CN119961105A

CN119961105A - Information display method, device, equipment, storage medium and program product

Info

Publication number: CN119961105A
Application number: CN202411867367.3A
Authority: CN
Inventors: 胡威予
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2024-12-18
Filing date: 2024-12-18
Publication date: 2025-05-09

Abstract

The disclosure provides an information display method, which can be applied to the technical field of cloud computing, the technical field of distributed technology, the technical field of micro-services and the technical field of finance and technology. The information display method comprises the steps of monitoring kernel layer information of each container in a system in a cloud primary environment, responding to detection of abnormal kernel layer information from the monitored kernel layer information, determining a target container from the containers of the system based on the abnormal kernel layer information, obtaining target kernel layer information of the target container in a target period, analyzing the target kernel layer information to generate an abnormal detection result about the target container, updating node information in a system topological graph based on the abnormal detection result to obtain a first system topological graph, and displaying the first system topological graph on a visual interface. The present disclosure also provides an information presentation apparatus, a device, a storage medium, and a program product.

Description

Information display method, apparatus, device, storage medium, and program product

Technical Field

The present disclosure relates to the fields of cloud computing technology, distributed technology, micro-service technology, and financial technology, and in particular, to an information display method, apparatus, device, medium, and program product.

Background

Because of the popularity of distributed systems and microservices, different service modules may be developed by different programming languages, running on different cloud environments. The observability of the application performance monitoring software tool in the related art is mainly based on Metric, trace, and Log.

In the process of realizing the inventive concept, the inventor finds that the application performance monitoring software tool in the related technology is generally suitable for being applied to observability of certain specific scenes, provides limited support when facing complex service scenes and massive data, has the problems of more occupied resources, low user experience and the like, and is difficult to meet the demand for observability of a cloud primary system.

Disclosure of Invention

In view of the foregoing, the present disclosure provides an information presentation method, apparatus, device, medium, and program product.

According to a first aspect of the disclosure, an information display method is provided, which includes monitoring kernel layer information of each container in a system in a cloud native environment, determining a target container from the containers of the system based on the abnormal kernel layer information in response to detecting the abnormal kernel layer information from the monitored kernel layer information, acquiring target kernel layer information of the target container within a target period, wherein the target period is a period before a first acquisition time of the abnormal kernel layer information, analyzing the target kernel layer information to generate an abnormal detection result about the target container, updating node information in a system topology based on the abnormal detection result to obtain a first system topology, wherein nodes in the system topology are determined based on the containers in the system, the node information in the system topology is determined based on the kernel layer information of the containers in the system, edges in the system topology are determined based on call relations between the containers in the system, and displaying the first system topology in a visual interface.

According to the embodiment of the disclosure, monitoring kernel layer information of each container in a system in a cloud native environment comprises calling a preset kernel mode program, running in a kernel layer of the system in a daemon mode to monitor byte codes of kernel events of each container in the system, and generating the kernel layer information of each container based on the byte codes of the kernel events.

According to the embodiment of the disclosure, the kernel layer information of each container comprises different types of index information, the information display method further comprises the steps of filtering the kernel layer information of each container based on the index type information to obtain the index information of the target type of each container in response to receiving a display instruction carrying the index type information, updating the first system topological graph based on the index information of the target type to obtain the second system topological graph, and displaying the second system topological graph on a visual interface.

According to the embodiment of the disclosure, the monitored kernel-level information of N containers is stored in a storage space, the kernel-level information of each container is filtered based on the index type information in response to receiving a display instruction carrying the index type information to obtain the index information of the target type of each container, the method comprises the steps of calling a first preset user-state program in response to receiving the display instruction carrying the index type information, obtaining the kernel-state information of each container in a byte code form from the storage space, carrying out format conversion on the kernel-state information in the byte code form to generate the kernel-state information of an event format, and calling a second preset user-state program in response to receiving the display instruction carrying the index type information to filter the kernel-state information of the event format based on the index type information to obtain the index information of the target type.

According to the embodiment of the disclosure, the information display method further comprises the steps of calling a first preset user mode program, serializing kernel mode information of an event format to generate serialized kernel mode information, wherein data interaction is conducted between the first preset user mode program and a second user mode program based on a network programming interface, and calling the second preset user mode program to filter the kernel mode information of the event format based on index type information to obtain index information of a target type, wherein the method comprises the steps of calling the second preset user mode program, utilizing the network programming interface to receive the serialized kernel mode information, deserializing the serialized kernel mode information to obtain the kernel mode information of the event format, and filtering the kernel mode information of the event format based on the index type information to obtain the index information of the target type.

According to the embodiment of the disclosure, the number of the kernel layer information of the target container is M, M is a positive integer greater than 1, the target kernel layer information of the target container in the target period is obtained, the method comprises the steps of determining normal kernel layer information from the M kernel layer information, and determining the target period based on the first acquisition time and the second acquisition time of the normal kernel layer information.

