Abstract: A method for simulating a transaction device is disclosed. A simulation device can be loaded with a predefined set of output messages to send in response to certain input messages, the output messages simulating messages sent by a transaction device. The simulation device can simulate a properly functioning transaction device, as well as a malfunctioning transaction device.

Abstract: A log processing job executing on a log producing computing system is initiated for processing log data associated with the log producing computing system. Log entries are determined to be available for processing. At least one instance of a Log Extractor Factory, Reader, and Transformation component are instantiated for reading and transforming the log data. Read log data is transformed into a common semantic format as transformed log data and transmitted in real-time to a Streaming Component for storage in an Enterprise Threat Detection (ETD) System. A recovery point is stored with a recovery timestamp indicating a next log entry in the log data to process.

Abstract: In certain embodiments, a tiered storage system is disclosed that provides for failover protection during data backup operations. The system can provide for an index, or catalog, for identifying and enabling restoration of backup data located on a storage device. The system further maintains a set of transaction logs generated by media agent modules that identify metadata with respect to individual data chunks of a backup file on the storage device. A copy of the catalog and transaction logs can be stored at a location accessible by each of the media agent modules. In this manner, in case of a failure of one media agent module during backup, the transaction logs and existing catalog can be used by a second media agent module to resume the backup operation without requiring a restart of the backup process.

Abstract: Systems and methods are disclosed for maintaining a status of a respective data processing unit (DPU) of a plurality of data processing units, each coupled to non-volatile memory. In some embodiments a first DPU is configured to execute one or more persistent processes, wherein the one or more processes persist in the non-volatile memory over power cycles, generate a first broadcast message upon completion of a first persistent process, transmit the first broadcast message to a set of DPUs associated with monitoring the first DPU, receive a second broadcast message from a second DPU of the set of DPUs and assign a value indicating an active status for the second DPU in a status table to track the status of each DPU of the set of DPUs.

Abstract: System and methods are provided for optimal error detection in programmatic environments through the utilization of at least one user-defined condition. Illustratively, the conditions can include one or more triggers initiating the collection of log data for methods associated with the provided at least one condition. Operatively, the disclosed systems and methods observe the run-time of the programmatic environment and initiate the collection of log data based on the occurrence of a condition trigger. A rank score can also be calculated to rank the methods associated with the defined condition to isolate those methods that have higher probability of causing the defined condition. Dynamic instrumentation of the methods associated with the user defined conditions during run time are used to calculate the rank score, which is used for ranking the methods.

Abstract: Described herein are techniques for storing data in a redundant manner on a plurality of storage units of a storage system. While all of the storage units are operating without failure, only error-correction blocks are stored on a first one of the storage units, while a combination of data blocks and error-correction blocks are stored on a second one of the storage units. Upon failure of the second storage unit, one or more data blocks and one or more error-correction blocks formerly stored on the second storage unit are reconstructed, and the one or more reconstructed data blocks and the one or more reconstructed error-correction blocks are stored on the first storage unit.

Abstract: There is provided a log collection device including: a log receiver that receives a text log from a log generation device; a dictionary generator that generates a compressed dictionary for performing text compression based on the received text log; a dictionary transmitter that transmits the generated compressed dictionary to the log generation device and instructs performing of the compression process using the compressed dictionary on the text log transmitted after the transmission of the compressed dictionary; and a decompression processor that performs a decompression process using the compressed dictionary on the text log received after transmission of the compressed dictionary.

Abstract: The subject disclosure relates to a database recovery technique that implements various aspects of transaction logging to optimize database recovery performance. Transactions are logged logically with no reference to physical location, which enables logging to be performed via multiple independent log streams in parallel. A set of log streams can further be adjusted to conform to a local configuration of a mirror or secondary node in order to increase mirroring flexibility. Additionally, individual transactions or groups of transactions are recorded using a single log record, which contains timestamp information to enable database recovery without reference to physical checkpoint files. Further, techniques are provided herein for processing transactions without Write Ahead Logging or hardening of undo information.

