A runtime environment for online processing of operating system kernel events

Abstract

Different approaches were proposed for the logging of operating system kernel events. In general, the resulting logfiles are huge and have to be analyzed by administrators, who try to identify problems and derive adequate actions. The idea of autonomic computing is to automate such tasks. As an important step towards this vision, computer systems have to be self-aware, i.e. they must be able to detect their runtime state and react if certain problems are detected. In contrast to control-theory based approaches for autonomic computing, the processing of discrete eventstreams offers the possibility of detecting singular events such as attacks or failing components directly. Our proposed runtime environment (1) processes event pattern descriptions, (2) combines events generated by usermode applications and the operating system kernel, (3) can be integrated into the operating system kernel to handle the events as close to their source as possible, (4) adaptively chooses relevant events to keep system disturbance low, and (5) provides an API for the implementation of ideas of autonomic computing in context of reactions to event patterns. In this paper, the event pattern specification language and the runtime environment are described. The described prototype implements the envisioned runtime environment in user-mode and is able to look for event patterns in prerecorded event logfiles. Additionally, an outlook on the planned operating system kernel integration is given.