File observation method, electronic device, chip and program product

Abstract

The invention provides a file observation method, electronic equipment, a chip and a program product, in the method, path information of a file is recorded in an expanded BPF map in advance at a creation point of an index node inode of a target file, and when the target file needs to be observed, the path information of the file is recorded in the BPF map in advance. The corresponding path information can be obtained from the BPF map by using the identification information of the target file, so that the file is observed according to the path information, and important data support is provided for system tuning.

Description

Technical Field

[0001] The present application belongs to the field of kernel observation, and in particular relates to a file observation method, electronic equipment, chip and program product. Background Art

[0002] The Linux kernel has many modules and a complex implementation mechanism, so various logic or performance problems may occur during operation. For example, if the output of a function is inconsistent with the expected value, it is necessary to track the files or data of some key nodes to find the cause of the problem. Or if the system's response speed slows down, it may be necessary to find out the functions that take a long time to execute. The observability of the kernel is a key capability that supports the observation of the operating status of the system. When performing kernel observation, one of the important branches is to observe files. File-related observation indicators, such as file reading step length, file hot and cold, file pre-reading parameters, etc., are crucial to system tuning. Therefore, how to observe files is an issue that needs to be considered at present. Summary of the invention

[0003] The embodiments of the present application provide a file observation method, electronic device, chip and program product, which can record the path information of the file in the first Berkeley packet filter map (extended berkeley packet filter map, eBPFmap) in advance, so that the file can be observed according to the path information in the future, providing important data support for system tuning.

[0004] In a first aspect, a file observation method is provided, which is applied to an electronic device and specifically includes: After obtaining the first identification information corresponding to the first target file, the first path information corresponding to the first identification information is determined through the first BPF map, and finally the first target file is observed according to the first path information. The first identification information is used to uniquely identify the index node (inode) of the first target file, the target association relationship between the first identification information and the first path information is pre-recorded in the first BPF map, and the first path information is used to indicate the storage address of the first target file in the storage space of the electronic device.

[0005] In the above scheme, the electronic device stores the target association relationship between the first identification information and the first path information of the first target file in the first BPF map in advance, that is, maintains the above target association relationship in the first BPF map. When the first target file is to be observed, the first identification information is obtained, and the target association relationship is read from the first BPF map. Finally, the first path information corresponding to the first target file can be determined based on the first identification information and the target association relationship. In this scheme, the first path information of the first target file can be quickly determined directly through the pre-recorded target association relationship, thereby realizing file observation and providing data support for system tuning and security analysis. At the same time, this solution does not need to re-parse the file path, which can reduce the frequent access to the file path, thereby reducing the probability of lock conflicts, live locks, deadlocks and other problems. In addition, this solution can support recording the association relationship corresponding to any number of files (that is, the association relationship between the file identification information and the path information), without being limited by the number of trace points, so any number of files can be observed. That is to say, at any location observable by the kernel, when we need to observe a file, we only need to obtain the file identification information, and then we can determine the file path information through the first BPF map, which greatly increases the number of observable files, thereby improving the accuracy of file input / output (I / O) problem analysis.

[0006] In combination with the first aspect, in some possible implementations of the first aspect, before obtaining the first identification information corresponding to the first target file at the target observation position, the method also includes: recording the target association relationship in the first BPF map at the creation point of the inode.

[0007] In the above scheme, the process of creating an inode generates the first identification information and determines the storage location of the first target file (i.e., the first path information). At this time, the target association relationship between the first identification information and the first path information is stored in the first BPF map, which can ensure that the first path information can be captured as soon as possible at the moment of file creation, and can avoid to the greatest extent the situation where the target association relationship cannot be found from the first BPF map when the first target file needs to be observed.

[0008] In combination with the first aspect, in some possible implementations of the first aspect, after recording the target association relationship in the first BPF map, the method further includes: when the first target file is deleted or destroyed, continuing to maintain the target association relationship.

[0009] In the above scheme, the target association relationship is persistently maintained in the first BPF map. Since the first target file is dynamic in the system, it may be deleted or destroyed at any time. By persistently maintaining the target association relationship, even if the first target file is subsequently deleted, the first target file can still be analyzed and tracked according to the target association relationship maintained in the first BPF map, providing data support for system optimization and security analysis. In other words, when the first target file is deleted or destroyed, the electronic device continues to maintain the target association relationship in the first BPF map. This persistence mechanism can be implemented through a database or log file to ensure data integrity and traceability.

[0010] In combination with the first aspect, in some possible implementations of the first aspect, recording the target association relationship in the first BPF map includes: when the thread corresponding to the first target file is a preset thread, and / or when the process corresponding to the first target file is a preset process, recording the target association relationship in the first BPF map.

