Single scan for a base machine and all associated virtual machines

[0001] This invention pertains generally to virtual computing, and more specifically to scanning the file systems of a base machine and its associated virtual machines.

[0002] Consider a computer running one or more virtual machines, using virtualization software such as VMware. The base computer runs an operating system (the baseOS), and the virtualization software (e.g., VMware) runs as an application on the baseOS. An operating system runs in the virtualization environment (a guestOS) in order to form a virtual machine. The applications running in the virtual environment on the guestOS have their data organized in the form of files in the file system of the guestOS. There is typically a single file in the baseOS file system that houses all the data for the applications running in the guestOS, and the guestOS itself. Any baseOS user or application looking at the file data on the baseOS will not be able to make any sense of virtual machine data, as the guestOS file system does not necessarily write file data sequentially within the baseOS file representing a virtual machine. Instead, the data extents of the files in a guestOS are present in a seemingly random sequence in the single file on the baseOS. Therefore, an application on the baseOS cannot reorganize the file data and reconstruct the files in the guestOS environment without the help of the file system on the guestOS.

[0003] In such an environment, if anti-virus software scans the baseOS system for viruses, it does not get reliable information concerning viruses that may be in any virtual machine files on the system. Thus, even if each baseOS file representing a virtual machine is scanned and no virus signatures are found, there could still be undetected virus signatures present that are broken up and stored non-contiguously such that the baseOS file system does not recognize the different blocks as comprising contiguous data. Thus, in order to safely conclude that no viruses are present on the base machine, each virtual machine would also need to be scanned.

[0004] Individually scanning the file system of each virtual machine results in lot of work duplication and performance overhead. Each baseOS file representing a virtual machine must be scanned multiple times, once at a baseOS level, and again at a virtual machine level. The act of separately scanning the virtual machine file systems populates those file systems and the baseOS file system with scanning data. Additionally, the anti-virus scanning tool would need to be installed on each of the guestOS operating systems of the virtual machines.

[0005] What is needed are methods, computer readable media and computer systems for performing a single scan on a base machine such that all associated virtual machines can also be reliably scanned.

[0006] Computer-implemented methods, computer systems and computer-readable media scan the file systems of virtual machines running on a base computer. In order to scan a virtual machine, a scanning manager identifies the file on the base machine that represents the virtual machine, freezes the virtual machine, and creates a snapshot thereof. The scanning manager restarts the frozen machine, and starts the snapshot. The files of the file system of the snapshot are mapped at a virtual machine level, and the resulting file mapping information is used to scan the files of the virtual machine at a base machine level. The mapping information is current as of the instant the snapshot was taken.

[0007] The scanning can comprise scanning for malicious code, such as virus signatures. In other embodiments, the scanning comprises other types of pattern searches. The scanning manager can scan one, multiple or all virtual machine(s) running on the base computer, in conjunction with a full or partial scan of the base computer, or independently.

[0008] The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawing, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.

[0011] The Figures depicts embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein.

[0012] FIG. 1 illustrates a scanning manager 101, according to some embodiments of the present invention. It is to be understood that although the scanning manager 101 is illustrated as a single entity, as the term is used herein a scanning manager 101 refers to a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where a scanning manager 101 is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries.

[0013] As illustrated in FIG. 1, the scanning manager 101 identifies the files 103 that represent the virtual machines 105 running on a base computer 107. The specific files 103 used by virtualization software to represent virtual machines 105 are known. For example, VMware publishes this information.

[0014] The scanning manager 101 freezes the virtual machines 101 by using the “suspend” or a similar feature (in VMware this feature is called “suspend;” it may have different names in other software packages). The scanning manager 101 then creates a snapshot 109 of the file 103 representing each virtual machine 105. The snapshot 109 can be a simple copy of the file 103 with a changed name and configuration (e.g., changed base VMware configuration), such that the virtual machine 105 represented by the snapshot 109 can be started.

[0015] Following is an example procedure for creating a snapshot 109 for a VMware virtual machine 105, according to one embodiment of the present invention. In the following example, the virtual machine is represented by “Virtual 01”, and “Virtual 03” represents the created snapshot 109 thereof. This example is for a base machine 107 running the Linux operating system, and includes implementation specific Linux commands. It is to be understood that the following procedure is only an example, and many variations on this procedure will be readily apparent to those of ordinary skill in the relevant art in light of this specification.

[0016] 1. Create a new directory:

[0017] #cd/var/lib/vmware/Virtual\Machines

[0018] #mkdir “Virtual 03”

[0019] 2. Copy the files 103 to the new directory. The following scripting changes filename components as desired, in this case changing the “01” and “03”. When using such scripting, it is important to watch the direction of the quotation marks.

