CN107871003A - Method and apparatus for event handling in a multi-platform system - Google Patents

Abstract

For the method and apparatus for carrying out the method for the event handling in multiple platform system, methods described includes：File accessevents are obtained from multiple platform system；Assistance data is considered to handle event to determine to act and activate the action.

Description

Method and apparatus for event handling in a multi-platform system

This application is a divisional application of an invention application with a filing date of September 19, 2011, an application number of 2011800735591, and an invention title of "Method and Device for Event Processing in a Multi-Platform System".

technical field

The present disclosure relates generally to file access events, and more particularly, to handling file access events in a multi-platform system.

Background technique

Distributed multi-platform computerized systems are versatile. For example, in banks, investment firms, large corporations, or other objects such as the military.

For example, such a system may include tens to thousands of platforms, with a rate of a few million or about a billion per hour.

Contents of the invention

An exemplary embodiment of the disclosed subject matter is a system for event processing in a multi-platform system, comprising: a processor installed in a platform of the multi-platform system for intercepting a file access event in the multi-platform system and at least one server connected to the at least one platform, the at least one server configured to obtain the event intercepted by the processor and configured to process the event by at least one rule while considering the auxiliary data to decide to respond to An act of an event, wherein the auxiliary data is provided independently of retrieval of the event.

Another exemplary embodiment of the disclosed subject matter is a method for event handling in a multi-platform system, comprising obtaining a file access event in a multi-platform system; processing the event considering auxiliary data to decide or determine an action; and Optionally activate the action.

In the context of this disclosure, without limitation, a platform means a computer with data resources, such as folders or files, possibly shared with another computer, where different platforms may have different devices and and/or software and may have different organizations of data objects or resources. For example, platforms may be different computer types running under different operating systems and using different file systems.

Typically, a platform is connected to one or more other platforms that form various connections, such as interconnected clusters of platforms, where the clusters are linked to each other.

In the context of this disclosure, without limitation and unless otherwise indicated, a server means a computer that is external to or supplements a multi-platform system.

In the context of this disclosure, without limitation and unless otherwise specified, a database means any data structure other than or complementary to the data resources or objects of a multi-platform system, without excluding prior art traditional database or lookup table.

For brevity, clarity, and non-limitation, in this disclosure, references to an operating system mean any software, such as Windows, Linux, MacOS, or others, that operates to control the functions of a computer and particularly control access to the file system.

For brevity, clarity, and non-limitation, in this disclosure, references to a file system mean any repository or organization of data objects or data sources in a platform or shared between multiple platforms, for example, Microsoft's FAT32's NTFS, Apple's HFS, IBM's LTFS, Sun Microsystems' ZFS, Oracle's ACFS, Microsoft SharePoint, or other organizations (such as mail in a mail server such as Microsoft's Exchange), or such as Joliet (ISO 9660:1988) any other organization.

In the context of this disclosure, without limitation, a reference to a file means any data object or data source of the file system, for example, as used in the prior art, an attachment in an email or a link to a web page or a common document.

In the context of this disclosure, without limitation, events refer to those used in existing computer and software technology, such as interrupts, signals or procedure calls, generally asynchronous and not excluding synchronous events.

For brevity, clarity, and non-limitation, in this disclosure, a distributed multi-platform computerized system refers to a multi-platform system.

Description of drawings

Certain non-limiting exemplary embodiments or features of the disclosed subject matter are illustrated in the following figures.

The same or duplicate or equivalent or similar structures, elements, or parts appearing in one or more drawings are generally labeled with the same reference numerals, optionally with an additional letter or letters to identify Distinguish between similar objects or variations of an object, and identify and/or describe without duplication.

Dimensions of components and features shown in the figures are chosen for convenience or clarity of presentation, and are not necessarily shown as scale or true views. For convenience and clarity, some elements or structures are not shown or are only partially shown, and/or are shown at different angles or from different perspectives.

References to previously given elements do not necessarily further cite the drawings or descriptions in which they appear.

FIG. 1 schematically illustrates a system for event handling in a multi-platform system, according to an exemplary embodiment of the disclosed subject matter.

Figure 2 schematically illustrates a standardized event record according to an exemplary embodiment of the disclosed subject matter.

