Network traffic data in virtualized environments

摘要

Approaches are described for collecting and/or utilizing network traffic information, such as network flow data, within a virtualized computing environment. The network traffic information can be collected on one or more host computing devices that host virtual machines. The collected network traffic information can include virtualized computing environment specific information, such as a user account identifier (ID), virtual machine identifier (ID), session termination information and the like. The collected network traffic information can also be presented to the user of the virtualized computing environment.

主权项

1. A computer implemented method for collecting data in a virtualized computing environment, said method comprising:
under the control of one or more computer systems configured with executable instructions,
providing, by a host computing device operated by a service provider, a virtual machine instance associated with a customer, wherein the virtual machine instance is hosted on a virtualization layer of the host computing device and the virtualization layer comprises a hypervisor operating in combination with a privileged domain;collecting, by an agent in the virtualization layer, network traffic data on the host computing device, the network traffic data including at least one record for each defined flow of network packets transmitted to or from the virtual machine instance on the host computing device;inspecting one or more of the network packets for a new source IP address and destination IP address combination;determining whether a new flow of network packets has begun, based on the inspection;adding service provider information to the collected network traffic data, the service provider information including session termination information related to a reason for termination of the defined flow of the network packets executed on the host computing device; andsending the network traffic data from the host computing device to a network data collector that is external with respect to the host computing device.