Abstract: A database system may implement efficient database journaling using non-volatile system memory. An update to a database may be received, and log records indicating the update may be generated. A non-volatile portion of the system memory may be directly accessed to store the generated log records such that in the event of a failure of the database, the log records may be still maintained. Log records stored to the non-volatile portion of the system memory may be identified as durably persisted, in some embodiments. Log records may be identified and sent to block-based storage, in some embodiments. Recovery from a database system failure, in some embodiments, by obtaining log records from the non-volatile portion of system memory.

Abstract: Methods and systems for selectively encrypting commit log entries in a distributed database system are described. One example method includes determining that a commit log for a particular server in the distributed database system is to be updated based on a data operation performed on a tablet managed by the server, the tablet including at least a portion of the data from a table in the distributed database system, and wherein the data from the table is stored in multiple tablets; determining that the tablet managed by the particular server is an encrypted tablet; in response to determining that the tablet is an encrypted tablet, generating an encrypted log entry representing the data operation performed on the tablet including an encrypted payload including information representing the data operation and an unencrypted header including information about the encrypted log entry; and updating the commit log to include the encrypted log entry.

Abstract: A computer system comprises a processor unit arranged to run a hypervisor running one or more virtual machines; a cache connected to the processor unit and comprising a plurality of cache rows, each cache row comprising a memory address, a cache line and an image modification flag; and a memory connected to the cache and arranged to store an image of at least one virtual machine. The processor unit is arranged to define a log in the memory and the cache further comprises a cache controller arranged to set the image modification flag for a cache line modified by a virtual machine being backed up, but not for a cache line modified by the hypervisor operating in privilege mode; periodically check the image modification flags; and write only the memory address of the flagged cache rows in the defined log.

Abstract: A remote snapshot is taken of a data associated with a node within a cluster of nodes by using a snapshot facility of an operating system. A set of backup data components is recorded. The data is remotely restored by interpreting the remote snapshot with the set of backup data components.

Abstract: Examples disclosed herein relate to determining that an operation is accessing data on a persistent memory and retrieving a log of the operation. The examples may also include determining a type of the data being accessed by the persistent memory by the operation and identifying, from the log, a location in the persistent memory of the data accessed by the operation. The examples may also include determining contents of the data accessed by the persistent memory by the operation and determining whether the contents of the data hold an invariant corresponding to the type of data.

Abstract: A method identifies syntaxes of disparately syntaxed components of a message file. One or more processors receive a message at a computer, where the message comprises disparately syntaxed components. Processor(s) detect a selection of a selected component from the disparately syntaxed components. Processor(s) display a description of a syntax used by the selected component on a user interface, where the description of the syntax displayed on the user interface comprises a description of what each data element, within the selected component, represents. Processor(s) identify a set of leading characters for the selected component, where the set of leading characters for the selected component organizes the disparately syntaxed components according to their respective syntax rules.

Abstract: A security agent implemented on a monitored computing device is described herein. The security agent is configured to receive one or more event notifications respectively associated with one or more kernel-mode events. Based on the one or more event notifications, the security agent determines that the one or more kernel-mode events are associated with user-mode processing of a request message by a RPC-utilizing process of the monitored computing device. The security agent then retrieves the request message based on information included in one or more RPC data structures and based on the one or more event notifications and identifies an originator of the request message based on metadata of the request message.

Abstract: Techniques described herein include an event notification processing platform configured to process large-scale event notifications in relative real time. The platform may receive event notifications from multiple sources and publish them to an event stream, or log. The platform may subsequently process each notification at a processing module according to one or more sets of rules and the processed information may be made available via a data store. Rule sets may be selected based on the type of event received by the platform. A backup data store may record event notifications as they are received or at periodic intervals. Event notification data may also be stored at multiple levels of the platform, so that in the case of a failure of one or more components of the platform, data may continue to be processed.

