Patent ID: 8533382

Claim:
A method for identifying a memory page of a virtual machine that has been modified during a time interval, wherein the virtual machine is executing on a computer system comprising a processor supporting nested page tables that map guest physical addresses referenced by a guest operating system of the virtual machine to system physical addresses in a system memory of the computer system, the method comprising: halting execution of the virtual machine at the end of the time interval; scanning the nested page tables to identify a page table entry in the nested page tables that has been marked by the processor during the time interval to indicate a successful write operation to a memory page of the system memory corresponding to the page table entry, wherein said scanning is subdivided into a plurality of subtasks and each of the said subtasks is allocated to a parallel executing thread; unmarking the page table entry prior to initiating a subsequent time interval; and transmitting at least a portion of the memory page to a collector process executing on a second computer system.