Non-intrusive Virtual Systems Monitoring

In this thesis, I discuss why existing intrusive systems monitoring approaches are not a good fit for the modern virtualized cloud, and describe two alternative out-of-band solutions that leverage virtualization for better systems monitoring. My first solution employs Virtual Machine Introspection (VMI) to gain access to a VM's runtime state from the virtualization layer. I develop new VMI techniques to efficiently expose VM memory state from outside the VM boundary, which can be readily employed in existing cloud platforms as they are designed to operate with no new modifications or dependencies. While there exist a variety of other competing alternatives, their latency, overhead, complexity and consistency trade-offs are not clear. Thus, I begin my thesis with addressing this gap by organizing the various existing VMI techniques into a taxonomy based upon their operational principles, and performing a thorough exploration of their trade-offs both qualitatively and quantitatively. I further present a deep dive on VMI consistency aspects to understand the sources of inconsistency in observed VM state, and show marginal benefits for consistency with commonly employed VMI solutions despite their prohibitive overheads. Then, I present NFM (Near Field Monitoring)- a new approach that decouples system execution from monitoring by pushing monitoring components out of the target systems' scope. By extending and combining VMI with a backend cloud analytics platform, NFM provides simple, standard interfaces to monitor running systems in the cloud that require no guest cooperation or modification, and have minimal effect on guest execution. By decoupling monitoring and analytics from target system context, NFM provides always-on monitoring, even when the target system is unresponsive. My second solution- CIVIC (Cloning and Injection based VM Inspection and Customization)- avoids NFM's functionality duplication effort and overcomes its VMI-related limitations arising out of its raw memory byte level visibility into the guest. CIVIC operates at a logical OS level and reuses the vast stock monitoring software codebase, but in a separate isolated environment thus avoiding guest intrusion and interference hassles. CIVIC enables a broader usage scope in addition to NFM's passive (read-only) monitoring, by supporting actuation or on-the-fly introduction of new functionality. It restricts all impact and side-effects of such customization operations inside a live clone of the guest VM. New functionality over the replicated VM state is introduced using code injection. I present four applications built on top of NFM using its `systems as data' monitoring approach, to showcase its capabilities for across-systems and across-time analytics. I also highlight CIVIC's versatility in terms of enabling hotplugged and impact-free live customization, by employing it to monitor, inspect, troubleshoot and tune unmodified VMs.Ph.D