Patent ID: 8849993

Claim:
An apparatus for rate limiting to control amounts of data in a passive network monitoring pipelined system, said apparatus comprising: at least one processor device; at least one memory element; a packet filter module, when executed by the at least one processor, to discard particular incoming packets and pass on non-discarded packets according to first rate limiting mechanism; a monitor, executed using the at least one processor device, receiving said non-discarded packets from said packet filter module, said monitor processing said non-discarded packets and outputting event data describing corresponding events, said monitor having a second rate limiting mechanism for discarding at least a portion of the event data, wherein non-discarded event data is passed on and comprises a first subset of event data; a logger module, when executed by the at least one processor, to discard at least a portion of the first subset of event data according to a third rate limiting mechanism, said logger module within a policy monitor module receiving said outputted corresponding events from said monitor wherein the non-discarded portion of the first subset of event data comprises a second subset of event data; and a reporting module, when executed by the at least one processor, to receive said second subset of event data from said logger module, wherein the second subset of event data describes a set of events, wherein the reporting module is further to combine said set of events with like events in a roll-up over a time interval or based on the hierarchy of objects to meet storage requirements based at least in part on a fourth rate limiting mechanism; wherein said first rate limiting mechanism discards particular packets on input when input packet rate exceeds a specified limit.