According to the embodiment of the disclosure, the target kernel layer information comprises K index information, K is a positive integer greater than 1, the target kernel layer information is analyzed to generate an abnormality detection result related to a target container, the method comprises the steps of determining K pre-stored index information which is the same as the K index information in category from the pre-stored index information based on the K index information in the K index information, checking the K index information by utilizing the K pre-stored index information to obtain a K check result, and generating the abnormality detection result related to the target container based on the K check result.

The second aspect of the disclosure provides an information display device, which comprises a monitoring module, a determining module, an obtaining module and a first module, wherein the monitoring module is used for monitoring kernel layer information of each container in a system in a cloud native environment, the determining module is used for determining a target container from the containers of the system based on the abnormal kernel layer information in response to detection of the abnormal kernel layer information from the monitored kernel layer information, the obtaining module is used for obtaining the target kernel layer information of the target container in a target period, the target period is a period before a first acquisition time of the abnormal kernel layer information, the analyzing module is used for analyzing the target kernel layer information to generate an abnormal detection result related to the target container, the first updating module is used for updating node information in a system topology graph based on the abnormal detection result to obtain a first system topology graph, nodes in the system topology graph are determined based on the containers in the system, the node information in the system topology graph is determined based on the kernel layer information of the containers in the system, edges in the system topology graph are determined based on calling relations among the containers in the system, and the first module is used for displaying the first system topology graph in a visual display interface.

A third aspect of the present disclosure provides an electronic device comprising one or more processors and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method.

A fourth aspect of the present disclosure also provides a computer readable storage medium having stored thereon a computer program or instructions which, when executed by a processor, implement the steps of the above method.

A fifth aspect of the present disclosure also provides a computer program product comprising a computer program or instructions which, when executed by a processor, performs the steps of the method described above.

According to the embodiment of the disclosure, the kernel layer information of each container in the system under the cloud primary environment is monitored, so that the target container is determined from the containers of the system under the condition that the abnormal kernel layer information exists in the monitored kernel layer information, then the specific analysis is carried out based on all the kernel layer information of the target container in the target period, the abnormal detection result of the target container is obtained by correlating the time information with the kernel layer information, and the abnormal detection result is displayed through the first system topological graph, so that the resources required for processing the information are reduced, the information processing efficiency is improved, the accuracy of displaying the node abnormality of the container is improved, and the observability requirement of the cloud primary system can be met.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be more apparent from the following description of embodiments of the disclosure with reference to the accompanying drawings, in which:

FIG. 1 schematically illustrates an application scenario diagram of an information presentation method, apparatus, device, medium, and program product according to an embodiment of the present disclosure;

FIG. 2 schematically illustrates a flow chart of an information presentation method according to an embodiment of the present disclosure;

FIG. 3 schematically illustrates a schematic diagram of a first system topology according to an embodiment of the present disclosure;

FIG. 4 schematically illustrates a schematic diagram of a second system topology according to an embodiment of the present disclosure;

FIG. 5 schematically illustrates a diagram of sending kernel mode information according to an embodiment of the present disclosure;

FIG. 6 schematically illustrates a diagram of sending kernel mode information in an event format according to an embodiment of the present disclosure;

FIG. 7 schematically shows a block diagram of an information presentation apparatus according to an embodiment of the present disclosure, and

Fig. 8 schematically illustrates a block diagram of an electronic device adapted to implement the information presentation method according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is only exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques are omitted so as not to unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and/or the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein should be construed to have meanings consistent with the context of the present specification and should not be construed in an idealized or overly formal manner.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a convention should be interpreted in accordance with the meaning of one of skill in the art having generally understood the convention (e.g., "a system having at least one of A, B and C" would include, but not be limited to, systems having a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

In the technical solution of the present disclosure, the related user information (including, but not limited to, user personal information, user image information, user equipment information, such as location information, etc.) and data (including, but not limited to, data for analysis, stored data, displayed data, etc.) are information and data authorized by the user or sufficiently authorized by each party, and the related data is collected, stored, used, processed, transmitted, provided, disclosed, applied, etc. in compliance with relevant laws and regulations and standards, necessary security measures are taken, no prejudice to the public order colloquia is provided, and corresponding operation entries are provided for the user to select authorization or rejection.

In the scenario of using personal information to make an automated decision, the method, the device and the system provided by the embodiment of the disclosure provide corresponding operation inlets for users to choose to agree or reject the automated decision, and enter an expert decision flow if the users choose to reject. The expression "automated decision" here refers to an activity of automatically analyzing, assessing the behavioral habits, hobbies or economic, health, credit status of an individual, etc. by means of a computer program, and making a decision. The expression "expert decision" here refers to an activity of making a decision by a person who is specializing in a certain field of work, has specialized experience, knowledge and skills and reaches a certain level of expertise.

In implementing the inventive concepts of the present disclosure, the inventors have found that if there is no probe applying a performance monitoring software tool on a certain node of the cloud native environment, it is difficult for the application performance monitoring software tool to go deep into the node along Trace. Aiming at the problem, the script can be utilized for automatic detection, and the full coverage of the probe to the node can be ensured through automatic installation of the script. But this solution requires manual intervention to decide when the traffic can be restarted and when the data collected by the probe can be validated.

