Abstract: In an example embodiment, a solution is provided that aggregates records as they are submitted to a third party (on the write path) rather than performing a real-time aggregation when a request is processed that needs the aggregation (read path). More particularly, in an example embodiment, a caching layer is introduced that avoids having to read all usage events to compute an aggregation when a request is received for aggregated data. The caching layer maintains values for various metrics that require aggregation.

Abstract: A method and apparatus for a first service processing system receiving and responding to a service request using a time context of a service time protocol is described. The method may include receiving a network based message associated with a service. The method may also include determining whether a service time context has been passed to the first service processing system from a second service processing system in the request. Furthermore, the method can include when no service time context is determined to have been passed to the first service processing system in the request, generating a current service time from a combination of a current physical time of the first service processing system and an initial counter time, performing a task associated with the service, and transmitting a second network based message that comprises the current service time as time context metadata associated with the performance of the task to a second service processing system.

Abstract: A method and system for performing lock handling across multiple servers. In one embodiment, the method comprises receiving, by a second server, a first request of a service from a first server, the first request including first metadata which includes lock information of a lock held by the first server. The method comprises extracting the lock information from the first metadata and storing the lock information in a locking table without the lock being transferred to the second server. The method further comprises executing application code to perform the service, including, while executing the application code, determining whether the lock exists based on the lock information in the locking table, and passing a lock check in response to determining that the lock exists.

Abstract: A method and apparatus for deleting resources are described.

Abstract: In an example embodiment, a solution is provided that aggregates records as they are submitted to a third party (on the write path) rather than performing a real-time aggregation when a request is processed that needs the aggregation (read path). More particularly, in an example embodiment, a caching layer is introduced that avoids having to read all usage events to compute an aggregation when a request is received for aggregated data. The caching layer maintains values for various metrics that require aggregation.

Abstract: A method and apparatus for deleting resources are described.

Abstract: A method and apparatus for a first service processing system receiving and responding to a service request using a time context of a service time protocol is described. The method may include receiving a network based message associated with a service. The method may also include determining whether a service time context has been passed to the first service processing system from a second service processing system in the request. Furthermore, the method can include when no service time context is determined to have been passed to the first service processing system in the request, generating a current service time from a combination of a current physical time of the first service processing system and an initial counter time, performing a task associated with the service, and transmitting a second network based message that comprises the current service time as time context metadata associated with the performance of the task to a second service processing system.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for correcting timestamps in computer security telemetry data. A method includes: receiving, at a computer network security data analysis system, first log data identifying a plurality of first events occurring on a computer network, the first log data including, for each first event, a respective first timestamp identifying when the first event occurred, the first timestamp including a first hour value, a first minute value, and a first second value; and generating first modified log data, the first modified log data including, for each first event, a first modified timestamp including the first minute value and the first second value from the log data and a first modified hour value that represents an hour value from a current time at which the first log data was received at the computer network security data analysis system.