[0011] In the above scheme, it is also possible to record only the association relationships corresponding to some files in the first BPF map. That is to say, the association relationships corresponding to all files are not saved in the first BPF map, so that in most scenarios, the size of the first BPF map can be prevented from exceeding the preset warning value, and there is no need to perform the above-mentioned space recovery operation. In one example, files can be filtered by thread and / or process. For example, when the thread corresponding to a file is a preset thread, and / or when the process corresponding to a file is a preset process, the association relationship corresponding to the file is stored in the first BPF map. In other words, the scheme only focuses on files of specific threads and / or processes, thereby reducing unnecessary data collection and processing. Such a filtering mechanism can significantly improve the performance of the system, especially in a high-load environment.

[0012] For example, at the creation point of the inode of the first target file, the identifier of the thread corresponding to the first target file is queried (recorded as the first thread identifier). If the first thread identifier is the same as the preset thread identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map, otherwise the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0013] For another example, at the creation point of the inode of the first target file, the identifier of the process corresponding to the first target file (recorded as the first process identifier) ​​is queried. If the first process identifier is the same as the preset process identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map, otherwise the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0014] For another example: at the creation point of the inode of the first target file, the thread identifier (recorded as the first thread identifier) ​​and the process identifier (recorded as the first process identifier) ​​corresponding to the first target file are queried. If the first thread identifier is the same as the preset thread identifier, and the first process identifier is the same as the preset process identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map, otherwise the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0015] In combination with the first aspect, in some possible implementations of the first aspect, determining first path information corresponding to the first identification information through a first BPF map includes: reading a target association relationship from the first BPF map through a processing module, and the processing module is located in a user space of the electronic device; based on the target association relationship, determining the first path information corresponding to the first identification information through the processing module.

[0016] In combination with the first aspect, in some possible implementations of the first aspect, first path information corresponding to the first identification information is determined by a processing module, including: when the amount of data to be observed is greater than or equal to a preset threshold, the first path information corresponding to the first identification information is determined by the processing module, and the first target file is associated with the data to be observed.

[0017] In the above scheme, the processing module in the user space can be used to perform the path matching operation. And, in a further possible implementation, the target association relationship and the first path information can be read by the processing module only when the amount of data to be observed is greater than or equal to the preset threshold, wherein the first target file is associated with the data to be observed. It can be understood that if the amount of data to be observed is relatively large (such as greater than or equal to the preset threshold), if a module in the kernel space is used for path matching, it may affect the response speed of the kernel space, and in severe cases, it may cause the system of the electronic device to freeze or even crash, thereby affecting the user experience. The overhead size of the user space has a relatively weak impact on the user experience. Therefore, if the amount of data to be observed is relatively large, the software module in the user space (i.e., the processing module) is used for batch path matching, which can improve efficiency, reduce the occupancy of the kernel space, and improve the fluency of the system.

[0018] In combination with the first aspect, in some possible implementations of the first aspect, first path information corresponding to the first identification information is determined through a first BPF map, including: reading a target association relationship from the first BPF map through a kernel observation module, the kernel observation module being located in the kernel space of the electronic device; based on the target association relationship, determining the first path information corresponding to the first identification information through the kernel observation module.

[0019] In combination with the first aspect, in some possible implementations of the first aspect, the first path information corresponding to the first identification information is determined by the kernel observation module, including: when the amount of data to be observed is less than a preset threshold, the first path information corresponding to the first identification information is determined by the kernel observation module, and the first target file is associated with the data to be observed.

[0020] In the above scheme, the kernel observation module in the kernel space can also be used to perform path matching. In a further possible implementation, the target association relationship can be read and the first path information can be matched through the processing module only when the data volume of the data to be observed is less than the preset threshold. It can be understood that when the data volume of the data to be observed is relatively small (such as less than the preset threshold), even if a module in the kernel space (such as the kernel observation module) is used for path matching, it will not affect the response speed of the kernel space. Since the modules in the kernel space can directly access the kernel and file subsystems, path matching can be performed through the kernel observation module in the kernel space, which can improve the efficiency of path matching, realize real-time data tracking, and greatly improve the precision and accuracy of file I / O problem analysis.

[0021] In combination with the first aspect, in some possible implementations of the first aspect, obtaining first identification information corresponding to the first target file includes: obtaining the first identification information through a file structure and / or an inode structure corresponding to the first target file.

[0022] In the above scheme, the first identification information can be obtained through the file structure and / or inode structure corresponding to the first target file. Among them, the file structure and the inode structure are both important data structures in the Linux kernel. The file structure represents an open file instance, which contains the file status information, the pointer to the inode, and the file descriptor, etc.; and the inode structure is a structure used to store file metadata in the file system, including the file's permissions, size, creation time, modification time and other information. Since the file structure and the inode structure are basic data structures, the electronic device can easily obtain the first identification information, thereby providing a basis for executing subsequent steps.

