cache contents to no longer accurately reflect data stored in disk storage. The cache device may be removable from the computer, and unexpected removal of the cache device may cause cache contents to no longer accurately reflect data stored in disk storage. Cache metadata may be managed during normal operations and across power transitions, ensuring that cache metadata may be efficiently accessed and reliably saved and restored across power transitions. A state of a log used by a file system may be determined prior to and subsequent to reboot of an operating system in order to determine whether data stored on a cache device may be reliably used.

Abstract: To ensure that the contents of a non-volatile memory device cache may be relied upon as accurately reflecting data stored on disk storage, it may be determined whether the cache contents and/or disk contents are modified during a power transition, causing cache contents to no longer accurately reflect data stored in disk storage. The cache device may be removable from the computer, and unexpected removal of the cache device may cause cache contents to no longer accurately reflect data stored in disk storage. Cache metadata may be managed during normal operations and across power transitions, ensuring that cache metadata may be efficiently accessed and reliably saved and restored across power transitions. A state of a log used by a file system may be determined prior to and subsequent to reboot of an operating system in order to determine whether data stored on a cache device may be reliably used.

Abstract: The invention is directed towards a system and method that utilizes external memory devices to cache sectors from a rotating storage device (e.g., a hard drive) to improve system performance. When an external memory device (EMD) is plugged into the computing device or onto a network in which the computing device is connected, the system recognizes the EMD and populates the EMD with disk sectors. The system routes I/O read requests directed to the disk sector to the EMD cache instead of the actual disk sector. The use of EMDs increases performance and productivity on the computing device systems for a fraction of the cost of adding memory to the computing device.

Abstract: The invention is directed towards a system and method that utilizes external memory devices to cache sectors from a rotating storage device (e.g., a hard drive) to improve system performance. When an external memory device (EMD) is plugged into the computing device or onto a network in which the computing device is connected, the system recognizes the EMD and populates the EMD with disk sectors. The system routes I/O read requests directed to the disk sector to the EMD cache instead of the actual disk sector. The use of EMDs increases performance and productivity on the computing device systems for a fraction of the cost of adding memory to the computing device.

Abstract: Multiple copy sets of data are maintained on one or more storage devices. Each copy set includes at least some of the same data units as other sets. Different sets optionally have data units stored in different orders on the storage device(s). A particular one of the sets of data is selected as the set to be accessed in response to detecting a particular scenario.

Abstract: In one embodiment, a system analyzer may iteratively sub-partition the trace timeline 202 of a computer system activity to more accurately understand the root causes 214 of various scenarios 204 in the trace timeline 202. The system analyzer may automatically partition a scenario 204 of the trace timeline 202 on a scenario-aware basis. The system analyzer may automatically sub-partition the scenario 204 into a sub-scenario set of the scenario 204. The system analyzer may display a sub-partitioned trace timeline 202 to a user.

Abstract: A method and apparatus for managing the caching of data on an auxiliary memory of a computer. Pages of data may be cached on an auxiliary memory, such as a flash memory, at a virtual level using an identifier that does not involve a physical address of the pages on a memory. Pages may be cached on auxiliary memory that may be removable from the computer, e.g., by unplugging the memory from the computer. Page data may be encrypted and/or compressed on the auxiliary memory. An authentication indicator may be used to verify the accuracy of cached data in the case of an interrupted connection to the auxiliary memory, e.g., as a result of computer power down, hibernation, removal of the memory from the computer, etc.

Abstract: A method and apparatus for managing the caching of data on an auxiliary memory of a computer. Pages of data may be cached on an auxiliary memory, such as a flash memory, at a virtual level using an identifier that does not involve a physical address of the pages on a memory. Pages may be cached on auxiliary memory that may be removable from the computer, e.g., by unplugging the memory from the computer. Page data may be encrypted and/or compressed on the auxiliary memory. An authentication indicator may be used to verify the accuracy of cached data in the case of an interrupted connection to the auxiliary memory, e.g., as a result of computer power down, hibernation, removal of the memory from the computer, etc.

Abstract: Compressed storage management includes assigning a selection priority and a priority level to multiple data units stored in an uncompressed portion of a storage resource. The management can further include compressing data units and storing the compressed data units in a compressed portion of the storage resource. The data units in the compressed portion are stored in regions, which each store data units having the same selection priority or the same selection priority level.

Abstract: Embodiments of the invention provide techniques for managing cache metadata providing a mapping between addresses on a storage medium (e.g., disk storage) and corresponding addresses on a cache device at which data items are stored. In some embodiments, cache metadata may be stored in a hierarchical data structure comprising a plurality of hierarchy levels. When a reboot of the computer is initiated, only a subset of the plurality of hierarchy levels may be loaded to memory, thereby expediting the process of restoring the cache metadata and thus startup operations. Startup may be further expedited by using cache metadata to perform operations associated with reboot.

Abstract: Multiple copy sets of data are maintained on one or more storage devices. Each copy set includes at least some of the same data units as other sets. Different sets optionally have data units stored in different orders on the storage device(s). A particular one of the sets of data is selected as the set to be accessed in response to detecting a particular scenario.