FIG. 3 schematically depicts operations in processing events from a multi-platform system, according to an exemplary embodiment of the disclosed subject matter.

Detailed ways

One technical problem addressed by the disclosed subject matter is responding to intercepted file access events in a multi-platform system in real time.

Another technical problem addressed by the disclosed subject matter is that of compressing and reducing the amount of data related to intercepted file access events in a multi-platform system.

Another technical problem addressed by the disclosed subject matter is handling intercepted file access events in a multi-platform system in or according to an extended or augmented context beyond the event itself .

One solution in accordance with the disclosed subject matter is to link or couple the processing of intercepting file access events to each platform or a portion thereof. Information about events in or relating to a platform or a group of platforms is monitored by a server, also called a "probe", connected to a platform or each platform in the group.

The information of the event is processed through the probe, thereby reducing the load of the platform to process the event information, thereby enabling real-time processing and response to the event in the multi-platform system.

Depending on the load or expected load of real-time processing of intercepted events, additional probes are connected to the platform, reducing the load on each probe and balancing the processing load, thereby providing a scalable solution for real-time response to multiple Load balancing of events in the platform system.

Another technical solution according to the disclosed subject matter is a process operating in a probe or in a device that, together with a data structure such as a table or database, discards redundant data of an intercepted event in the relevant code and/or abbreviate redundant data for intercepted events in related code.

By way of example, if a user opens a particular object such as a file or folder several times within a time interval, instead of logging each individual access, only the event interval is logged, possibly along with the number of accesses within that interval.

By way of another example, a unique code is assigned to the accessed object, thereby avoiding repeated recording of the full path string of the object.

By way of another example, the user name is not recorded, but an abbreviated unique code for the user name is used, thereby avoiding repeated recording of the user's full name.

Another technical solution according to the disclosed subject matter is one or more data structures stored in a server connected to the probe and/or in the probe, such as a database, the one or more The data structure holds auxiliary or extrinsic or disjoint information about the event.

By taking into account the auxiliary information, events can be processed and/or analyzed in a broader context on or beyond the multi-platform system.

By way of example, an object such as a folder may be recorded in a data structure as sensitive data for an organization. When this object is accessed, an event is generated in the platform where this object is stored and is monitored or captured by a probe.

The event's data, including the object path, or its code, is checked against the data in the data structure, and in this case the object is identified as sensitive, further action can be performed.

Data in the data structure may be predefined or may be determined or modified according to events or other operations in the multi-platform system. Thus, auxiliary or extrinsic information may be updated incrementally during operation of the multi-platform system. For example, if a particular user repeatedly accesses a particular file within a certain period of time, update the information in the data structure affected by this. Continuing, upon further events of this user's access to this file, as caught by the probe, the information in the data structure will be consulted, and this user may be prevented from further accessing this file.

A potential technical effect of the disclosed subject matter is a multi-platform system capable of real-time processing of file access events within an extended context beyond the data included in the event.

As used herein, the term "real-time" generally means an operation that is completed quickly enough in response to an event before another event occurs.

A general, non-limiting overview of practicing the present disclosure is given below. The overview describes exemplary practice of embodiments of the disclosure, providing a constructional basis for modified and/or alternative and/or divergent embodiments, some of which are then described.

Operations on files of a file system are generally well-defined procedures of the operating system and/or file system, such as creating or deleting files, or reading or writing files, and in some cases Modify the attributes of the file, such as read-only. Such operations on a file may be tracked, for example, by services of the operating system, or by using an API (Application Programming Interface), or by "hooking" onto the file operating process or any other method provided by the operating system and/or file system superior. Acquiring information about the occurrence and nature of file operations is collectively referred to herein as "file operation capture," or, for brevity, "capture," or variations thereof.

Events can be generated by capturing file operations. In some cases, the operating system and/or file system generate events. In many cases and/or in certain embodiments of the present disclosure, an event includes data or is accompanied by or provides data to the event, the data being referred to as event data. For clarity and brevity, when referring to events also means event data.

Event data includes items, or indications or associations thereof, such as the file accessed with part of the full path (called the file path), the user accessing the file, the event type according to the operation performed (such as open or delete), the The time (referred to as a timestamp), the location or platform where the event originates, or any other data associated with the event (such as the event's destination in case of copying or moving), or any combination thereof.