[0023] In combination with the first aspect, in some possible implementations of the first aspect, multiple groups of association relationships are recorded in the first BPF map, and the multiple groups of association relationships include target association relationships. The method also includes: checking the multiple groups of association relationships in the first BPF map according to a first preset period; if there are at least two groups of association relationships in the first BPF map with the same first identification information, storing the at least two groups of association relationships in a second BPF map, and the second BPF map is different from the first BPF map.

[0024] In combination with the first aspect, in some possible implementations of the first aspect, after storing at least two sets of association relationships in a second BPF map, the method also includes: obtaining second identification information corresponding to the second target file, the second identification information being used to uniquely identify the inode of the second target file; determining second path information corresponding to the second identification information through the second BPF map, at least two sets of association relationships including an association relationship between the second identification information and the second path information; and observing the second target file through the second path information.

[0025] It is understandable that in a file system, as a large number of files are created and deleted, there may be a conflict in the identification information of two files. For example, after a file is deleted for a period of time, the system may assign its identification information to other files. At this time, it may appear that the identification information in two associations in the first BPF map is the same, that is, the keywords of two data items in the first BPF map are the same, and there is no complex conflict resolution mechanism in the BPF technology, which may cause errors in subsequent path matching. In order to minimize this risk, the above scheme provides a conflict handling mechanism, which supports transferring conflicting associations to an additional BPFmap (recorded as the second BPF map) to ensure that the data in the original first BPF map is not abnormal. For example, the electronic device can check the multiple groups of associations in the first BPF map according to the first preset period. For example, the multiple groups of associations in the first BPF map are checked every 30 seconds. In the case where the first identification information corresponding to at least two groups of associations in the first BPF map is the same, the at least two groups of associations are stored in the second BPF map, and the second BPF map is different from the first BPF map. That is, the electronic device maintains an additional second BPF map based on the first BPF map. If conflicting relationships are found (i.e., the identification information in two or more association relationships is the same), these conflicting association relationships are stored in the second BPF map and deleted from the first BPF map. In this way, the uniqueness of the identification information of each association relationship stored in the first BPF map can be ensured.

[0026] In combination with the first aspect, in some possible implementations of the first aspect, the method also includes: querying the size of the first BPF map according to a second preset period through an independent thread; when the first BPF map is greater than or equal to a preset warning value, checking whether the inode corresponding to the first target file still exists in the file system of the electronic device; when the inode still exists in the file system, deleting the target association relationship from the first BPF map; or, when the inode no longer exists in the file system, continuing to maintain the target association relationship in the first BPF map.

[0027] In the above scheme, when the size of the first BPF map exceeds the preset warning value, space recovery is performed. It can be understood that the first BPF map usually records multiple groups of associations (the association refers to the association between the path information and the identification information of the file to be observed), and the target association is only one of them. If there are more data to be observed, the information recorded in the first BPF map will become more and more, which may exceed the maximum value of the first BPF map set, thereby causing the subsequent new data recording to fail. In this case, a preset warning value can be set. If the size of the first BPF map exceeds the preset warning value, some associations need to be deleted to ensure that there is enough space in the first BPF map to record new information. In an example, some associations can be deleted according to a preset rule. For example, the preset rule is: if the inode of a file has not been deleted, the association corresponding to the file is deleted. That is to say, if the inode of a file has been deleted, the association corresponding to the file is retained. Because, if the inode of a file has been deleted, it is difficult to obtain the path information corresponding to the file by other means other than the first BPF map. If the association corresponding to the file is deleted from the first BPF map, it will be difficult to effectively observe the file later. On the contrary, if the inode of a file is not deleted, it is possible to query the path information of the file by other means other than the first BPF map, that is, even if the association relationship corresponding to the file is deleted from the first BPF map, there is a way to continue to observe the file, but the efficiency may be lower. For example, the complete path of the file can be queried according to the identification information of the file through the lsof command. For example, first set an independent thread, which is used to query the size of the first BPF map according to the second preset period, that is, regularly check the size of the first BPF map, for example, check the size of the first BPF map every 10 seconds. When the first BPF map is greater than or equal to the preset warning value, the independent thread traverses the first BPF map to query whether the inodes corresponding to the multiple groups of association relationships in the first BPF map exist. If the inodes corresponding to some association relationships do not exist, these association relationships continue to be saved; if the inodes corresponding to some association relationships still exist, these association relationships are removed from the first BPF map for space recovery. Take the first target file involved in the embodiment of the present application as an example: query the size of the first BPF map according to the second preset period by an independent thread. When the first BPFmap is greater than or equal to the preset warning value, it is checked whether the inode corresponding to the first target file still exists in the file system of the electronic device.If the inode still exists in the file system, the target association relationship is deleted from the first BPF map; or, if the inode no longer exists in the file system, the target association relationship continues to be maintained in the first BPF map.