On the other hand, application performance monitoring software tools are difficult to uniformly track and interrupt in the face of cloud native environments developed by multiple development languages. For this, different agents (agents) may be used to address the problem for different programming languages. But agent agents in some programming languages have difficulty in implementing automated instrumentation, which can only be manually instrumented through a software development kit. Moreover, due to the different characteristics of the programming languages, it is difficult to ensure consistency between the data collected by the probes of different languages. The situation brings great pressure to the data integration analysis of the back end, and the user experience is difficult to be consistent. For example, there is a problem that the types of data indices in the respective languages are not uniform because the different languages correspond to different data indices.

In yet another aspect, the application performance monitoring software tool lacks kernel observability data. The related art observation method is difficult to solve the problems of the kernel layer in the cloud native environment, such as service jitter caused by domain name system performance, request sending jitter caused by service request performance of shared storage, and problems of suddenly slow code execution. In addition, for the kernel function execution statistical information and the kernel function execution result, in the related art, information is collected through a tool capable of interacting with the kernel and is output to a console for display, and no observability scheme for 7x24 hours operation is provided. The main reason is that the statistical information of kernel function execution and the information amount in kernel function execution result and time are large, and in the 7x24 hour operation process, the information is normal in most cases, and the storage of a large amount of information consumes more storage resources.

In view of the above, an embodiment of the present disclosure provides an information display method, which includes monitoring kernel layer information of each container in a system in a cloud native environment, determining a target container from the containers of the system based on the abnormal kernel layer information in response to detecting the abnormal kernel layer information from the monitored kernel layer information, acquiring target kernel layer information of the target container within a target period, wherein the target period is a period before a first acquisition time of the abnormal kernel layer information, analyzing the target kernel layer information to generate an abnormal detection result about the target container, updating node information in a system topology based on the abnormal detection result to obtain a first system topology, wherein nodes in the system topology are determined based on the containers in the system, node information in the system topology is determined based on the kernel layer information of the containers in the system, edges in the system topology are determined based on a call relationship between the containers in the system, and displaying the first system topology in a visual interface.

Fig. 1 schematically illustrates an application scenario diagram of an information presentation method, apparatus, device, medium and program product according to an embodiment of the present disclosure.

As shown in fig. 1, the application scenario 100 according to this embodiment may include a server 110, a system 120, and a terminal device 130. Wherein, the system 120 has a container 121_1 deployed therein.121_n, n being an integer greater than 1. The network is used as a medium to provide a communication link between the server 110, the system 120, and the terminal device 130, and may also be used as a medium to provide a communication link between the containers 121_1. The network may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

A user may interact with the server 110 or the system 120 over a network using the terminal device 130 to receive or send messages, etc. Various communication client applications may be installed on the terminal device, such as shopping class applications, web browser applications, search class applications, instant messaging tools, mailbox clients, social platform software, and the like (by way of example only).

Terminal device 130 may be a variety of electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop and desktop computers, and the like.

The server 110 may be a server providing various services, such as a background management server (by way of example only) providing support for websites browsed by the user using the terminal device 130. The background management server may analyze and process the received data such as the user request, and feed back the processing result (e.g., the web page, information, or data obtained or generated according to the user request) to the terminal device.

It should be noted that, the information presentation method provided in the embodiments of the present disclosure may be generally executed by the server 110. Accordingly, the information presentation apparatus provided by the embodiments of the present disclosure may be generally disposed in the server 110. The information presentation method provided by the embodiments of the present disclosure may also be performed by a server or a server cluster that is different from the server 110 and is capable of communicating with the system 120, the terminal device 130, and/or the server 110. Accordingly, the information presentation apparatus provided by the embodiments of the present disclosure may also be provided in a server or a server cluster that is different from the server 110 and is capable of communicating with the system 120, the terminal device 130, and/or the server 110.

It should be understood that the number of terminal devices, containers and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, containers, and servers, as desired for implementation.

The information display method of the disclosed embodiment will be described in detail with reference to fig. 2 to 6 based on the scenario described in fig. 1.

Fig. 2 schematically shows a flowchart of an information presentation method according to an embodiment of the present disclosure.

As shown in fig. 2, the information display method of this embodiment includes operations S210 to S260.

In operation S210, kernel-layer information of each container in the system in the cloud native environment is monitored.

In operation S220, in response to detecting abnormal kernel layer information from the monitored kernel layer information, a target container is determined from containers of the system based on the abnormal kernel layer information.

In operation S230, target kernel-layer information of the target container within a target period is acquired, wherein the target period is a period before a first acquisition time of abnormal kernel-layer information.

In operation S240, the target kernel layer information is analyzed to generate an anomaly detection result with respect to the target container.

In operation S250, based on the anomaly detection result, updating node information in the system topology map to obtain a first system topology map, where nodes in the system topology map are determined based on containers in the system, node information in the system topology map is determined based on kernel-level information of the containers in the system, and edges in the system topology map are determined based on calling relations between the containers in the system.

