Virtual switch interceptor
Application management is facilitated by observing messages communicated amongst virtual applications external to application-hosting virtual machines. In one instance, the messages can be observed from within a virtual switch outside hosting virtual machines. One or more actions can subsequently be performed as a function of the messages such as but not limited to application monitoring as well as message routing, filtering, and/or transformation.
1. A method performed by a physical computing device, the method comprising:
implementing, by the physical computing device, a virtual machine;
communicatively coupling, by the physical computing device, the virtual machine to a virtual switch via which an application hosted by the virtual machine communicates via messages with another entity, where the virtual switch is implemented at least in part by the computing device;
maintaining, by a management component implemented at least in part by the computing device, metadata that includes information describing the virtual machine, an identification of the application hosted by the virtual machine, and credentials associated with the messages;
observing, by an interface component of the virtual switch and based on the credentials and the identification of the application, at least a portion of the messages; and
performing, by the management component, an action as a function of the observed at least a portion of the messages.
2. The method of claim 1 further comprising observing other messages of other virtual machines as they are deployed, removed, and moved.
3. The method of claim 2 where the metadata further includes additional information describing the other virtual machines, additional identification of other applications hosted on the other virtual machines, and additional credentials associated with other messages corresponding to the other applications.
4. The method of claim 1 further comprising decrypting, by the interface component using the credentials, the at least a portion of the messages.
5. The method of claim 1 further comprising receiving a policy that influences the action performed.
6. The method of claim 5 further comprising interpreting the messages at a network-protocol-stack level based on the policy.
7. The method of claim 1 further comprising forward, by the interface component, at least some of the messages, or copies thereof, to the management component.
8. The method of claim 1 further comprising communicating results of the action to a management server.
9. A system comprising:
at least one physical processor;
a virtual machine implemented at least in part by the at least one physical processor;
a virtual switch communicatively coupled to the virtual machine and via which an application hosted by the virtual machine communicates via messages with another entity;
memory coupled to the at least one physical processor, the memory comprising metadata that includes information describing the virtual machine, an identification of the application hosted by the virtual machine, and credentials associated with the messages;
an interface component of the virtual switch configured to observe, based on the credentials and the identification of the application, at least a portion of the messages; and
a management component configured to perform an action as a function of the observed at least a portion of the messages.
10. The system of claim 9 , the interface component further configured to decrypt, using the credentials, the at least a portion of the messages.
11. The system of claim 9 where the interface component is further configured to observe other messages of other virtual machines as they are deployed, removed, and moved.
12. The system of claim 11 where the metadata further includes additional information describing the other virtual machines, additional identification of other applications hosted on the other virtual machines, and additional credentials associated with other messages corresponding to the other applications.
13. The system of claim 9 where the interface component is further configured to forward at least some of the messages, or copies thereof, to the management component.
14. The system of claim 9 where the action comprises at least one of routing, filtering, or transforming some of the messages.
15. The system of claim 9 further comprising a third component configured to communicate results of the action to a management server.
16. At least one computer-readable storage medium having instructions stored thereon that configure at least one physical processor to perform actions upon execution of the instructions, the actions comprising:
implementing a virtual machine;
communicatively coupling the virtual machine to a virtual switch via which an application hosted by the virtual machine communicates via messages with another entity, where the virtual switch is implemented at least in part by the at least one physical processor;
maintaining, by a management component implemented at least in part by the at least one physical processor, metadata that includes information describing the virtual machine, an identification of the application hosted by the virtual machine, and credentials associated with the messages;
observing, by an interface component of the virtual switch and based on the credentials and the identification of the application, at least a portion of the messages; and
performing, by the management component, an action as a function of the observed at least a portion of the messages.
17. The at least one computer-readable storage medium of claim 16 , the actions further comprising observing other messages of other virtual machines as they are deployed, removed, and moved.
18. The computer-readable storage medium of claim 16 , the actions further comprising decrypting, using the credentials, the at least a portion of the messages.
19. The computer-readable storage medium of claim 17 where the metadata further includes additional information describing the other virtual machines, additional identification of other applications hosted on the other virtual machines, and additional credentials associated with other messages corresponding to the other applications.
20. A physical computing device, comprising:
a switch via which an application hosted by a virtual machine communicates via messages with another entity;
memory comprising metadata that includes an identification of the application and credentials associated with the messages;
an interface component of the switch configured to observe, based on the credentials and the identification, at least a portion of the messages; and
a management component configured to perform an action based on the observed at least a portion of the messages.
21. The physical computing device of claim 20 where the virtual machine is hosted a separate physical computing device.
22. At least one computer-readable storage medium having instructions stored thereon that configure at least one physical processor to perform actions upon execution of the instructions, the actions comprising:
observing, based on an identification of an application that communicates via messages with another entity, the application hosted by a virtual machine, and further based on credentials associated with the messages, a portion of the messages; and
performing an action based on the observed portion of the messages.
23. The at least one computer-readable storage medium of claim 22 , the action comprising generating one or more management metrics.