[0028] In combination with the first aspect, in some possible implementations of the first aspect, observing the first target file according to the first path information includes: obtaining a file observation index corresponding to the first target file, the file observation index is used to tune the system performance of the electronic device, and the file observation index includes one or more of the following: the read step length of the first target file, or the hotness or coldness of the first target file, or the pre-reading parameters of the first target file, or the file page bumping of the first target file. In a second aspect, an electronic device is provided, including a memory and a processor, the memory stores a computer program that can be run on the processor, and when the processor executes the computer program, the electronic device implements the steps of the method described in any one of the first aspects above.

[0029] In a third aspect, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps of the method described in any one of the first aspects are implemented.

[0030] According to a fourth aspect, a computer program product is provided. When the computer program product is executed on an electronic device, the electronic device executes any one of the methods according to the first aspect.

[0031] In a fifth aspect, a chip system is provided, which includes a processor coupled to a memory, and the processor executes a computer program stored in the memory to implement any method described in the first aspect.

[0032] The chip system may be a single chip or a chip module composed of multiple chips.

[0033] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of a software structure of an operating system of an electronic device provided in an embodiment of the present application; Figure 2 A schematic diagram of the interaction of internal modules in the software architecture diagram provided in an embodiment of the present application; Figure 3 An exemplary flow chart of method 200 provided in an embodiment of the present application; Figure 4A statistical diagram of the number of thrashing times corresponding to different files in a practical application scenario is given.

[0035] Figure 5 Another interactive schematic diagram of the internal modules in the software architecture diagram provided in the embodiment of the present application; Figure 6 A hardware architecture diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0037] The embodiment of the present application provides a file observation method, which can be applied to electronic devices, such as mobile phones, tablet computers, desktop computers, laptop computers, handheld computers, notebook computers, ultra-mobile personal computers (UMPC), netbooks, augmented reality (AR) devices, virtual reality (VR) devices, artificial intelligence (AI) devices, wearable devices, vehicle-mounted devices, smart home devices and / or smart city devices, etc. The embodiment of the present application does not impose any special restrictions on the specific type of the electronic device.

[0038] An operating system runs on the electronic device. An operating system is a built-in program of an electronic device, which is used to cooperate with various hardware and software inside the electronic device, so that the electronic device deployed with the operating system can interact with the user, and the electronic device can be regarded as a computing resource instance running the operating system. Specifically, the operating system is part of the software in the electronic device, and is the first layer of software based on the hardware in the electronic device, serving as a bridge (or interface) for communication between the hardware and other software in the electronic device; the operating system can control the operation of other programs in the electronic device, manage the system resources of the electronic device, and provide the most basic computing functions (such as managing and configuring memory, determining the priority of system resource supply and demand, and providing some basic service programs, etc.). Among them, the operating system may include but is not limited to: Linux, Windows, Android (Android) and IOS, etc. For convenience, the embodiment of the present application is described by taking the Android operating system as an example, wherein the Android operating system is an operating system based on the Linux kernel.

[0039] Figure 1 A software structure diagram of the operating system of the electronic device 100 provided in the embodiment of the present application. Figure 1As shown, the present application divides the Linux system into a user space 101 (user space may also be referred to as a user layer), a kernel space 102 (kernel space may also be referred to as a kernel layer) and a hardware layer 103 from top to bottom.

[0040] Among them, both user space 101 and kernel space 102 belong to virtual memory in the operating system, which is the memory space virtualized by the operating system for a process, providing an independent and private memory space for the process. The hardware layer 103 includes various hardware devices, such as memory, etc. Among them, the process mentioned above is a running activity of a program in an electronic device on a certain data set, which is the basic unit for resource allocation and scheduling of the system and the basis of the operating system structure. In simple terms, a process can be understood as a program running in an operating system; for example, when an electronic device opens and runs a game application, a process needs to be started for the operation of the game to achieve the successful operation of the game through the process. In addition, a thread is an entity of a process, a basic unit for CPU scheduling and dispatching, and a basic unit that can run independently and is smaller than a process.

[0041] The user space 101 is a virtual concept relative to the kernel space 102. It refers to the environment that the user can see and operate when using the electronic device 100, including the command line interpreter, file system, application program, system library and configuration file, etc. It is the environment for running application programs, and the space that supports users to create, delete and modify files and directories, etc. In one example, the user space 101 is composed of the system runtime layer, the application framework layer, etc., including application programs, library functions and shells, etc. The kernel space 102 and the user space 101 of the system can be connected through the system call (syscall).

[0042] The kernel space 102 is the core of the operating system, responsible for managing the hardware and software resources of the operating system and controlling the operation of the hardware and software of the operating system. The kernel space provides various system services and resource management functions, such as process management, memory management, device drivers and file systems.