In operation S260, a first system topology map is presented at a visualization interface.

According to embodiments of the present disclosure, the system may be an operating system in a cloud native environment. The monitored kernel layer information may be stored in a memory space. The storage space may be a data structure created based on a direct memory mapping technique. The kernel layer information in the memory space may include, but is not limited to, kernel events on the container kernel, and the like. The kernel event in the memory space may be in the form of bytecode. Kernel events may include, but are not limited to, file transfer events, memory events, resource events, and the like. Based on this, the kernel layer information of each container may include index information of different dimensions. The dimensions may include, but are not limited to, a network dimension and a memory dimension. The index information of different dimensions may include bandwidth information, network speed information, byte count information of a network dimension, and memory usage information of a memory dimension.

According to an embodiment of the present disclosure, the exception kernel layer information may be kernel layer information including exception bytecodes. The exception bytecode may be, but is not limited to, bytecode that characterizes the container failure. The target container may be a container to which the exception kernel layer information belongs. The target period may be a period in which the target container fails. The target kernel layer information may be all kernel layer information of the target container within the target period. The anomaly detection result may be indicative of a fault condition of the target vessel. And under the condition that abnormal kernel layer information is detected, determining the abnormal probability of the target container. On this basis, by acquiring all kernel layer information of the target container in the target period and analyzing, whether the target container is actually faulty or not can be determined.

In accordance with embodiments of the present disclosure, probes may be constructed using scalable packet filter techniques. The probe includes a predetermined kernel mode program and a predetermined user mode program. The predefined kernel mode program may be used to collect kernel events on the container kernel to obtain kernel layer information of the container. The predetermined user state program may be used to analyze the collected information. For example, in the case of detecting the abnormal kernel layer information, a container to which the abnormal kernel layer information belongs may be determined as a target container having a failure probability, so that all the kernel layer information of the target container in a target period before the abnormal kernel layer information is generated may be obtained, and index information of each dimension in all the kernel layer information may be analyzed, so as to obtain an abnormal detection result. And under the condition that the abnormality detection result indicates that the target container is abnormal, updating the node information of the target container in the system topological graph by using the first prompt information, so as to prompt the abnormal condition of the target container. And under the condition that the abnormality detection result indicates that the target container is not abnormal, updating the node information of the target container in the system topological graph by using the second prompt information, so as to prompt the condition that the target container generates abnormal kernel layer information.

Fig. 3 schematically illustrates a schematic diagram of a first system topology according to an embodiment of the present disclosure.

As shown in fig. 3, the node identification of the container 301, the node identification of the container 302, the node identification of the container 303, and the node identification of the container 304 are included in the first system topology 300 of the embodiment. As indicated by the arrow pointing in the first system topology, container 301 can initiate a call to container 302, container 302 can initiate a call to container 303, container 303 can initiate a call to container 304, and container 304 can initiate a call to container 301. The container 301 is a container in which an abnormal condition exists, and is distinguished from other containers in the first system topology 300 by a different color, however, embodiments of the present disclosure are not limited thereto, and abnormal containers may be distinguished from other containers in the first system topology 300 by information such as a shape. In addition, in the embodiment of the present disclosure, the container 302 and the container 304 that have a call relationship with the container 301 may also be labeled together, so as to schematic the upstream and downstream containers of the abnormal container, so as to facilitate the analysis of the call link of the container by the user.

According to embodiments of the present disclosure, the predetermined kernel mode program may be based on the daemon controller being on an operating system where nodes of the cloud native environment are located. The daemon controller may ensure that a copy of the container is run on each node in the environment.

According to the embodiment of the disclosure, the preset kernel mode program is operated in the kernel layer of the system in a daemon mode, so that the kernel layer information of each container can be acquired without restarting the application, and no interference is caused to the service. And, since the predetermined kernel mode program operates at the kernel layer, the predetermined kernel mode program is independent of the programming language used by the monitored program. Therefore, the monitored program can be observed without any plug-in or change and restarting. On the basis, the types of index information acquired from each program are unified, so that the accuracy of information understanding by a user can be improved, and the user experience is improved.

According to the embodiment of the disclosure, the kernel layer information and the acquisition time of the kernel layer information can be stored in an associated mode. For example, the obtained kernel function execution statistics information, kernel function execution results and time information are stored in association. The kernel function execution statistical information may correspond to an index identifier in the index information, and the kernel function execution result may correspond to a specific index value in the index information. The index information corresponding to the abnormality detection result may be stored. Thus, in the case of observing information of the kernel layer for a long time, the method of the present disclosure can reduce the storage amount of information while ensuring the observation accuracy, since only index information corresponding to the abnormality detection result is stored, and thus can reduce the occupation of resources.

According to an embodiment of the present disclosure, the M kernel layer information may include abnormal kernel layer information and normal kernel layer information. The acquisition time of the normal kernel layer information may be located between the acquisition times of the abnormal kernel layer information. The range of the target period may be defined based on the first acquisition time of the abnormal kernel layer information and the second acquisition time of the normal kernel layer information so as to clarify the condition of each index information of the target container before the abnormal kernel layer information is generated.