In some embodiments, the platform includes or is linked to or coupled to a processor that captures file operations and generates events, or, alternatively, a processor that intercepts operating system and/or file system generated events. Processors are also referred to herein as "drivers."

Events are acquired from one or more drivers by a server operating as an agent of the multi-platform system related to the event, also referred to herein as a "probe". In some embodiments, the probe queries the driver for events, or, alternatively, the driver sends events to the probe, optionally or alternatively, using a combination of querying and receiving of events by the probe.

In some embodiments, a probe can be connected to one platform or to multiple platforms. In certain embodiments, multiple probes are used, each connected to a different multiple platform, optionally with connection redundancy.

In some embodiments, the probe stores event data in the database according to a storage mechanism, such as in response to an event, or periodically (such as once an hour or once a day). In some embodiments, all probes are connected to the same database, optionally or alternatively, multiple databases are used, optionally the databases are accessible to all probes.

In some embodiments, the database includes information about files, or other information about the multi-platform system, or any other ancillary or disjoint information related to the event. Optionally, information collected during operation of the multi-platform system and/or by probes is provided to the database. For example, file permissions, file levels (such as group sensitivity), or the identity of users accessing a particular file and at what rate or at what time interval, or users are removed from the multi-platform system or introduced into the multi-platform system. platform system.

On top of getting the event, the probe examines the event data, possibly also about data in the database, and performs one or more actions according to one or more rules, somewhat similar to mailbox rules of prior art mail clients.

For example, a rule could read something like: If a deleted file is marked as sensitive, generate an alert; as a result, suspend the operation unless confirmed by an authorized user.

It may be noted that use of drivers by probes and further processing of events may at least potentially enable minimal or negligible intervention in the operation of the multi-platform system.

FIG. 1 schematically illustrates an event processing system 100 in a multi-platform system 190 according to an exemplary embodiment of the disclosed subject matter, wherein arrows between components of the event processing system 100 generally indicate data between components. flow.

Multi-platform system 190 includes multiple instances of platform 110 , as indicated by dashed lines 192 and 194 , representing any number of platforms 110 .

Platform 110 includes an operating system 114 and a file system 116, or for that effect, any structure or mechanism capable of storing, managing, and accessing data objects.

Event processing system 100 includes a server as a probe 120 connected to one or more platforms, such as platform 110 , as indicated by dashed line 192 , representing any number of platforms 110 connected to probe 120 . As indicated by dashed line 194 , the two illustrated instances of probe 120 represent any number of probes (such as probe 120 ) connected to any number of platforms (such as platform 110 ).

Probe 120 includes or is coupled to or linked to one or more rules, collectively referred to as rules 122 . Rules 122 use events or event data, or portions thereof, as parameters or arguments for the logic or procedures of rules 122 from which to decide or determine actions.

Platform 110 includes a processor, represented as a driver 112, that generates and/or intercepts file access events in platform 110, referred to generically and without limitation as "interception." Events are provided to and/or acquired by probe 120 .

Note that driver 112 does not necessarily have to be installed in or coupled to every platform 110, but rather, driver 112 is installed in or coupled to any platform 110 that has accessible file Or a file access event is being processed for said arbitrary platform 110 .

In some embodiments, in response to obtaining an event, the probe 120 runs the rule 122 using the obtained event as a parameter for the process logic of the rule 122 . Where an action is determined by the rules 122 , for other components of the event handling system 100 or the multi-platform system 190 , the probe 120 executes the action or invokes or initiates or authorizes the determined action.

In some embodiments, using probe 120 to process and process events reduces the processing load on multi-platform system 190 and/or minimizes or reduces intervening operations of multi-platform system 190 where driver 112 non-intrusively File access events in the multi-platform system 190 are captured.

In some embodiments, the probe 120 obtains events from the platform 110 via another component or components, such as a proxy server that reduces the communication load in the event processing system 100 and/or through pre-processing The processing load, such as filtering events before reaching the probe 120, is reduced.

In some embodiments, the probe 120 stores the events in the database 130, enabling further referencing and/or analysis of the events. Optionally, the probe 120 stores events via a proxy, such as a server, and/or via an intermediate storage, such as a cache.