[0043] Please read further Figure 2 :The kernel is the first layer of software expansion based on the hardware layer 103 in the kernel system, which is used to provide the most basic functions of the operating system and is the basis for the operation of the operating system. The kernel is generally responsible for process scheduling and management, thread scheduling and management, file system management, memory management, device driver management, and network system management.

[0044] The kernel can control the hardware resources of the computer and provide a standard interface for the devices in the hardware layer 103 (such as processors, memories, disks, printers, etc.) through the hardware abstraction layer (HAL). Among them, the hardware abstraction layer is a hardware interface layer abstracted from a specific hardware platform, which is responsible for realizing the functions and control of the specific hardware platform, and at the same time provides a unified API interface for other software modules. Specifically, the hardware abstraction layer can abstract the commonality of hardware operation and control, hide the hardware interface details of a specific platform, and provide a unified virtual hardware platform and control interface to the upper-level software to achieve isolation of other software modules from the underlying hardware, thereby facilitating the transplantation of the system on a new hardware platform.

[0045] The kernel space 102 also includes a file subsystem. It is understandable that in a computer system, a series of operations need to be performed on executable program code segments and resource files during program execution. For example, data is read from a storage device into memory (such as a read operation), and data that needs to be persisted is written back to the storage device (such as a write operation). These operations are implemented in different IO requests within the system. Specifically, the Linux system manages memory in units of pages, and different operations (such as the above-mentioned read operations or write operations) can be implemented by initiating different IO requests through different threads. Specifically, the file read and write module in the user space 101 can perform read operations or write operations on file pages through the file subsystem in the kernel space 102, wherein the file subsystem may include a directory entry cache (dentry cache, dcache), a page cache (page cache, pcache), a file system (Filesystem), a block (block), etc. The file system and the page cache are used to manage cached file pages and temporarily store file data; the file read and write module may be a software module in an application. In a specific example, a thread in an application can trigger an IO request to the file subsystem through a file read / write module to request data processing, such as reading or writing data. When the file subsystem receives an IO request and starts an IO operation, it can submit a BIO structure to the block. For example, the file system layer can submit a BIO structure to the block by calling submit_bio. The BIO structure is a data structure of the IO request of the block, and the BIO structure represents an IO operation in progress. The block can provide a variety of interfaces for processing IO requests. The block includes an IO scheduler (IOScheduler), which is used to manage the request queue of IO requests. It can determine the order of the requests in the queue and when to dispatch the requests. The IO scheduler can convert the received BIO into a message of a request structure and send the message to the device driver. The device driver is an interface between the IO system and related hardware, and is used to drive the corresponding hardware device. The device driver includes, for example, a memory driver, a camera driver, a processor driver, a display driver, an audio driver, etc. The device driver can convert the received request into an IO command, and instruct the device of the hardware layer 103 to perform the corresponding IO operation through the cmd.

[0046] Kernel observability is the core of system performance tuning and security debugging. Kernel observability can also be called kernel traceability, which refers to the feature of obtaining the internal running state or execution status of the kernel by making points in the kernel. Through kernel observability, the kernel behavior or state such as process scheduling, memory management, and file types read and written can be obtained, which can help developers diagnose performance bottlenecks, locate the root cause of failures, and optimize system behavior.

[0047] Therefore, one of the important branches in the kernel observation task is the observation task for kernel-related files. In the embodiment of the present application, file observation refers to the detection of characteristics or parameters related to the target file based on preset file observation indicators. For example, the read step length, file hotness and coldness, file pre-reading parameters, etc. of the target file are detected based on preset file observation indicators, so as to perform system performance tuning or system security debugging according to these parameters. Among them, the target file involved in the embodiment of the present application refers to the file to be observed, or the file associated with the data to be observed (such as the file read by the data to be observed); the above-mentioned file observation indicators are used to indicate which characteristics or parameters of the target file are detected. The file observation indicators can be pre-configured or temporarily set by developers or users. The present application does not limit the specific content of the file observation indicators.

[0048] Please continue reading Figure 2 In a possible example provided in the embodiment of the present application, the kernel observation module in the kernel space 102 can be used to observe the kernel and the file subsystem, and the processing module in the user space 101 can be used to process the relevant observation data. However, when performing kernel observation, it is often difficult to directly observe the file due to the complexity of data synchronization and the difficulty in obtaining the file path. Therefore, how to perform file observation is a problem that needs to be considered at present.

[0049] In view of the above problems, an embodiment of the present application provides a file observation method, which can conveniently obtain the file path of a target file, so that the target file can be observed through the file path.

[0050] In a possible implementation (referred to as Solution 1), the file path of the target file is obtained layer by layer through directory analysis. It can be understood that the file path of a file is usually composed of multiple layers of directory names, and different path names can be separated by " / ", and the outermost layer is the root directory. For example, assuming that the file path of the target file is "home / user / documents / ", "home / " is the root directory of the target file, and "documents / " is the last level directory where the target file is located.

