Patent ID: 7441042

Claim:
A computer implemented method for correlating network traffic with corresponding file input/output activity, the method comprising the steps of: intercepting system calls made by a kernel level fileserver to place work items in a system queue, a work item comprising a callback function provided by the kernel level fileserver and a context field, and the work item corresponding to a request to perform a file input/output operation; replacing a callback function of the work item with a proxy callback function; storing information concerning a thread that issued the request being addressed by the work item, the callback function, the context field and the proxy callback function; responsive to the proxy callback function being called by a system worker thread for performing the requested file input/output operation associated with the work item, the proxy callback function locating the stored information concerning the thread that issued the request being addressed by the work item; correlating the thread that issued the request with the system worker thread for performing the requested file input/output operation using the stored information; and correlating a remote request to perform the file input/output operation with the thread that issued the request being addressed by the work item.