Abstract: Techniques for optimizing file processing for linked clone virtual machines (VMs) are provided. In one embodiment, an agent executing within a linked clone VM can determine an identifier for a file to be processed by a file processor, where the identifier is based on a virtual disk location of the file. The agent can then transmit the identifier to the file processor. Upon receiving the identifier, the file processor can detect, using the identifier, whether the file has already been processed. If the file has already been processed, the file processor can short-circuit processing of the file.

Abstract: According to examples of the present disclosure, a method is provided to perform network introspection in an operating system that comprises a user memory space and a kernel memory space. The method may comprise, in response to an initiation of a socket operation, filtering the socket operation at a socket layer in the kernel memory space using a socket operation filter hook associated with the socket operation. The method may further comprise performing an introspection action associated with the socket operation filtered using the socket operation filter hook.