[0051] In this implementation, the names of the target file's directories are obtained layer by layer through hierarchical iteration from the inside out. That is, the last directory name of the target file is obtained through directory analysis first, and then analyzed layer by layer outward until the root directory (root) where the target file is located is found. The following is a possible execution code: while(dentry !root->dentry&mnt->mnt !root->mnt){ const struct dentry *parent READ_ONCE (dentry->d_parent); / / This means to analyze the directory and get the directory names layer by layer until the root is found … prefetch(parent); if (!prepend_name(p, &dentry->d_name)) break; dentry parent; } However, due to issues such as directory entry caching and file lifecycle, the file system uses a complex lock dependency structure and runtime checks. For details, see the following example: char *d path (const struct path *path, char *buf, int buflen) rcu_read_lock(); / / This represents the first layer of read-copy update (rcu) lock get_fs_root_rcu(current->fs,&root); / / This represents the second layer of sequential lock (read_segcount_begin) if (unlikely (d_unlinked (path->dentry))) / / This means that the file may be destroyed at any time prepend(&b,"(deleted)",11); prepend_path(path,&root,&b); rcu_read_lock(); / / This represents the third layer of rcu lock read_seqbegin_or_lock(&mount_1ock,&m_seq); / / This represents the fourth level sequence lock As can be seen from the above example, the lock dependency structure in the file system is complex. Therefore, when performing directory analysis in the kernel, it is easy to encounter problems such as lock conflicts, live locks, dead locks, hungry tasks, and use after free (UAF) memory usage.

[0052] In another possible implementation (denoted as Solution 2), the file path can be obtained based on an extended Berkeley packet filter (eBPF).

[0053] eBPF is a technology that allows user-written programs to run in the Linux kernel without modifying the kernel code or loading kernel modules. In short, eBPF makes the Linux kernel programmable, and it can be used to safely and efficiently extend the functionality of the kernel without changing the kernel source code or loading kernel modules.

[0054] In this implementation, eBPF technology is used to perform points at any location in the kernel, that is, to insert software code to obtain the kernel execution status, such as obtaining the path information of the target file. For example, multiple trace points can be defined in eBPF, and these trace points allow the eBPF program to be executed when specific events occur in the kernel. In other words, the eBPF program can be similar to adding a listener to the kernel. When a preset event (such as system call, file reading and writing, function entry / exit, network event, etc.) occurs, the corresponding eBPF program will be triggered and executed. In this way, eBPF can flexibly expand kernel functions without affecting kernel stability, and realize various purposes such as performance monitoring, security protection, and network packet filtering. The following is an example of defining multiple trace points in an eBPF program: BPF_CALL_3 (bpf_d_path, struct path *path, char *buf, u32, sz) { … p = d_path(©,buf,sz); … } BTF_SET_START(btf_allowlist_d_path) #ifdef CONFIG SECURITY BTF_ID (func, security_file_permission) / / trace point 1 BTF_ID (func, security_inode_getattr) / / trace point 2 BTF_ID (func, security_file_open) / / trace point 3 #endif #ifdef CONFIG SECURITY PATH BTF_ID (func, security_path_truncate) / / trace point 4 #endif BTF_ID (func, vfs_truncate) / / trace point 5 BTF_ID (func, vfs_fallocate) / / trace point 6 BTF_ID (func, dentry_open) / / trace point 7 BTF_ID (func, vfs_getattr) / / trace point 8 BTF_ID(func, filp_close) / / trace point 9 BTF_SET_END (btf_allowlist_d_path) From the above example, it can be seen that although the path of the target file can be easily obtained through eBPF technology, the file path is only allowed to be obtained at 9 trace points at most, and the remaining locations cannot be accurately observed, which seriously affects the accuracy of file I / O problem analysis.

[0055] In another possible implementation (denoted as Option 3), with the help of eBPF technology, the target association relationship between the identification information of the target file and the corresponding path information is recorded in the BPF map in advance. When the target file needs to be observed, the target association relationship can be directly read from the BPF map, and the path information of the target file can be determined based on the target association relationship, so that the target file can be observed. In this way, frequent access to the file path can be reduced, thereby reducing the probability of lock conflicts, livelocks, deadlocks and other problems. At the same time, it can also support the acquisition of path information of any number of files, that is, any number of files can be observed, thereby improving the accuracy of file I / O problem analysis. The following is combined with Figure 3 Method 200 in the figure exemplifies the specific implementation process of this possible implementation method.

[0056] S210: Obtain first identification information corresponding to the first target file.

[0057] Exemplarily, when it is determined that the first target file is to be observed, first identification information corresponding to the first target file is obtained.

[0058] The first target file is used to represent any file to be observed, and a file is a collection of information using the storage space of an electronic device as a carrier.

[0059] The first identification information is used to uniquely identify the index node inode of the first target file.