According to the embodiment of the disclosure, the first acquisition time of the abnormal kernel layer information and the second acquisition time of the normal kernel layer information are used for determining the target time period when the abnormal condition of the target container occurs, so that the accuracy of determining the target time period is improved, the condition of each index information of the target container before the abnormal kernel layer information is generated can be determined based on all the kernel layer information of the target container in the target time period, and the accurate abnormal detection can be performed on the target container.

According to an embodiment of the present disclosure, a plurality of kinds of pre-stored index information may be included in the pre-stored index information. The index information may include an index identifier and an index value. The index information and the pre-stored index information, which are identical to each other, may be determined to be the same kind of information based on the index identification in the index information and the index identification in the pre-stored index information. The index value in the pre-stored index information may be a range. Based on this, it can be determined whether or not the index value in the index information belongs to the index value range of the pre-stored index information. If the result is not the result, the result that the characterization check is not passed is generated.

And generating an abnormal detection result representing that the abnormal condition exists in the target container when the number of the verification results representing that the verification is passed is larger than or equal to a preset value, and generating an abnormal detection result representing that the abnormal condition does not exist in the target container when the number of the verification results representing that the verification is passed is smaller than the preset value.

According to the embodiment of the disclosure, the verification results of various index information are obtained by respectively verifying the different kinds of index information, and then the abnormality detection is performed on the target container based on the verification results of the various index information, so that the accuracy of the abnormality detection is improved.

According to the embodiment of the disclosure, the display instruction can be used for enabling the visual interface to display the index information corresponding to the index type information. The index category information may include an index identification of a certain category. The kernel layer information of each container may be filtered according to the index identifier, so that only index information belonging to the same kind of index as the index identifier, i.e., index information of the target type, is reserved. Thus, the node information of each container in the first system topology can be updated according to the index information of the target type of each container, and the second system topology can be obtained.

Fig. 4 schematically illustrates a schematic diagram of a second system topology according to an embodiment of the present disclosure.

As shown in fig. 4, the node identification of the container 401, the node identification of the container 402, the node identification of the container 403, and the node identification of the container 404 are included in the second system topology 400 of the embodiment. As indicated by the arrow pointing in the first system topology, container 401 can make a call to container 402, container 402 can make a call to container 403, container 403 can make a call to container 404, and container 404 can make a call to container 401. The container 401 is a container in which an abnormal condition exists, and is distinguished from other containers in the second system topology 400 by a different color, however, embodiments of the present disclosure are not limited thereto, and abnormal containers may be distinguished from other containers in the second system topology 400 by information such as a shape in the present disclosure. Also, in the embodiment of the present disclosure, the memory usage information of each container may be respectively presented by the node identifier of the container 401, the node identifier of the container 402, the node identifier of the container 403, and the node identifier of the container 404. For example, the memory usage of container 401 is 10%, the memory usage of container 402 is 15%, the memory usage of container 403 is 13%, and the memory usage of container 404 is 17%. It should be understood that the memory usage shown here is only an example, and other index information may also be shown by the node identifier in this disclosure, which is not described herein.

According to the embodiment of the disclosure, under the condition that the display instruction carrying the index type information is received, the inner core layer information of each container can be filtered based on the index type information, only the index information of the target type corresponding to the index type information is reserved, and then the index information of the target type is displayed through the system topological graph, so that the observation scene is flexibly changed based on the requirement of a user, the flexibility of displaying the information is improved, and the user experience is improved.

Fig. 5 schematically illustrates a diagram of transmitting kernel mode information according to an embodiment of the present disclosure.

As shown in fig. 5, the first predetermined user mode program 521 and the predetermined kernel mode program 511 may communicate through a data structure for interaction between the user space 520 and the kernel space 510. For example, the data structure may include, but is not limited to, BPF (Berkeley PACKET FILTER ) Map, and the like. It should be noted that the second predetermined user mode program may also be located in the user space 520, which is not described herein.

Fig. 6 schematically illustrates a diagram of sending kernel mode information in an event format according to an embodiment of the present disclosure.

As shown in fig. 6, the first predetermined user mode program 521 may be used to call a BPF API (application programming interface ) to load the bytecode in kernel mode. The original event generated by the kernel is read and preprocessed, and the kernel mode information is converted into a standard event format and sent to the second predetermined user mode program 522. The first predefined user mode program 521 is further configured to provide a dynamic configuration channel, which is a channel for implementing filtering of kernel-level information by configuration. The data quantity of the kernel layer information and irrelevant data can be reduced through the channel. The second predefined user-state program 522 may filter the kernel-state information of the received event format based on the index category information received from the client, so that the user may subscribe to the kernel event of interest and based on the used scene extension analysis program.

According to the embodiment of the disclosure, the first preset user mode program is used for carrying out format conversion on the kernel mode information in the form of the byte codes, so that the kernel mode information in the event format is generated, the interference of redundant data is reduced, and the data quantity is reduced. And then, the second preset user mode program is called to filter the index information in the kernel mode information according to the index type, so that the kernel layer information acquired by the preset kernel mode program is displayed to a user in a simple mode, the accuracy and the efficiency of information display are improved, and the user experience is improved.