In some embodiments, database 130 is implemented on a server or any other device, where database 130 represents any type of repository or organization, possibly split or distributed across multiple servers or devices. Thus, in some embodiments, events are stored in a different or separate structure or device than where the auxiliary data (explained further below) is stored. Still, for brevity and clarity, the storage device or structure is referred to as database 130 .

In some embodiments, events are stored using a compressed form and/or structures as described below.

Note that the rules 122 are not necessarily stored in the probe 120 and that the rules 122 may alternatively or additionally be stored in another device, such as a server linked to the probe 120 .

Note that driver 112 does not have to be stored in platform 110 , and alternatively or additionally, driver 112 may be stored in another device, such as a server linked to platform 110 .

Note that the probe 120 does not have to be a separate device from the platform 110, and that the probe 120 may alternatively or additionally be included in the platform 110 using, for example, an additional processor and its memory.

In some embodiments, rules 122 use additional information in addition to event data to determine actions. The additional information, also referred to as auxiliary data, is used in conjunction with the event data or as a reference, thereby influencing or enabling the program procedure affecting logic or the procedure of the rules 122 and/or the determined action. In some embodiments, the auxiliary data is stored in database 130 and/or in any other device or structure represented by database 130 .

In some embodiments, in response to obtaining an event, probe 120 queries database 130 for assistance data related to the event, and where assistance data is present in database 130, probe 120 retrieves the assistance data and compares the assistance data with Rule 122 merged. Optionally or alternatively, the probe (optionally, repeatedly or periodically) retrieves the auxiliary data from the database 130 and stores the data according to a mechanism, such as according to the frequency of recurring events. In some embodiments, the probe 120 caches data, optionally saving auxiliary data related to frequent events.

In some embodiments, the auxiliary data includes information about files in the platform's file system or files in the file systems of multiple platforms.

For example, auxiliary data may include permissions to access the file system or a portion thereof, membership in a group involving the file system or a portion thereof, the level of the file or group of files, classifications such as sensitive or public, for any purpose or historical or Recommendations instead mark a file, a designated owner of a file or group thereof, or any other data such as a sandbox result (ie a "what if" result), or a combination thereof.

In some embodiments, some or a portion of the auxiliary data is preset prior to operation of the multi-platform system 190 and/or the event processing system 100 .

In some embodiments, auxiliary data, or a portion thereof, is provided by operation of multi-platform system 190 , as schematically illustrated by auxiliary data 140 and dashed arrow 142 . For example, auditing or collecting a history of a user's activity on a file to generate permissions, or input by the user.

In some embodiments, auxiliary data, or a portion thereof, is provided through operation of event processing system 100 , such as records of events provided from probes 120 and/or results of rules 122 .

Accordingly, in some embodiments, during operation of multi-platform system 190 and/or event processing system 100 , database 130 is incrementally provided or updated with auxiliary data.

In some embodiments, ancillary data related to an event includes at least a portion of data related to or associated with a file or group of files, such as a file name, or a destination belonging to or related to or associated with a file. Location.

It is emphasized that in some embodiments, events are stored in database 130 by probe 120 separately from the auxiliary data.

In some embodiments, probe 120 connects to and communicates with database 130 via an agent, such as a server; optionally, the agent caches certain event data from probe 120 and/or supplementary data.

Note that use of probes 120 at least potentially facilitates fast or real-time responses to events as multi-platform system 190 is offloaded from processing events.

Having to respond to events and analyzing and/or processing events (such as via rule 122) should in principle or theory involve repeated and seemingly redundant references to items, and/or storage of items, such as usernames, file paths, or A location identifier (such as an IP or UNC path).

Such redundant operations can adversely affect response time and/or may require additional processors, such as probe 120, to respond to and process events in real time.

Therefore, and possibly for other reasons, in some embodiments, items of the multi-platform system 190 and/or optionally the event processing system 100 are expressed or encoded in a short form or code. In some embodiments, only items that are repeatedly referenced and/or determined to be repeatedly referenced are encoded. Encoding of items is also referred to herein as "normalization" or a variant thereof.

The code is stored in a structure or structures such as a look-up table, optionally using or aided by a mechanism for sufficiently fast retrieval, such as a binary tree or a hash table.

