US 11,726,957 B2
Methods and systems for a network flow log database
Shrey Ajmera, Milpitas, CA (US); Vipin Jain, San Jose, CA (US); Enrico Schiattarella, Los Altos, CA (US); and Pirabhu Raman, Fremont, CA (US)
Assigned to Pensando Systems Inc., Milpitas, CA (US)
Filed by Pensando Systems Inc., Milpitas, CA (US)
Filed on Apr. 7, 2021, as Appl. No. 17/225,060.
Prior Publication US 2022/0335008 A1, Oct. 20, 2022
Int. Cl. G06F 16/00 (2019.01); G06F 16/13 (2019.01); G06F 16/14 (2019.01); H04L 43/062 (2022.01)
CPC G06F 16/13 (2019.01) [G06F 16/148 (2019.01); H04L 43/062 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
creating a flow log object that includes a plurality of log entries at a plurality of log entry locations;
creating an index object that includes a plurality of shards and a flow table that indicate the log entry locations; and
storing the flow log object and the index object in at least one nonvolatile memory,
wherein
each of the log entries includes a plurality of indexed field values for a plurality of indexed fields that include a first indexed field and a second indexed field,
the log entries include a log entry stored at an entry location,
a first shard entry is stored in a first one of the shards indicated by a first shard identifier determined using the first indexed field,
the first shard entry stores a first flow entry indicator in association with a first flow key determined using the first indexed field,
the first flow entry indicator indicates a first log entry indicator that indicates the entry location,
a second shard entry is stored in a second one of the shards indicated by a second shard identifier determined using the second indexed field,
the second shard entry stores a second flow entry indicator in association with a second flow key determined using the second indexed field, and
the second flow entry indicator indicates a second log entry indicator that indicates the entry location.