Virtual machine traffic monitoring method

Abstract

The present invention discloses a virtual machine traffic monitoring method and system. Firstly, a virtual machine comprising a monitoring module is started; a data packet capture module and a data cache module are deployed in a virtual machine monitor core; the data packet capture module copies a data packet passing a TCP/IP protocol stack according to a filtering mechanism, and stores the data packet to a cache of the data cache module; the data cache module forwards the data packet in the cache to the monitoring module; the monitoring module performs statistics analysis on the data packet, so as to monitor the traffic of the virtual machine. A problem that communication between virtual machines is not monitored due to virtualization of a server is solved, and communication between virtual machines on the same physical server and communication between the virtual machine and the external network of the server are monitored in a unified way.

Description

technical field [0001] The invention relates to server virtualization virtual machine flow monitoring, in particular to a virtual machine flow monitoring method and system on a physical server. Background technique [0002] Server virtualization can improve the utilization of computing resources and enhance the management flexibility of IT resources. Therefore, this technology has become an important technology in current data centers. However, after server virtualization, there are multiple virtual machines on the same physical server, and the communication between these virtual machines cannot be sensed by the monitoring system deployed outside the physical server. [0003] Existing methods are implemented through traffic redirection strategies, including two types, one is to redirect virtual machine traffic to a network device outside the server for monitoring and processing. Another type is to redirect the traffic of the virtual machine to a virtual machine on a virtual...

AI Technical Summary

Problems solved by technology

The advantage of the first method is that the existing monitoring resources can be used, but it is necessary to modify the network protocol driver or add new network hardware devices

The second type of method is relatively common, but relies on the configurability of virtual switches and lacks performance optimization capabilities. At the same time, the monitoring of communication traffic between virtual machines and the outside world can only be handled by external monitoring devices, lacking unified monitoring management capabilities