Abstract: Hierarchical temporal event management enables reduction or elimination of synchronization of multiple potentially huge indexes for real-time log indexing. Logs are time series data of events having associated times. Raw events are indexed in a hierarchical index. Transformed, filtered, or aggregated events are indexed in the hierarchical index at a different level of the hierarchy than the raw events. The result is a single hierarchical index that supports queries that optionally cross “level boundaries”, enabling a search on both aggregated information and specific elements. Such searches are usable when generating “drill down” data for graphs and reports. Search requests having corresponding search specifications are received from requestors. In response, a hierarchical event store is searched and results are provided to the requestors.

Abstract: An enterprise coordinator coupled to one or more site coordinators provides configuration and scheduling of tasks across a plurality of sites, and accumulates results. Each of the site coordinators optionally manages one or more respective agents to perform agent-local ones of the tasks, and optionally manages one or more respective grid workers to perform, in a distributed fashion, site-local ones of the tasks. Each of the site coordinators optionally apportions a state file into respective work lists that are assigned to the respective grid workers, and concatenates at least some portions of received results to produce a new state file. Each of the grid workers performs operations in accordance with the assigned work list and returns results including an updated version of the work list. In some usage scenarios, a bootstrapping technique is used to install an agent program on unprovisioned ones of the agents and/or the grid workers.

Abstract: Monitored content is classified to determine partial matches with fragments of documents. A set of redundant keys, or sliding sectional fingerprints, are computed for every possible alignment of the documents with respect to the monitored content. The keys are stored in repositories according to the classification of the corresponding documents. Sectional fingerprints are computed for the monitored content, and the repositories are searched. If a match is found in a repository corresponding to public content, then the monitored data section is classified as public. If a match is found only in a repository corresponding to private content, then the data section is classified as private. Otherwise, the data section is classified as unknown. In a related aspect, a set of policies are searched for a first match in part according to the classifications of the monitored data sections, and a designated action taken if the first match is found.

Abstract: Monitored content is analyzed to determine full and partial matches to previously classified content. Monitored content matching previously classified public content is classified as public, even if the monitored content is also found to match previously classified private content. In other words, public classification “overrides” potentially private classification. Monitored content matching only previously classified private content is classified as private. All remaining otherwise unclassified monitored content is classified as unknown. Monitored content is analyzed with respect to a session. If any content in a session is private, then the session is classified as private. If all content in a session is public, then the session is classified as public. Otherwise, the session is classified as unknown. In a related aspect, a set of policies are searched for a first match in part according to the classification, and a designated action taken if the first match is found.

Abstract: In one embodiment, documents accessible via a designated public account are classified as public. In another embodiment, documents accessible according to a designated public access control list are classified as public. In some embodiments, all documents not classified as public are classified as private. Content in the public documents is linguistically analyzed, resulting in a set of keys for use in subsequent full and partial content matching. The keys and associated file names are stored in a public-content identification repository. Similarly, content in the private documents is linguistically analyzed, and the results are stored in a private-content identification repository. Subsequently, full and partial content matching is performed on monitored content according to information in the public and private repositories.