[0060] Inode is a data structure used to store file meta information in the Linux file system. It is a core data structure of a file. Each file has a corresponding inode. All file information except the file name is stored in the inode, such as the number of file bytes, the file owner, the identifier of the group to which the file belongs (Group ID), the timestamp of the file, etc. In other words, one file usually corresponds to one inode, so the first identification information can also be used to uniquely identify the first target file, that is, the first identification information can be used to identify and identify the first target file within the file system. As an example, the first identification information can be recorded as i_ino, or as inode id.

[0061] The present application does not limit the timing when the electronic device triggers observation of the first target file.

[0062] As an example, when a specific event for the first target file occurs in the data to be observed, such as opening the first target file, the electronic device determines to observe the first target file. It can be understood that the data to be observed here refers to any line of kernel code to be observed selected by the developer or user, or any line of code at the target observation position, and the data to be observed is associated with the first target file, that is, the data to be observed performs operations on the first target file, such as reading, writing, or deleting and modifying operations.

[0063] When creating the inode of the first target file, the first identification information corresponding to the first target file is also generated. Therefore, when determining to observe the first target file, the first identification information can be easily obtained. For example, the first identification information can be obtained through the file structure and / or inode structure corresponding to the first target file. Among them, the file structure and the inode structure are both important data structures in the Linux kernel. The file structure represents an open file instance, which contains the file status information, a pointer to the inode, and a file descriptor, etc.; and the inode structure is a structure used to store file metadata in the file system, including information such as the file's permissions, size, creation time, and modification time.

[0064] An example of an inode structure is as follows: struct inode { umode_t i_mode; … / / Dynamically allocate the first identification information of the first target file (hereinafter i_ino represents the first identification information) unsigned longi_ino; … } As can be seen from the above, the inode structure includes the first identification information, so the first identification information of the first target file can be directly obtained from the inode structure.

[0065] An example of a file structure is as follows: struct file { / / Only save 1 layer of file name / directory struct path f_path; / / Cached data can be obtained without lock struct inode *f_inode; … } As can be seen from the above, the file structure includes a pointer to the inode structure, so the inode structure can be found according to the pointer, thereby obtaining the first identification information in the inode structure.

[0066] Since the file structure and the inode structure are basic data structures, the electronic device can easily obtain the first identification information, thereby providing a basis for executing subsequent steps.

[0067] S220. Determine first path information corresponding to the first identification information through a first BPF map.

[0068] Exemplarily, after acquiring the first identification information, first path information corresponding to the first identification information is determined, wherein the first path information is used to indicate a storage address of the first target file in a storage space of the electronic device.

[0069] In one implementation, the electronic device stores the target association relationship between the first identification information and the first path information in the first BPF map in advance. For example, in step S211, at the creation point of the inode (i.e., when the inode is created, or after the inode is created), or when the first target file is opened, the target association relationship between the first identification information and the first path information is recorded in the first BPF map. A specific example is given below: struct file *do_filp_open(int dfd,struct filename *pathname, conststruct open_flags *op) { struct nameidata nd; int flags op->lookup_flags; struct file *filp; set nameidata(&nd, dfd, pathname, NULL); filp path_openat(&nd, op, flags LOOKUP_RCU); if (unlikely(filp =ERR_PTR(-ECHILD)))filp path_openat(&nd,op,flags); if (unlikely(filp =ERR_PTR(-ESTALE)))filp path_openat(&nd,op,flagsLOOKUP_REVAL); restore_nameidata(); return filp; } It should be noted here that the process of creating an inode will generate the first identification information and determine the storage location of the first target file (that is, the first path information). At this time, the target association relationship between the first identification information and the first path information is stored in the first BPF map, which can ensure that the first path information can be captured as soon as possible at the moment of file creation, and can avoid to the greatest extent the situation where the target association relationship cannot be found from the first BPF map when the first target file needs to be observed.

[0070] It is understandable that when opening the first target file, if the inode of the first target file has not been created, the creation of the inode of the first target file is triggered first. Therefore, when opening the first target file, the above target association relationship can also be recorded in the first BPF map.

[0071] In addition, BPF map can also be called eBPF map, which is a set of mapping relationships. BPF map is a mechanism provided by eBPF technology to support data sharing between kernel space and user space. It allows eBPF programs to store and retrieve data in kernel space, and can also access and modify these data through user-mode tools. BPF map supports a variety of data structures, such as hash tables, arrays, queues, etc., which can meet the data storage and retrieval requirements in different scenarios. It can be seen that BPF map can be used to realize two-way data exchange between kernel eBPF programs and user applications, and is an important basic data structure in eBPF technology. Therefore, storing the above-mentioned target association relationship in the first BPF map can facilitate the software modules in user space and kernel space to obtain the target association relationship, thereby providing technical support for the execution of subsequent solutions.