According to embodiments of the present disclosure, the network programming interface may be an interface (e.g., socket, etc.) that eliminates the need for data to pass through the network protocol stack. The first preset user mode program sequences the kernel mode information in the event format, and then the network programming interface is utilized to send the serialized kernel mode information to the second preset user mode program. The second preset user mode program deserializes the serialized kernel mode information, so that the kernel mode information of the event format can be obtained, and the kernel mode information of the event format is filtered. In the embodiment of the present disclosure, the second predetermined user mode program may be further configured to analyze the kernel mode information, thereby generating an anomaly detection result of the target container, update the system flowchart based on the anomaly detection result, and display the updated system flowchart, where the specific method is as described above and will not be described herein.

According to the embodiment of the disclosure, the network programming interface is utilized to realize data interaction between the first preset user mode program and the second preset user mode program, so that the quality of data transmission between the first preset user mode program and the second preset user mode program is improved.

Based on the information display method, the disclosure also provides an information display device. The device will be described in detail below in connection with fig. 7.

Fig. 7 schematically shows a block diagram of a structure of an information presentation apparatus according to an embodiment of the present disclosure.

As shown in fig. 7, the information presentation apparatus 700 of this embodiment includes a monitoring module 710, a determining module 720, an acquiring module 730, an analyzing module 740, a first updating module 750, and a first presentation module 760.

The monitoring module 710 is configured to monitor kernel-level information of each container in the system in the cloud-native environment. In an embodiment, the monitoring module 710 may be configured to perform the operation S210 described above, which is not described herein.

The determining module 720 is configured to determine, in response to detecting abnormal kernel layer information from the monitored kernel layer information, a target container from containers of the system based on the abnormal kernel layer information. In an embodiment, the determining module 720 may be configured to perform the operation S220 described above, which is not described herein.

The obtaining module 730 is configured to obtain target kernel-layer information of the target container within a target period, where the target period is a period before a first acquisition time of the abnormal kernel-layer information. In an embodiment, the obtaining module 730 may be configured to perform the operation S230 described above, which is not described herein.

The analysis module 740 is configured to analyze the target kernel layer information and generate an anomaly detection result about the target container. In an embodiment, the analysis module 740 may be configured to perform the operation S240 described above, which is not described herein.

The first updating module 750 is configured to update node information in a system topology map based on an anomaly detection result to obtain a first system topology map, where nodes in the system topology map are determined based on containers in the system, node information in the system topology map is determined based on kernel layer information of the containers in the system, and edges in the system topology map are determined based on calling relationships between the containers in the system. In an embodiment, the first updating module 750 may be used to perform the operation S250 described above, which is not described herein.

The first presentation module 760 is configured to present the first system topology map on the visualization interface. In an embodiment, the first display module 760 may be used to perform the operation S260 described above, which is not described herein.

According to an embodiment of the present disclosure, the monitoring module 710 includes a calling sub-module and a first generating sub-module. The system comprises a calling sub-module, a first generating sub-module and a second generating sub-module, wherein the calling sub-module is used for calling a preset kernel mode program and running in a kernel layer of the system in a daemon mode so as to monitor the byte codes of kernel events of each container in the system, and the first generating sub-module is used for generating kernel layer information of each container based on the byte codes of the kernel events.

According to an embodiment of the disclosure, the information display device further includes a filtering module, a second updating module, and a second display module. The system comprises a filtering module, a second updating module and a second display module, wherein the filtering module is used for responding to a display instruction carrying index type information, filtering the inner core layer information of each container based on the index type information to obtain the index information of the target type of each container, the second updating module is used for updating the first system topological graph based on the index information of the target type to obtain a second system topological graph, and the second display module is used for displaying the second system topological graph on a visual interface.

According to an embodiment of the disclosure, the filtering module includes a first invoking sub-module and a second invoking sub-module. The first calling submodule is used for calling a first preset user state program in response to receiving a display instruction carrying index type information, acquiring the kernel state information of each container in a byte code form from a storage space, converting the format of the kernel state information in the byte code form to generate the kernel state information in an event format, and the second calling submodule is used for calling a second preset user state program, filtering the kernel state information in the event format based on the index type information to obtain the index information of a target type.

According to an embodiment of the present disclosure, the first calling sub-module further includes a serialization unit. The second call submodule comprises a receiving unit, an anti-serialization unit and a filtering unit. The method comprises the steps of generating a first preset user mode program, a second preset user mode program, a serialization unit, a reverse serialization unit and a filtering unit, wherein the serialization unit is used for calling the first preset user mode program to serialize kernel mode information of an event format to generate serialized kernel mode information, the first preset user mode program and the second user mode program are used for carrying out data interaction based on a network programming interface, the receiving unit is used for calling the second preset user mode program to receive the serialized kernel mode information by utilizing the network programming interface, the reverse serialization unit is used for carrying out reverse serialization on the serialized kernel mode information to obtain the kernel mode information of the event format, and the filtering unit is used for filtering the kernel mode information of the event format based on index type information to obtain index information of a target type.