Abstract: A log analysis system includes a first processor unit, a second processor unit, a third processor unit, and a fourth processor unit. The first processor unit normalizes the detection log acquired by an acquirer, allocating the detection log into predefined monitoring target units, and outputs the monitoring target units. The second processor unit appends common information based on a predefined rule to each of the monitoring target units of the detection log output from the first processor unit, arranges the monitoring target units into information granularities based on the content of the detection log and common information, and outputs the monitoring target units as analysis unit information. The third processor unit gathers the analysis unit information output from the second processor unit and setting detection target event candidates based on a predefined rule, and outputs the detection target event candidates and the determination results.

Abstract: A computer system comprises a processor unit arranged to run a hypervisor running one or more virtual machines; a cache connected to the processor unit and comprising a plurality of cache rows, each cache row comprising a memory address, a cache line and an image modification flag; and a memory connected to the cache and arranged to store an image of at least one virtual machine. The processor unit is arranged to define a log in the memory and the cache further comprises a cache controller arranged to set the image modification flag for a cache line modified by a virtual machine being backed up, but not for a cache line modified by the hypervisor operating in privilege mode; periodically check the image modification flags; and write only the memory address of the flagged cache rows in the defined log.

Abstract: A computer system comprises a processor unit arranged to run a hypervisor running one or more virtual machines; a cache connected to the processor unit and comprising a plurality of cache rows, each cache row comprising a memory address, a cache line and an image modification flag; and a memory connected to the cache and arranged to store an image of at least one virtual machine. The processor unit is arranged to define a log in the memory and the cache further comprises a cache controller arranged to set the image modification flag for a cache line modified by a virtual machine being backed up, but not for a cache line modified by the hypervisor operating in privilege mode; periodically check the image modification flags; and write only the memory address of the flagged cache rows in the defined log.

Abstract: A method and system for checkpointing at least one application in an application group. At least one full checkpoint and at least one incremental checkpoint are created for the application in the application group. The at least one incremental application checkpoint is merged against the at least one full application checkpoint, and checkpointing across all applications in the application group is synchronized. A storage checkpoint is taken for at least one of the full checkpoint and the incremental checkpoint, and memory and storage checkpoints are synchronized and consistent.

Abstract: This disclosure proposes techniques for graphics processing. In one example, a graphics processing unit (GPU) is configured to access a memory according to one of an unsecure mode and a secure mode. The GPU may include a memory access controller configured to direct memory transactions from at least one hardware unit of the GPU to an unsecure memory unit or a secure memory unit based on the unsecure mode or secure mode and a resource descriptor associated with a memory resource.

Abstract: In a network computing environment, in which data stored at a primary storage system, is mirrored from the primary storage system to a secondary storage system, a selection may be made to direct an input/output operation such as a read operation, for example, to the secondary storage system instead of the primary storage system in order to improve operations. For example, a read operation may be directed to the secondary storage to improve the read operation response time. In other aspects, a read or other input/output operation may be directed to the secondary storage to improve utilization of the resources of the secondary storage system. Other aspects are described.

Abstract: A monitoring device information analyzing device calculates a log variation amount from a log variation amount of a monitoring target device h and a log variation amount of the monitoring target device on another day, by referring to a template information storage unit storing a time at which a log message arises, the log message arising in the past, a template that is associated with an ID of the monitoring target device, and a template ID of the template to calculate the log variation amount of the monitoring target device and to obtain the log variation amount of the monitoring target device on the other day at the same time zone; obtains the log variation amount that is to be a sample; executes verification according to a statistical method, and determines the sample as an advance log, if a test statistic is greater than a predetermined threshold value.

Abstract: A computer-readable medium, computer-implemented method, and system are provided. In one embodiment, a rollback checkpoint for a step in an executable process is established, and the executable process is executed. A change request is received, and the step with the established rollback checkpoint is adjusted. Any subsequent steps of the executable process are also adjusted.

Abstract: The present invention discloses a method and apparatus for automatic cross-system program debugging. One embodiment of the present invention provides a method for cross-system program debugging. The method comprises: determining a first breakpoint in a first debugging session of a first system; determining a second breakpoint in a second debugging session of a second system, the second system being different from the first system; and responsive to a user performing a debugging action of associating the first breakpoint with the second breakpoint in the first debugging session and the second debugging session, recording an association between the first breakpoint and the second breakpoint for automating the program debugging across the first system and the second system. There is further described a corresponding apparatus.

