Monitoring system-calls to identify runaway processes within a computer system

1. A method for identifying runaway processes within a computer system, comprising:

monitoring system-calls on the computer system during runtime to generate a trace of system-calls made;

analyzing the trace of system-calls made to detect runaway processes; and

if a runaway process is detected, identifying the runaway process;

wherein analyzing the trace of system-calls made to detect runaway processes involves:

computing a metric from the trace of system-calls made; and

using the metric to subsequently identify runaway processes;

wherein computing the metric involves:

creating a histogram for the trace of system-calls made; and

comparing the frequency of the most common system-call in the trace to the mean system-call frequency for the system-calls in the trace.

2. The method of claim 1 , wherein the method is performed over a limited time interval to reduce resource usage.

3. The method of claim 2 , wherein the method is repeated over multiple time intervals to determine changes in the metric.

4. The method of claim 1 , wherein monitoring system-calls on the computer system involves using a dynamic tracing framework.

5. The method of claim 1 , wherein identifying a runaway process involves checking a set of secondary characteristics to confirm that a process is likely to be a runaway process.

6. The method of claim 5 , wherein checking the set of secondary characteristics involves comparing a process type for the process to a list of culprit process types to determine whether the process is likely to be a runaway process.

7. The method of claim 6 , wherein the method further comprises:

killing the runaway process;

alerting a system administrator of the runaway process; and/or

alerting an owner of the runaway process.

8. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for identifying runaway processes within a computer system, comprising:

monitoring system-calls on the computer system during runtime to generate a trace of system-calls made;

analyzing the trace of system-calls made to detect runaway processes; and

if a runaway process is detected, identifying the runaway process;

wherein analyzing the trace of system-calls made to detect runaway processes involves:

computing a metric from the trace of system-calls made; and

using the metric to subsequently identify runaway processes;

wherein computing the metric involves:

creating a histogram for the trace of system-calls made; and

comparing the frequency of the most common system-call in the trace to the mean system-call frequency for the system-calls in the trace.

9. The computer-readable storage medium of claim 8 , wherein the method is performed over a limited time interval to reduce resource usage.

10. The computer-readable storage medium of claim 9 , wherein the method is repeated over multiple time intervals to determine changes in the metric.

11. The computer-readable storage medium of claim 8 , wherein monitoring system-calls on the computer system involves using a dynamic tracing framework.

12. The computer-readable storage medium of claim 8 , wherein identifying a runaway process involves checking a set of secondary characteristics to confirm that a process is likely to be a runaway process.

13. The computer-readable storage medium of claim 12 , wherein checking the set of secondary characteristics involves comparing a process type for the process to a list of culprit process types to determine whether the process is likely to be a runaway process.

14. The computer-readable storage medium of claim 13 , wherein the method further comprises:

killing the runaway process;

alerting a system administrator of the runaway process; and/or

alerting an owner of the runaway process.

15. An apparatus that identifies runaway processes within a computer system, comprising:

a monitoring mechanism configured to monitor system-calls on the computer system during runtime to generate a trace of system-calls made;

an analysis mechanism configured to analyze the trace of system-calls made to detect runaway processes; and

an identifying mechanism configured to identify a detected runaway process;

wherein analyzing the trace of system-calls made to detect runaway processes involves:

a computation mechanism configured to compute a metric from the trace of system-calls made;

wherein the computation mechanism is farther configured to compute the metric by creating a histogram for the trace of system-calls made and comparing the frequency of the most common system-call in the trace to the mean system-call frequency for the system-calls in the trace; and

an identification mechanism that is configured to use the metric to subsequently identify runaway processes.