Thus, in some embodiments, events with the full username or full file path or destination or location UNC (Universal Naming Convention) and/or similar data of the accessed file are not captured and/or stored, or logged Instead of data, only the corresponding code is recorded, thereby saving operating time such as multiple accesses to the memory and also the storage load, and saving storage space overall.

Figure 2 schematically illustrates a standardized event record according to an exemplary embodiment of the disclosed subject matter.

The lookup table 210 includes strings, indicated at 206, for file paths, locations, and usernames, respectively, associated with codes 204 as binary numbers, shown as decimal numbers for clarity. Codes are used to standardize event records 202 using codes in place of corresponding strings.

Further and/or optionally or alternatively, in some embodiments, similar or redundant information is further reduced by compressing information reflecting repeated or similar information in the structure, the method is also called aggregation ( aggregation).

For example, between time T1 and time T2, file F is accessed N times by user U, and file F is recorded only at the Nth access in time interval T1-T2. Furthermore, file F and user U are optionally recorded by corresponding codes therein rather than full path and name strings.

As another example, the records R1, R2 and R3 in the database DB accessed by the user U are not recorded three times, but are recorded as DB and R1, R2, R3 and the user U at optional time intervals, and optionally, Record DB and User U as the corresponding codes therein.

In some embodiments, standardized data and structures are stored in database 130 . Optionally or alternatively, standardized data and structures, or portions thereof, are stored in a secondary device or memory, such as a proxy cache in probe 120 for quick reference.

In some embodiments, events are stored in database 130 in aggregated form separately from and/or in combination with auxiliary data or portions thereof.

Using normalization and/or aggregation at least potentially reduces processing, such as applying rules 122 and/or storage and/or communication in database 130 for retrieving events from drivers 112, thereby at least potentially facilitating real-time response and processing of events.

In some embodiments, the assistance data is also standardized into a code or aggregated to form the assistance data, at least potentially, further reducing the response and/or processing of events, enabling a reduction in the number of probes 120 .

In some embodiments, rules 122 operate in an "if then else" structure, alternatively or additionally, rules 122 operate in accordance with other structures, such as multi-branch or such as inference engines.

In some embodiments, the rules 122 stored in the probe 120 are run in parallel or multi-tasked or multi-threaded, optionally processing multiple events at least partially in parallel.

In some embodiments, rules 122 are arranged according to one or more priority criteria and/or rules 122 operate according to said criteria. For example, events from user input are processed over events from a background database.

In some embodiments, the decisions and/or resulting actions of rules 122 corresponding to events are grouped into three categories, namely filtering, alerting, and workflow, where actions are optionally invoked or initiated in response to events in real-time, Or design actions accordingly.

Events are discarded or ignored in filtering actions, thereby saving processing time and storage space. For example, events involving temporary or unimportant files, or events involving backup operations.

In an alert action, the information and/or signal is sent to an appropriate user and/or destination, such as by mail or by storage in an event log. For example, notify an administrative user when someone tries to access a sensitive file, or when a user who is a member of a specific group or a different group tries to access a file.

In a workflow action, invoke or initiate an operation or operations. Operations may be user-defined, or otherwise defined, and/or based on a computerized or software engine that can be extended or changed, such as through APIs or other system calls. For example, the right to prevent users from deleting multiple files within a predetermined or preset time interval.

Figure 3 schematically outlines operations in processing events from a multi-platform system platform according to an exemplary embodiment of the disclosed subject matter.

At 302 , events from a distributed multi-platform computerized system, such as a multi-platform system, are intercepted and/or generated by way of driver 112 , such as in probe 120 , obtained or received from the multi-platform system.

In some embodiments, an event also means the data therein, captured in a compressed form, such as a normalized form by code.

At 304, event-disjoint auxiliary or additional data is retrieved, such as from database 130 or from any source (optionally, from a cache).

At 306, the event is processed, such as by the rules 122, optionally determining one or more actions in view of or by taking into account the auxiliary data.

At 308 , the determined action is initiated or performed, optionally by a device such as probe 120 or by another device optionally included in multi-platform system 190 .

At 310, the event is optionally stored, such as in database 130, optionally in a compressed form using code and/or aggregation.

In some embodiments, storing is performed before and/or after activation of a process or action, optionally on a periodic basis or in response to an event of a plurality.