According to an embodiment of the present disclosure, the acquisition module 730 includes a first determination submodule and a second determination submodule. The first determining submodule is used for determining normal kernel layer information from M pieces of kernel layer information, and the second determining submodule is used for determining a target period based on the first collecting time and the second collecting time of the normal kernel layer information.

According to an embodiment of the present disclosure, the analysis module 740 includes a third determination sub-module, a verification sub-module, and a second generation sub-module. The third determining submodule is used for determining kth pre-stored index information which is the same as the kth index information in the types of the kth index information from the pre-stored index information based on the kth index information in the K index information, the checking submodule is used for checking the kth index information by utilizing the kth pre-stored index information to obtain a kth checking result, and the second generating submodule is used for generating an abnormality detection result related to the target container based on the K checking results.

Any of the monitoring module 710, the determining module 720, the obtaining module 730, the analyzing module 740, the first updating module 750, and the first presentation module 760 may be combined in one module to be implemented, or any of the modules may be split into a plurality of modules according to an embodiment of the present disclosure. Or at least some of the functionality of one or more of the modules may be combined with, and implemented in, at least some of the functionality of other modules. According to embodiments of the present disclosure, at least one of the monitoring module 710, the determining module 720, the obtaining module 730, the analyzing module 740, the first updating module 750, and the first presentation module 760 may be implemented at least in part as hardware circuitry, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system-on-chip, a system-on-substrate, a system-on-package, an Application Specific Integrated Circuit (ASIC), or as hardware or firmware in any other reasonable manner of integrating or packaging the circuitry, or as any one of or a suitable combination of three of software, hardware, and firmware. Or at least one of the monitoring module 710, the determining module 720, the obtaining module 730, the analyzing module 740, the first updating module 750 and the first presentation module 760 may be at least partially implemented as computer program modules which, when run, may perform the respective functions.

As shown in fig. 8, an electronic device 800 according to an embodiment of the present disclosure includes a processor 801 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 802 or a program loaded from a storage section 808 into a Random Access Memory (RAM) 803. The processor 801 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or an associated chipset and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), or the like. The processor 801 may also include on-board memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing the different actions of the method flows according to embodiments of the disclosure.

In the RAM 803, various programs and data required for the operation of the electronic device 800 are stored. The processor 801, the ROM 802, and the RAM 803 are connected to each other by a bus 804. The processor 801 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM 802 and/or the RAM 803. Note that the program may be stored in one or more memories other than the ROM 802 and the RAM 803. The processor 801 may also perform various operations of the method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

According to an embodiment of the present disclosure, the electronic device 800 may also include an input/output (I/O) interface 805, the input/output (I/O) interface 805 also being connected to the bus 804. The electronic device 800 may also include one or more of an input portion 806 including a keyboard, a mouse, etc., an output portion 807 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), etc., and a speaker, etc., a storage portion 808 including a hard disk, etc., and a communication portion 809 including a network interface card such as a LAN card, a modem, etc., connected to an input/output (I/O) interface 805. The communication section 809 performs communication processing via a network such as the internet. The drive 810 is also connected to an input/output (I/O) interface 805 as needed. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 810 as needed so that a computer program read out therefrom is mounted into the storage section 808 as needed.

The present disclosure also provides a computer-readable storage medium that may be included in the apparatus/device/system described in the above embodiments, or may exist alone without being assembled into the apparatus/device/system. The computer-readable storage medium carries one or more programs which, when executed, implement methods in accordance with embodiments of the present disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example, but is not limited to, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, the computer-readable storage medium may include ROM 802 and/or RAM 803 and/or one or more memories other than ROM 802 and RAM 803 described above.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowcharts. The program code means for causing a computer system to carry out the information presentation methods provided by the embodiments of the present disclosure when the computer program product is run on the computer system.

The above-described functions defined in the system/apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 801. The systems, apparatus, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the disclosure.

In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted, distributed, and downloaded and installed in the form of a signal on a network medium, and/or from a removable medium 811 via a communication portion 809. The computer program may comprise program code that is transmitted using any appropriate network medium, including but not limited to wireless, wireline, etc., or any suitable combination of the preceding.

In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 809, and/or installed from the removable media 811. The above-described functions defined in the system of the embodiments of the present disclosure are performed when the computer program is executed by the processor 801. The systems, devices, apparatus, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the disclosure.

According to embodiments of the present disclosure, program code for performing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, such computer programs may be implemented in high-level procedural and/or object-oriented programming languages, and/or assembly/machine languages. Programming languages include, but are not limited to, such as Java, c++, python, "C" or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that the features recited in the various embodiments of the disclosure may be combined and/or combined in various combinations, even if such combinations or combinations are not explicitly recited in the disclosure. In particular, features recited in various embodiments of the present disclosure may be combined and/or combined in various ways without departing from the spirit and teachings of the present disclosure. All such combinations and/or combinations fall within the scope of the present disclosure.

