Preserving changes when reverting back to a snapshot
Disclosed is a method, system, and computer program product for preserving actions taken after a snapshot. One embodiment of the method may comprise capturing a snapshot of a virtualized container environment (VCE), the VCE comprising one or more applications-of-interest. The method may further comprise intercepting an event-of-interest directed to an application-of-interest within the VCE. The method may further comprise automatically storing the intercepted event in an action database. The method may further comprise, in response to a user instruction to revert the VCE to a prior snapshot, generating an automated script from the intercepted events, wherein the automated script comprises actions that occurred in the VCE after capture of the selected snapshot; and executing the automated script.
1. A method for preserving actions taken after a snapshot, comprising:
capturing a snapshot of a virtualized container environment (VCE), the VCE comprising a plurality of applications;
receiving a selection of one or more applications-of-interest from the plurality of applications from a user;
intercepting an event-of-interest directed to an application-of-interest within the VCE, wherein the intercepting occurs in response to the application-of-interest being in the selection of one or more applications-of-interest;
automatically storing the intercepted event-of-interest in an action database; and
in response to a user instruction to revert the VCE to a prior snapshot:
presenting intercepted events-of-interest that were stored to the user via a user interface, wherein one or more of the intercepted events-of-interest is a higher risk event that comprises changes by other applications to a file used by the applications-of-interest in the selection of one or more of the applications-of-interest;
receiving, via the user interface, a sub-selection of the intercepted events-of-interest that were stored to be replayed;
receiving, via the user interface, one or more modifications to the sub-selection of the intercepted events-of-interest that were stored;
modifying the sub-selection of intercepted events-of-interest that were stored based on the received one or more modifications, wherein the modifications comprise changes to one or more variables associated with at least one of the sub-selection of intercepted events-of-interest that were stored;
generating an automated script from the modified sub-selection of intercepted events-of-interest, wherein:
the automated script comprises a modified sub-selection of the sub-selection of intercepted events-of-interest that occurred in the VCE after capture of the selected snapshot; and
executing the automated script that replays events-of-interest in a same chronological order as the sub-selection of intercepted events-of-interest occurred in the VCE.
2. The method of claim 1 , further comprising receiving a user selection of a set of events-of-interest in the VCE that are directed to the one or more applications-of-interest, wherein the intercepting is further in response to the event-of-interest being in the user selection of the set of events-of-interest.
3. The method of claim 2 , wherein the set of events-of-interest further includes events taken by other applications that affect the applications-of-interest.
4. The method of claim 3 , wherein the events taken by other applications comprise events related to modifying a file used by one or more of the applications-of-interest.
5. The method of claim 1 , wherein the event-of-interest comprises results of a user interacting with one or more applications in the VCE.
6. The method of claim 1 , wherein the event-of-interest comprises a change in an operating system (OS) configuration.
7. The method of claim 1 , wherein intercepting the event-of-interest comprises defining one or more process handles and events associated with the application-of-interest.
8. The method of claim 1 , wherein intercepting the event-of-interest comprises monitoring instructions entering virtualized hardware drivers.
9. The method of claim 1 , further comprising detecting the event-of-interest by a trained neural network.
10. The method of claim 9 , further comprising:
receiving training data, wherein the training data comprises labeled event data for a plurality of VCEs, wherein at least some of the VCE in the labeled event data have previously crashed; and
training the neural network to automatically identify patterns of event timelines that are indicative of a future crash event, wherein the training comprises:
presenting the labeled event data to the neural network;
calculating, by the neural network, a probability score representing a chance that the VCE with crash in response to the event-of-interest; and
comparing the calculated probability score to the labeled data.
11. The method of claim 1 , further comprising highlighting one or more of the intercepted events-of-interest that were stored in a user interface as higher risk.
12. The method of claim 1 , further comprising intercepting an event-of-interest directed to a file-of-interest within the VCE.
13. A system for preserving actions taken after a snapshot, the system comprising:
one or more processors; and
a memory communicatively coupled to the one or more processors;
wherein the memory comprises instructions which, when executed by the one or more processors, cause the one or more processors to perform a method comprising:
capturing a snapshot of a virtualized container environment (VCE), the VCE comprising a plurality of applications;
receiving a selection of one or more applications-of-interest from the plurality of applications from a user;
intercepting an event-of-interest directed to an application-of-interest within the VCE, wherein the intercepting occurs in response to the application-of-interest being in the selection of one or more applications-of-interest;
automatically storing the intercepted event-of-interest in an action database; and
in response to a user instruction to revert the VCE to a prior snapshot:
presenting intercepted events-of-interest that were stored to the user via a user interface, wherein one or more of the intercepted events-of-interest is a higher risk event that comprises changes by other applications to a file used by the applications-of-interest in the selection of one or more of the applications-of-interest;
receiving, via the user interface, a sub-selection of the intercepted events-of-interest that were stored to be replayed;
receiving, via the user interface, one or more modifications to the sub-selection of the intercepted events-of-interest that were stored;
modifying the sub-selection of intercepted events-of-interest that were stored based on the received one or more modifications, wherein the modifications comprise changes to one or more variables associated with at least one of the sub-selection of intercepted events-of-interest that were stored;
generating an automated script from the modified sub-selection of intercepted events-of-interest, wherein:
the automated script comprises a modified sub-selection of the sub-selection of intercepted events-of-interest that occurred in the VCE after capture of the selected snapshot; and
executing the automated script that replays events-of-interest in a same chronological order as the sub-selection of intercepted events-of-interest occurred in the VCE.
14. A computer program product for preserving actions taken after a snapshot, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to perform a method comprising:
capturing a snapshot of a virtualized container environment (VCE), the VCE comprising a plurality of applications;
receiving a selection of one or more applications-of-interest from the plurality of applications from a user;
intercepting an event-of-interest directed to an application-of-interest within the VCE, wherein the intercepting occurs in response to the application-of-interest being in the selection of one or more applications-of-interest;
automatically storing the intercepted event-of-interest in an action database; and
in response to a user instruction to revert the VCE to a prior snapshot:
presenting intercepted events-of-interest that were stored to the user via a user interface, wherein one or more of the intercepted events-of-interest is a higher risk event that comprises changes by other applications to a file used by the applications-of-interest in the selection of one or more of the applications-of-interest;
receiving, via the user interface, a sub-selection of the intercepted events-of-interest that were stored to be replayed;
receiving, via the user interface, one or more modifications to the sub-selection of the intercepted events-of-interest that were stored;
modifying the sub-selection of intercepted events-of-interest that were stored based on the received one or more modifications, wherein the modifications comprise changes to one or more variables associated with at least one of the sub-selection of intercepted events-of-interest that were stored;
generating an automated script from the modified sub-selection of intercepted events-of-interest, wherein:
the automated script comprises a modified sub-selection of actions the sub-selection of intercepted events-of-interest that occurred in the VCE after capture of the selected snapshot; and
executing the automated script that replays events-of-interest in a same chronological order as the sub-selection of intercepted events-of-interest occurred in the VCE.