Abstract: A method by a computer includes, for each of a plurality of log records received as part of a log stream from a host machine node, identifying a template identifier within a template repository for a template string matching an invariant string of the log record, and identifying an attribute identifier in an attribute repository for an attribute string matching a variant string of the log record. The log records are partitioned into batches. Each of the batches are defined by a data structure that includes the template identifier and the attribute identifier for each of the log records within the batch. The data structures for each of the batches are stored into a log repository.

Abstract: A method for recovery after a power failure. The method generally includes a step of searching at least some of a plurality of pages of a memory to find a first erased page in response to an unsafe power down. A step may move stored data located between a particular word line in the memory that contains the first erased page and a previous word line that is at least two word lines before the particular word line. Another step may write new data starting in a subsequent word line that is the at least two word lines after the particular word line that contains the first erased page.

Abstract: A deduplication storage system with snapshot and clone capability includes storing logical pointer objects and organizing a first set of the logical pointer objects into a hierarchical structure. A second set of the logical pointer objects may be associated with corresponding logical data blocks of a client data object. The second set of the logical pointer objects may point to physical data blocks having deduplicated data that comprise data of the corresponding logical data blocks. Some of the logical pointer objects in the first set may point to the logical pointer objects in the second set, so that the hierarchical structure represents the client data object. A root of the hierarchical structure may be associated with the client data object. A snapshot or clone may be created by making a copy of the root and associating the copied root with the snapshot or clone.

Abstract: Embodiments for an approach to resource optimization during consistency group formation associated with a global mirror environment is provided. The approach detects when a primary volume associated with the consistency group has completed transmitting its out-of-sync (OOS) data towards its associated secondary volume. A command is sent to create a next consistency group sidefile so further writes can be sent to the sidefile rather than queueing at the primary volume. The approach repeats this process for each primary volume associated with the global mirror environment until all primary volumes are complete. Commands are sent to disable writes to the associated sidefiles and to merge the data stored in the sidefiles into normal cache as the next consistency group becomes the current consistency group.

Abstract: Method and apparatus for switching between a first server and a second server, each located within a virtual private cloud and the first server being located within a first zone and the second server being located within a second zone that is physically separate from the first zone. The method and apparatus further configured to determine that the first server has experienced a failure to send or receive data. The method and apparatus further configured to enable a second port on the second server. The method and apparatus further configured to create a new route table at the second server and flush the previous route table. The method and apparatus further configured to transmit, via the second port, a request to a virtual private cloud controller to update an elastic internet protocol address with the second port information and receive data from the virtual private cloud controller.

Abstract: Methods, systems, and computer program products are included for collecting kernel data in a protected kernel environment. A method includes allocating a first portion of a memory for a first kernel and reserving a second portion of the memory for a second kernel. The second kernel is stored in the second portion of the memory. A hypervisor is provided a memory address corresponding to the second portion of the memory. The hypervisor disables write and execute access privileges corresponding to the second portion of the memory. After a crash occurs corresponding to the first kernel, the second kernel is attempted to be executed. The hypervisor detects the attempted execution of the second kernel. The hypervisor enables execute access privileges corresponding to the second portion of the memory. After the execute access privileges are enabled, the second kernel is executed to collect data corresponding to the first kernel.

Abstract: A storage layer stores integrity data corresponding to data groups being written to a storage array. The storage layer validates stored data groups by use of the integrity data, independent of recovery information managed by the storage array. The storage layer preempts crash recovery operations of the storage array by validating a subset of the data groups. The storage layer identifies data groups to validate based on a location of a log append point within a storage address space of the storage array. The storage layer may be further configured to mitigate write hole conditions by, inter alia, reconstructing invalid data of a data group and/or retaining valid portions of the data group.

Abstract: A System, Computer program product, and computer-executable method for providing a user access to an image of data storage, wherein the data storage is managed by a data protection appliance (DPA), the System, Computer program product, and computer-executable including receiving a request for the image of data storage, wherein the image requested is the data storage at a Point in Time (PiT), creating a virtual image of data storage using a difference journal, wherein the virtual image provides the user with access to data within the requested image at the PiT, and providing access to the virtual image.

