Re: [Qemu-devel] Adding Disk-Level Introspection to QEMU

[Wolfgang Richter]

On Wed, Apr 24, 2013 at 4:39 AM, Stefan Hajnoczi <address@hidden> wrote:

On Tue, Apr 23, 2013 at 03:11:26PM -0400, Wolfgang Richter wrote:
> On Tue, Apr 23, 2013 at 2:31 PM, Wolfgang Richter <address@hidden> wrote:
>
> > On Tue, Apr 23, 2013 at 2:21 PM, Stefan Hajnoczi <address@hidden>wrote:
> >
> >> Eric's suggestion to use NBD makes sense to me.  The block-backup code
> >> can be extended fairly easier using sync mode=none (do not perform a
> >> background copy of the entire disk) and by disabling the bitmap
> >> (essentially "tap" mode).
> >
> >
> Also, as another thought, I think I can actually use the bitmap to implement
> an optimization.  In my code, I already use a bitmap to determine which
> sectors I want to introspect (ignoring portions of the disk greatly reduces
> required bandwidth and overhead; swap space for example isn't generally
> interesting unless you can interpret memory as well).   So I think I can
> adapt
> my code here as well.

Cool.  By the way, do you actually care about the data being written or
just which sectors were touched?

Excellent question, my example wasn't clear.  I do want the data _especially_

for sectors containing file system metadata because I interpret metadata (for

NTFS and ext4 currently) to figure out new sectors associated with a file or

file creations and file deletions.

But, if there is a system that is write-heavy, I'm OK with dropping data writes

to regular files (not file system metadata).  In that case, people interested in

say monitoring web server logs would lose the data stream from their log files,

but the introspection system as a whole maintains its view of the file system

space. 

--
Wolf