[0020] # for F in Virtual\01/*

[0021] >do

[0022] >cp-av “$F” “‘echo $F|sed ‘s/Virtual 01/Virtual 03/g’’”

[0023] >done

[0024] 3. Change the first of two files 103 that specify the disk images:

[0025] # cd Virtual\03

[0026] # vi Virtual\03.vmdk

[0027] 4. Globally change “Virtual 01” to “Virtual 03” by typing:

[0028] :%s/Virtual 01/Virtual 03/g

[0029] Save your changes and exit the editor.

[0030] 5. Edit the other file 103:

[0031] # vi Virtual\03.vmx.

• • [0032] Globally change “Virtual 01” to “Virtual 03” by typing:

[0033] :%s/Virtual 01/Virtual 03/g

[0034] 6. Delete the write-lock file, if it exists:

[0035] # rm Virtual\03.vmdk.WRITELOCK

[0036] 7. Edit the file /etc/vmware/vm-list to add the line:

[0037] config “/var/lib/vmware/Virtual Machines/Virtual 03/Virtual 03.vmx”

The scanning manager 101 can restart the frozen virtual machines 105, once the snapshots 109 have been created.

[0038] The scanning manager 101 starts the snapshot virtual machines 105, and uses a file mapping methodology to create mapping information 111 for the files 103 of the file systems 113 of the virtual machines 105. Such mapping information 113 typically includes the data extent location for the files 103 on the storage device. In the case of a file system 113 of a virtual machine 105, the storage device is not a physical medium, but instead the file 103 in the file system 113 of the base computer 107 that represents the virtual machine 105. The mapping information 111 reflects the state of the file system 113 at the time the snapshot 109 was taken. Thus, the virtual machine 105 files 103 subsequently scanned are guaranteed to be current as of the instant when the snapshot 109 was taken.

[0039] As illustrated in FIG. 2, the file system 113 of a virtual machine 105 is mapped at a guestOS level (e.g., by a mapping component 201 of the scanning manager 101 running as a process on the virtual computer 105). Thus, the mapping component 201 gleans mapping information 113 concerning the locations of the files 103 of the file system 113 of the virtual machine 105 on their storage medium, which in this case is the single file 103 in the file system 113 of the base computer 107 that represents the virtual machine.

[0040] The mapping information 113 is communicated to a baseOS component of the scanning manager 101 (e.g., a scanning component 203 running as a process of the base computer 107). This communication can be executed via network protocol. Note that the mapping information 113 is very small compared to the actual files 103. Additionally, as the transfer occurs between the guestOS and the baseOS on the same physical base computer 107, there is no actual traffic on the external network. Once the mapping information 113 has been gleaned and transmitted, the snapshot 109 can be shutdown.

[0041] Techniques for file mapping are known to those of ordinary skill in the relevant art, and the implementation mechanics for file mapping within the context of the current invention will be readily apparent to those of ordinary skill in the relevant art, in light of this specification.

[0042] Returning to FIG. 1, the scanning manager 101 uses the mapping information 113 to reorganize the data representing the files 103 of each virtual machine 105 at a base machine 107 level. For example, the scanning manager 101 can use the mapping information 113 to reconstruct the files 103 of a virtual machine 105, e.g., in the memory of the base machine 107.

[0043] The scanning manager 101 then scans the files 103 of virtual machines 105 at a base machine 105 level. The scanning can comprise scanning for malicious code (e.g., virus) signatures, but in other embodiments comprises other types of pattern searches. Anti-virus scanning is just an example.

[0044] It is to be understood that the scanning manager can use the above described methodology to scan one, multiple or all virtual machine(s) 105 running on the base computer 107, in conjunction with a full or partial scan of the base computer 107, or independently.

[0045] In different embodiments of the present invention, the scanning manager 101 scans file systems 113 of virtual machines 105 that are implemented by various virtual machine packages having the “freeze”, “snapshot” and “resume” capabilities. VMware is just an example.

[0046] As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Furthermore, it will be readily apparent to those of ordinary skill in the relevant art that where the present invention is implemented in whole or in part in software, the software components thereof can be stored on computer readable storage media as program codes. As will be readily apparent to one of ordinary skill in the relevant art, any form of computer readable storage medium can be used in this context, such as magnetic or optical storage media, such that when the program codes stored on a computer readable medium are executed by a computer processor of a computing device, the computing device executes their associated functionality. As used herein, the term “computer readable storage medium” does not mean an electrical signal separate from an underlying physical medium. Additionally, as will be readily apparent to one of ordinary skill in the relevant art, software portions of the present invention can be instantiated (for example as object code or executable images) within the memory of any programmable computing device, such that when the processor of the computing device processes the components, the computing device executes their associated functionality. It will be further readily apparent to those of ordinary skill in the relevant art that the terms “computer system” and “computing device” means one or more computers configured and/or programmed to execute the described functionality. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.