The operations outlined above and/or the order of operations may be changed. For example, the assistance data may have been stored and cached together with the processing code, such as rule 122, such that no further retrieval of the assistance data is performed.

Two non-limiting examples are described below with respect to a company's distributed multi-platform computerized system, such as multi-platform system 190 , as processed by an event processing facility, such as event processing system 100 .

In one scenario, a company receives information that an employee of the company is leaving the company. Determined that an employee has accessed sensitive information about the company, the administrator of the multi-platform system sets rules, such as rule 122, such that whenever an employee copies data marked as sensitive, an alert will be sent, allowing the employee to be found and/or preventing the employee from copying the data.

In another scenario, in order to minimize damage, an employee can cause the company's data to be shared, the administrator of the multi-platform system sets up a rule, such as rule 122, where if a user is on a folder with permissions of "everyone", in Deleting more than three files within a minute will remove the user's permissions, ensuring that the user will need to request access in the future.

Note that the techniques of this disclosure are not limited to file access events, but, in some embodiments, can be applied to other events or processes, such as input-output events or communications between processes or devices.

Thus in accordance with the disclosed subject matter, there is provided a system for event handling in a multi-platform system, comprising: a processor installed in a platform of the multi-platform system for intercepting a file access event in the multi-platform system; and at least a server, connected to at least one platform, said at least one server configured to acquire events intercepted by the processor, and configured to process the events by at least one rule while taking into account auxiliary data for deciding on a response to the event action. In some embodiments, the auxiliary data is provided independently of the retrieval of the event.

In some embodiments, the auxiliary data includes at least one of: preset data related to the multi-platform system, accumulated data responsive to the operation of the multi-platform system, or updated data responsive to the operation of the multi-platform system, or any combination thereof.

In some embodiments, the auxiliary data is stored in a database connected to said at least one server.

In some embodiments, the database is stored on at least one device separate from the at least one server and separate from the multi-platform system.

In some embodiments, the at least one server is configured to at least one of: retrieve events in compressed form, process events in compressed form, store events in compressed form, or any combination thereof, thereby facilitating access to events Real-time response.

In some embodiments, the compressed form includes at least one of encoded event data or aggregated event data, or a combination thereof.

In some embodiments, the at least one rule is stored in the at least one server, wherein, in some embodiments, the at least one server is configured to initiate actions determined by the at least one rule.

In some embodiments, the at least one rule includes a plurality of rules.

In some embodiments, the at least one platform includes a plurality of platforms.

In some embodiments, the at least one server includes multiple platforms.

In some embodiments, a processor is installed on each platform of a multi-platform system having accessible files.

Thus, in accordance with the disclosed subject matter, there is further provided a method for event handling in a multi-platform system comprising: obtaining a file access event from the multi-platform system; processing the event considering auxiliary data to determine an action and activating the action.

In some embodiments, processing the event includes using at least one rule, wherein, in some embodiments, the at least one rule includes a plurality of rules.

In some embodiments, the auxiliary data includes at least one of the following: preset data related to the multi-platform system, data accumulated in response to the operation of the multi-platform system, or updated data in response to the operation of the multi-platform system, or any combination thereof.

In some embodiments, the retrieval of events is performed on at least one server connected to and separate from the multi-platform system.

In some embodiments, the at least one server is configured to at least one of: retrieve events in compressed form, process events in compressed form, store events in compressed form, or any combination thereof, thereby facilitating access to events Real-time response.

In some embodiments, the compressed form includes at least one of encoded event data or aggregated event data, or a combination thereof.

In some embodiments, the auxiliary data is stored in a database connected to said at least one server.

The terms "processor" or "computer", or "server" or systems thereof are used herein in the ordinary context of the prior art, such as general-purpose processors or microprocessors, RISC processors, or DSPs, possibly including additional components, such as memory or communication ports. Alternatively or additionally, the terms "processor" or "computer" or derivatives thereof represent a device capable of executing a provided or incorporated program, and/or capable of controlling and/or accessing a data storage device and/or Other devices such as input and output ports. The term "processor" or "computer" also denotes a plurality of processors or computers connected, and/or linked and/or otherwise in communication, possibly sharing one or more other resources such as memory.

