Patent ID: 8141149

Claim:
A system for monitoring events on a monitored computer, the system comprising: a first computer not accessible by a user of the monitored computer, the first computer comprising a processor and a first set of instructions executable by the processor, the first set of instructions comprising: a) instructions to receive a keyword; b) instructions to generate a regular expression that is satisfied by the keyword; c) instructions to generate at least one identifier corresponding to the keyword; d) instructions to generate a set of one or more one hash values corresponding to the keyword; e) instructions to create at least one package comprising the identifier and the one or more hash values; and f) instructions to transmit the regular expression and the package for reception by a software program executing on the monitored computer; and a software program executing on the monitored computer, the software program comprising a second set of instructions executable by the monitored computer, the second set of instructions comprising: aa) instructions to receive the regular expression and the package from the first computer; bb) instructions to identify a set of text at the monitored computer, the set of text being associated with an event; cc) instructions to evaluate the set of text against the regular expression to determine whether at least a portion of the set of text satisfies the regular expression; dd) instructions to generate a text hash from the at least a portion of the set of text, based on a determination that the at least a portion of the set of text satisfies the regular expression; ee) instructions to compare the text hash to at least one of the one or more hash values; ff) instructions to identify the event as an event requiring monitoring, based on a comparison of the text hash with the at least one hash value.