Monitoring system
The monitoring system is a system that monitors a virtualization system, the system including: a VM monitor and a request monitor each of which has a different authority, monitors the virtualization system, and detects an anomaly; and a determiner that determines a state of the virtualization system based on monitoring results from the VM monitor and the request monitor.
1. A monitoring system that monitors a virtualization system, the monitoring system comprising:
a processor; and
at least one memory including programs that, when executed by the processor, cause the processor to perform operations, the operations including:
monitoring, by a plurality of monitors, the virtualization system, each of the plurality of monitors being implemented by the processor executing one of the programs, each of the plurality of monitors having a different authority;
detecting, by at least one of the plurality of monitors, an anomaly in the virtualization system; and
determining a state of the virtualization system based on monitoring results from the plurality of monitors,
wherein each of the plurality of monitors includes different level of authorities, with a monitoring result of a monitor having a higher authority being given a higher priority for the determining.
2. The monitoring system according to claim 1 ,
wherein the plurality of monitors include at least one of a virtual environment monitor that monitors a virtual environment in the virtualization system, a request monitor that monitors a request from the virtual environment to a virtualization infrastructure in the virtualization system, or a virtualization infrastructure monitor that monitors the virtualization infrastructure in the virtualization system.
3. The monitoring system according to claim 1 ,
wherein the processor determines the state of the virtualization system according to a combination of the monitoring results from the plurality of monitors.
4. The monitoring system according to claim 1 ,
wherein the processor determines the state of the virtualization system according to a detection order of the anomalies detected by the plurality of monitors.
5. The monitoring system according to claim 1 ,
wherein the processor determines the state of the virtualization system according to a duration of the anomalies detected by the plurality of monitors.
6. The monitoring system according to claim 1 , wherein the operations further include:
responding according to the state of the virtualization system that has been determined by the processor.
7. The monitoring system according to claim 1 , wherein
the plurality of monitors includes a first monitor and a second monitor, each of which has a different authority,
the second monitor is accessible to the first monitor, and
the first monitor is inaccessible to the second monitor.
8. The monitoring system according to claim 7 , wherein
the first monitor is a virtual environment monitor that monitors a virtual environment in the virtualization system, and
the second monitor is a request monitor that monitors a request from the virtual environment to a virtualization infrastructure in the virtualization system.
9. The monitoring system according to claim 7 , wherein
the plurality of monitors further includes a third monitor which has a different authority from the first authority and the second authority,
the third monitor is accessible to the first monitor and the second monitor, and
the first monitor and the second monitor are inaccessible to the third monitor.
10. The monitoring system according to claim 9 , wherein
the first monitor is a virtual environment monitor that monitors a virtual environment in the virtualization system,
the second monitor is a request monitor that monitors a request from the virtual environment to a virtualization infrastructure in the virtualization system, and
the third monitor is a virtualization infrastructure monitor that monitors the virtualization infrastructure in the virtualization system.
11. The monitoring system according to claim 9 , wherein
the first monitor is provided in a first virtual environment in the virtualization system,
the second monitor is provided in a second virtual environment in the virtualization system,
the third monitor is provided in an operating system (OS) that performs security-related processing for a virtualization infrastructure in the virtualization system,
the second virtual environment is accessible to the first virtual environment,
the first virtual environment is inaccessible to the second virtual environment,
the virtualization system is accessible to the OS, and
the OS is inaccessible to the virtualization system.
12. The monitoring system according to claim 7 , wherein
the first monitor is provided in a first virtual environment in the virtualization system,
the second monitor is provided in a second virtual environment in the virtualization system,
the second virtual environment is accessible to the first virtual environment, and
the first virtual environment is inaccessible to the second virtual environment.
13. The monitoring system according to claim 1 , wherein
when determining the state of the virtualization system, the processor weights each of the monitoring results from the plurality of monitors according to an authority of each of the plurality of monitors.
14. The monitoring system according to claim 13 , wherein
the processor preferentially uses the monitoring result of the monitor having the higher authority in the determining.
15. The monitoring system according to claim 1 , wherein
the processor determines that a first monitor of the plurality of monitors is in an anomalous state in response to a combination of a first monitoring result of a second monitor of the plurality of monitors and a second monitoring result of a third monitor of the plurality of monitors being anomalous.
16. The monitoring system according to claim 15 , wherein
the first monitor is accessible to the second monitor and the third monitor, and
at least the third monitor is inaccessible to the first monitor.
17. The monitoring system according to claim 1 , further comprising:
a secure operating system that performs that performs security-related processing for a virtualization infrastructure of the virtualization system,
wherein the virtualization infrastructure is accessible to the secure operating system, and
the secure operating system is inaccessible to the virtualization system.
18. The monitoring system according to claim 17 , wherein
the plurality of monitors includes a first monitor, a second monitor, a third monitor which include the different level of authorities,
the first monitor is a virtual environment monitor that monitors a virtual environment in the virtualization system,
the second monitor is a request monitor that monitors a request from the virtual environment to the virtualization infrastructure in the virtualization system,
the third monitor is a virtualization infrastructure monitor that monitors the virtualization infrastructure in the virtualization system
the secure operating system is inaccessible to the first monitor, the second monitor, and the third monitor,
the first monitor and the second monitor are inaccessible to the secure operating system, and
the third monitor is accessible to the secure operating system.
19. A monitoring system that monitors a virtualization system, the monitoring system comprising:
a processor; and
a memory including programs that, when executed by the processor, cause the processor to perform operations, the operations including:
monitoring, by a plurality of the programs, the virtualization system, each of the plurality of the programs having a different authority;
detecting, by at least one of the plurality of the programs, an anomaly in the virtualization system; and
determining a state of the virtualization system based on monitoring results from the plurality of the programs,
wherein each of the plurality of the programs includes different level of authorities, with a monitoring result of a program having a higher authority being given a higher priority for the determining.
20. A monitoring system that monitors a virtualization system, the monitoring system comprising:
a processor; and
a memory including a program that, when executed by the processor, causes the processor to perform operations, the operations including:
monitoring, as a hypervisor, the virtualization system;
monitoring, as a first virtual machine, the virtualization system;
monitoring, as a second virtual machine, the virtualization system;
detecting, by at least one of the hypervisor, the first virtual machine, or the second virtual machine, an anomaly in the virtualization system; and
determining a state of the virtualization system based on monitoring results from the hypervisor, the first virtual machine, and the second virtual machine,
wherein each of the hypervisor, the first virtual machine, and the second virtual machine has a different authority, and
each of the hypervisor, the first virtual machine, and the second virtual machine has a different level of authority, with a monitoring result of one of the hypervisor, the first virtual machine, and the second virtual machine having a higher authority being given a higher priority for the determining.