The terms "software," "program," "software process" or "procedure" or "software code" or "code" are used interchangeably depending on the context herein and represent one or more instructions or directives or circuits , for performing a series of operations, and the series of operations generally represents an algorithm and/or other processing or method. The program is stored in or on a medium such as RAM, ROM, or disk, or embedded in a circuit or other circuitry that is accessible and executable by a device such as a processor.

The processor and the program may constitute at least partly the same device, such as an electronic gate array, such as an FPGA or an ASIC, designed to perform a programmed sequence of operations, optionally including or linked to a processor or other circuitry.

The term computerized or similar term means having one or more processors operable or in accordance with a program.

The term configured for purpose or variations thereof means, using software and/or electronic circuits, designed and/or operable or working to achieve a purpose.

As used herein, without limitation, a module represents a part of a system, such as a part of a program that operates with other parts on the same unit, or a program component that operates on a different unit, and a process represents a collection of operations for achieve a specific output.

The flowchart and block diagrams illustrate the architecture, functionality, or operation of possible implementations of systems, methods, and computer program products according to various embodiments of the disclosed subject matter. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of program code, which includes one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the operations illustrated may occur in a different order or in parallel instead of sequential operations to achieve the same or equivalent effect.

The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for use in combination with other claimed elements as expressly claimed perform the function. As used herein, the singular forms "a", "the" and "the" are also intended to include plural forms, unless the context clearly dictates otherwise. It will be further understood that when used in this specification, the terms "comprising" and/or "comprising" specify the presence of the stated features, integers, steps, operations, elements and/or components, but do not exclude the presence or addition of an or multiple other features, integers, operations, elements, components, and/or groups thereof.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosed subject matter. While particular embodiments of the disclosed subject matter have been illustrated and described, it will be clear that the invention is not limited to the embodiments described herein. Numerous modifications, changes, variations, substitutions and equivalents are not excluded.

Claims (11)

1. a kind of expansible multiple platform system, including：

1) multiple platforms, wherein, each platform is computer and is connected at least one other flat in the multiple platform system Platform, and each platform includes：

A) operating system；

B) file system, wherein being stored with data object；

C) processor, for intercepting and capturing the file accessevents to the data object in the platform；And

2) several servers, each server are connected at least one platform；And

Wherein, the file accessevents intercepted and captured by the processor are provided to the server and are used to handle event, the clothes Be engaged in device quantity and its with the connection of platform be variable and the determination according to the load on the multiple platform system determines, with Real-time acquisition and processing for balancing the load and event is provided.

2. system according to claim 1, wherein, load of the determination of the load based on reality.

3. system according to claim 1, wherein, the determination of the load is based on expected load.

4. system according to claim 1, wherein, processing event is by considering to be provided separately on described multi-platform Pass through action of at least one rule to determine in response to event while the assistance data of the accumulation activity history of system.

5. system according to claim 4, wherein, at least one rule considers the attribute of accessed file.

6. system according to claim 1, wherein, the processor is configured to：It is less than by the way that the data of event are utilized The corresponding code for being encoded data is encoded, to compress the data of event.

7. system according to claim 1, wherein, the processor is configured to：Polymerization has set of metadata of similar data each other Event, so as to abandon the redundant data of the event.

8. system according to claim 4, wherein, the assistance data is based on following at least one：On file The movable history of user the input of user, accesses file system or part thereof of authority, is related to file system to generate authority Finger of membership qualification in system or part thereof of group, the classification of file or the packet of file, the mark of file, file or its group The fixed owner.

9. a kind of method for extending the event handling in multiple platform system, methods described include：

Multiple platforms are provided, wherein, each platform is computer and is connected at least one other in the multiple platform system Platform, and each platform includes：

A) operating system；

B) file system, wherein being stored with data object；

The installation process device in each platform of the multiple platform system, wherein, the processor is intercepted and captured in the platform The file accessevents of the data object；And

Server is connected to the platform, the server is configured to：According to the load on the multiple platform system really It is fixed to obtain and handle event, to provide real-time acquisition and processing for balancing the load and for event.

10. according to the method for claim 9, wherein, the determination of the load is based on actual load.

11. according to the method for claim 9, wherein, the determination of the load is based on expected load.