Abstract: A storage device failure recovery system includes a storage IHS and a user IHS coupled together over a network. The user IHS includes a storage system having a storage device, and a storage repair function that periodically provides a storage device image over the network to the storage IHS using data from the storage device. The storage repair function detects a failure of the storage device and streams an operating system on the user IHS using the storage device image stored on the storage IHS. While streaming the operating system on the user IHS using the storage device image stored on the storage IHS, the storage repair function analyzes the failure of the storage device, determines a storage system failure recovery procedure, and performs the storage system failure recovery procedure to restore the storage system while a user remains productive on the user IHS via the streamed operating system.

Abstract: A method and system for checkpointing at least one application in an application group. At least one full checkpoint and at least one incremental checkpoint are created for the application in the application group. The at least one incremental application checkpoint is merged against the at least one full application checkpoint, and checkpointing across all applications in the application group is synchronized. A storage checkpoint is taken for at least one of the full checkpoint and the incremental checkpoint, and memory and storage checkpoints are synchronized and consistent.

Abstract: A method to detect and diagnose where an error occurs in a source code that is associated with a software program or a website is provided. The method may include receiving a log report associated with the software program or the website, whereby by the log report is sent based on a hidden tag associated with the software program or the website. The method may also include analyzing the received log report. The method may further include detecting at least one error based on the analysis of the received log report. The method may include reverting back to a previous line in the source code associated with the software program or the website, whereby the reverting is based on the detection of the at least one error.

Abstract: A system and method are provided for detecting fraud and/or misuse of data in a computer environment through generating a rule for monitoring at least one of transactions and activities that are associated with the data. The rule can be generated based on one or more criteria related to the at least one of the transactions and the activities that is indicative of fraud or misuse of the data. The rule can be applied to the at least one of the transactions and the activities to determine if an event has occurred, where the event occurs if the at least one criteria has been met. A hit is stored if the event has occurred and a notification can be provided if the event has occurred. A compilation of hits related to the rule can be provided.

Abstract: Method and system are provided for providing instructions to a mainframe system. The method at a client system includes constructing a job control language (JCL) job embedded with an interpreted language program to provide instructions to a mainframe operating system. The method at a mainframe system includes: receiving a job control language (JCL) job embedded with an interpreted language program to provide instructions to a mainframe operating system; copying the interpreted language program to a transient executable area; and executing the interpreted language program.

Abstract: A method and apparatus for detecting a Return-Oriented Programming exploitation. At a computer device, a mechanism to detect a control transfer of a code location in a memory is established. This may be, for example, hooking the control transfer. The code location relates to an electronic file. In the event that a control transfer of the code location is detected, a comparison is made between a destination code location address with values in the freed stack. If the code location address matches any of the values in the freed stack, then it is determined that the control transfer of the code location relates to a Return-Oriented Programming exploitation.

Abstract: A digital device comprising a functional unit, a real-time performance information unit, and a monitoring unit is described. The real-time performance information unit provides real-time performance information about the functional unit. The real-time performance information unit enables the local host device to retrieve the real-time performance information from the real-time performance information unit. The monitoring unit retrieves the real-time performance information from the real-time performance information unit. The monitoring unit has a network interface for connecting to a network. The monitoring unit is arranged to upload the real-time performance information to the network via the network interface. A method of operating the digital device is also described.

Abstract: Embodiments of the inventive subject matter include receiving, in a distributed computing environment, a plurality of files for execution. Embodiments further include identifying, by parsing the plurality of files, code segments contained in each of the plurality of files. Embodiments further include determining, based on a comparison of the code segments and definitions contained in a distributed computing basic function library, a first group of the code segments that include configuration tasks and a second group of the code segments that include computational tasks. Embodiments further include combining the first group of the code segments to form a super configuration task. Embodiments further include creating an executable code, wherein the executable code comprises the super configuration task and the second group of code segments. Embodiments further include allocating the executable code to one or more nodes. Embodiments further include executing the executable code on the one or more nodes.