The embodiments of the present disclosure are described above. These examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the embodiments cannot be used advantageously in combination. Various alternatives and modifications can be made by those skilled in the art without departing from the scope of the disclosure, and such alternatives and modifications are intended to fall within the scope of the disclosure.

Claims

1. A method for information display, characterized in that the method comprises:

Monitor kernel layer information of each container in the system in a cloud-native environment;

In response to detecting abnormal kernel layer information from the monitored kernel layer information, determining a target container from containers of the system based on the abnormal kernel layer information;

Acquire target kernel layer information of the target container within a target time period, wherein the target time period is a time period before a first collection time of the abnormal kernel layer information;

Analyze the target kernel layer information to generate an abnormality detection result about the target container;

Based on the anomaly detection result, updating the node information in the system topology map to obtain a first system topology map, wherein the nodes in the system topology map are determined based on the containers in the system, the node information in the system topology map is determined based on the kernel layer information of the containers in the system, and the edges in the system topology map are determined based on the calling relationship between the containers in the system; and

The first system topology diagram is displayed on a visual interface.

2. The method according to claim 1, wherein monitoring kernel layer information of each container in a system in a cloud native environment comprises:

Invoke a predetermined kernel state program to run in the kernel layer of the system in a daemon process manner to monitor the bytecode of kernel events of each container in the system; and

Based on the bytecode of the kernel event, kernel layer information of each container is generated.

3. The method according to claim 1 or 2, characterized in that the kernel layer information of each container includes different types of indicator information;

The method further comprises:

In response to receiving a display instruction carrying indicator type information, filtering the kernel layer information of each container based on the indicator type information to obtain indicator information of a target type of each container;

Based on the indicator information of the target type, the first system topology map is updated to obtain a second system topology map; and

The second system topology diagram is displayed on the visualization interface.

4. The method according to claim 3, characterized in that the kernel layer information of the monitored N containers is stored in the storage space;

The step of filtering the kernel layer information of each container based on the indicator type information in response to receiving the display instruction carrying the indicator type information to obtain the indicator information of the target type of each container includes:

In response to receiving a display instruction carrying the indicator type information, calling a first predetermined user state program, obtaining kernel state information in bytecode form of each container from the storage space, and performing format conversion on the kernel state information in bytecode form to generate kernel state information in event format; and

A second predetermined user state program is called to filter the kernel state information in the event format based on the indicator type information to obtain the indicator information of the target type.

5. The method according to claim 4, characterized in that

The method further includes: calling the first predetermined user state program, serializing the kernel state information in the event format, and generating serialized kernel state information, wherein the first predetermined user state program and the second user state program perform data exchange based on a network programming interface; and

The calling of the second predetermined user state program, filtering the kernel state information in the event format based on the indicator type information to obtain the indicator information of the target type, includes: calling the second predetermined user state program, using the network programming interface to receive the serialized kernel state information; deserializing the serialized kernel state information to obtain the kernel state information in the event format; filtering the kernel state information in the event format based on the indicator type information to obtain the indicator information of the target type.

6. The method according to claim 1 or 2, characterized in that the kernel layer information of the target container is M, where M is a positive integer greater than 1;

The obtaining target kernel layer information of the target container within a target period includes:

Determine normal kernel layer information from the M kernel layer information; and

The target time period is determined based on the first collection time and the second collection time of the normal kernel layer information.

7. The method according to claim 1 or 2, characterized in that the target kernel layer information includes K types of indicator information, where K is a positive integer greater than 1;

The analyzing the target kernel layer information to generate an abnormality detection result about the target container includes:

Based on the kth indicator information among the K types of indicator information, determining the kth pre-stored indicator information of the same type as the kth indicator information from the pre-stored indicator information;

Verifying the k-th type of indicator information using the k-th type of pre-stored indicator information to obtain a k-th verification result; and

Based on the K verification results, an abnormality detection result about the target container is generated.

8. An information display device, characterized in that the device comprises:

The monitoring module is used to monitor the kernel layer information of each container in the system in the cloud native environment;

a determination module, configured to, in response to detecting abnormal kernel layer information from the monitored kernel layer information, determine a target container from the containers of the system based on the abnormal kernel layer information;

an acquisition module, configured to acquire target kernel layer information of the target container within a target time period, wherein the target time period is a time period before a first collection moment of the abnormal kernel layer information;

An analysis module, configured to analyze the target kernel layer information and generate an abnormality detection result about the target container;

a first updating module, configured to update node information in a system topology map based on the anomaly detection result to obtain a first system topology map, wherein the nodes in the system topology map are determined based on containers in the system, the node information in the system topology map is determined based on kernel layer information of containers in the system, and the edges in the system topology map are determined based on call relationships between containers in the system; and

The first display module is used to display the first system topology diagram on a visual interface.

9. An electronic device, comprising:

one or more processors;

a memory for storing one or more computer programs,

It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, wherein the computer program or instruction, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that when the computer program or instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.