Abstract: A method and system for checkpointing at least one application in an application group. At least one full checkpoint and at least one incremental checkpoint are created for the application in the application group. The at least one incremental application checkpoint is merged against the at least one full application checkpoint, and checkpointing across all applications in the application group is synchronized. A storage checkpoint is taken for at least one of the full checkpoint and the incremental checkpoint, and memory and storage checkpoints are synchronized and consistent.

Abstract: The use of a data stream that has therein data items and a sequence of collection records. each comprising a collection definition that is not overlapping with the collection definition in any of the sequence of collection records. The collection definition defines which data items of the data stream are included within the collection. Each collection record also includes a data stream address range at least extending from the data stream address of the first data item of the collection to the data stream address of the last data item in the collection. In this context, the data stream may be efficiently processed by quickly reviewing the data stream to find each collection record. Once a collection record is found, the collection record is dispatched for processing to a worker thread for processing of the corresponding collection.

Abstract: A management system that generates a plan which is a countermeasure against an event occurring in a computer system includes: a plan generating unit configured to generate a plan according to the event; and an indicator generating unit configured to generate, as a performance change evaluation indicator of the plan, information on a change in performance of a resource of the computer system, which can occur due to other subject's process executed by the other subject different from a subject of the plan when the plan generated by the plan generating unit is executed.

Abstract: It is desirable for interrupt handling routines to be aware of the interrupt latency—the time between a interrupt request is received and the time when the interrupt service routine begins executing. A method is shown wherein the latency is measured by a dedicated counter and is available to the interrupt service routine. Alternately, a threshold may be set indicating the maximum acceptable latency and the interrupt service routine is signaled when said maximum is reached.

Abstract: Techniques for determining characteristics of data blocks being accessed in a storage system are described herein. According to one embodiment, an input/output (IO) request is received for accessing a first data block of a first file stored in a storage system. The first file is one of the files stored in the storage system and each file contains multiple data blocks. In response to the request, a block-based monitor executed in a memory by a processor accesses a set of monitoring rules to determine whether the first file should be monitored. If so, the block-based monitor captures statistics data associated with the first data block and stores the statistics data of the first data block in a statistics database maintained in a persistent storage device. The statistics database stores statistics data of the data blocks of files monitored and captured based on the set of monitoring rules.

Abstract: A method and system for data pipeline monitoring receives an event data object and a current status data object from one or more subsystems of a pipeline. The system analyzes the event data object and the current status data object to determine a first and second validation value. The system, in response to determining that either the first or second validation value is not valid, sends a notification.

Abstract: A system and method providing interrupted write protection to a stand-alone commodity storage array utilized within a database system. The method identifies writes of data from the database system to the storage array requiring interrupt protection, and for each write, generates an entry for an intent log maintained within the database system. The log entries include a write identifier, storage device information associated with a write, and a write statues indication which are used to identify failed writes following a database system failure.

Abstract: A computer system obtains a streaming media signal source, selects a testing sample from the streaming media signal source, records characteristics of the testing sample, and obtains an expected output according to the characteristics of the testing sample. Next, the computer system converts the testing sample into a digital streaming format preset by a service provider and initiates a media recognition request according to the testing sample in the digital streaming format to the service provider. After receiving a media recognition result of the testing sample returned by the service provider according to the media recognition request, the computer system compares the media recognition result with the expected output and indicates whether the service provider is normal in accordance with the comparison result.

Abstract: A vehicle safety system made up of multiple processors connected together into a multiprocessor system where the system is configured to operate the vehicle. Multiple sensors are connected to the processors and configured to gather information from vehicle and a lidar sensor attached to the windshield and oriented to gather data from the road in front of the vehicle. A processor is connected and collocated with the lidar sensor for controlling the lidar and a second processor is configured to operate an application configured to receive data from the multiprocessor system, merge the data from multiprocessor system into a message, prioritize the message against other messages, add a priority label to the message, send and process the message according to the priority label attached.