[0072] In an optional solution, the life cycle of the first BPF map can be managed. For example, the life cycle of the first BPF map is set to be from the beginning to the end of the trace, that is, the first BPF map is generated after the kernel observation starts, and the first BPF map is cleared after the kernel observation ends. In this way, the first BPF map can play a role in the entire kernel observation cycle, and the maintenance time of the first BPF map can be reduced to save resources.

[0073] It is understandable that step S220 can be executed by a software module inside the electronic device, and the present application does not limit the location of the software module, that is, the software module can be located in the user space of the electronic device or in the kernel space of the electronic device.

[0074] by Figure 2 Take the software architecture diagram in as an example: In one possible implementation, the processing module in the user space 101 can be used to execute step S220. In this implementation, step S220 includes: reading the target association relationship from the first BPFmap through the processing module, and the processing module is located in the user space of the electronic device; based on the target association relationship, determining the first path information corresponding to the first identification information through the processing module. In a further possible implementation, the target association relationship can be read and the first path information can be matched through the processing module only when the amount of data to be observed is greater than or equal to a preset threshold, wherein the first target file is associated with the data to be observed.

[0075] It is understandable that if the amount of data to be observed is relatively large (such as greater than or equal to the preset threshold), if a module in the kernel space is used for path matching, it may affect the response speed of the kernel space, and in serious cases may cause the electronic device system to freeze or even crash, thereby affecting the user experience. The impact of the user space overhead on the user experience is relatively weak, so if the amount of data to be observed is relatively large, using the software module in the user space (i.e., the processing module) for batch path matching can improve efficiency, reduce the occupancy of the kernel space, and improve system fluency.

[0076] In another possible implementation, the kernel observation module in the kernel space 102 can also be used to execute step S220. In this implementation, step S220 includes: reading the target association relationship from the first BPF map through the kernel observation module, and the kernel observation module is located in the kernel space of the electronic device; based on the target association relationship, determining the first path information corresponding to the first identification information through the kernel observation module. In a further possible implementation, the target association relationship can be read and the first path information can be matched through the processing module only when the amount of data to be observed is less than a preset threshold.

[0077] It is understandable that when the amount of data to be observed is relatively small (such as less than a preset threshold), even if a module in the kernel space (such as the kernel observation module) is used for path matching, it will not affect the response speed of the kernel space. Since the modules in the kernel space can directly access the kernel and file subsystems, path matching through the kernel observation module in the kernel space can improve the efficiency of path matching, realize real-time data tracking, and greatly improve the precision and accuracy of file I / O problem analysis.

[0078] Based on the above scheme, it can be known that the electronic device can store the target association relationship between the first identification information and the first path information of the first target file in the first BPF map at the creation point of the inode of the first target file, that is, maintain the above target association relationship in the first BPF map. When it is determined that the first target file is to be observed, the first identification information is obtained, and the target association relationship is read from the first BPF map. Finally, the first path information corresponding to the first target file can be determined based on the first identification information and the target association relationship. In this scheme, the first path information of the first target file can be quickly determined directly through the pre-recorded target association relationship. Compared with the above scheme one, this scheme does not need to re-parse the file path, which can reduce the frequent access to the file path, thereby reducing the probability of lock conflicts, live locks, deadlocks and other problems. In addition, this scheme can support recording the association relationship corresponding to any number of files (that is, the association relationship between the file identification information and the path information), without being limited by the number of trace points, so any number of files can be observed. That is to say, at any location observable by the kernel, when we need to observe a file, we only need to obtain the file identification information, and then we can determine the file's path information through the first BPF map. Compared with the above scheme two, the number of observable files is greatly increased, thereby improving the accuracy of file I / O problem analysis.

[0079] It is understandable that the present application does not limit the duration of maintaining the target association relationship in the first BPF map, and the target association relationship can be maintained persistently or cleared when needed, which is not limited by the present application. Several possible examples are given below.

[0080] Optionally, in a possible implementation, the target association relationship is persistently maintained in the first BPF map. Since the first target file is dynamic in the system, it may be deleted or destroyed at any time. By persistently maintaining the target association relationship, even if the first target file is subsequently deleted, the first target file can still be analyzed and tracked according to the target association relationship maintained in the first BPF map, providing data support for system optimization and security analysis. In other words, when the first target file is deleted or destroyed, the electronic device continues to maintain the target association relationship in the first BPF map. This persistence mechanism can be implemented through a database or log file to ensure data integrity and traceability.

[0081] Optionally, in another possible implementation, when the size of the first BPF map exceeds a preset warning value, space recovery is performed. It is understandable that the first BPF map usually records multiple sets of association relationships (the association relationship refers to the association relationship between the path information and identification information of the file to be observed), and the target association relationship is only one of them. If there is a lot of data to be observed, the information recorded in the first BPF map will become more and more, and may exceed the set maximum value of the first BPF map, resulting in the failure of subsequent new data recording. In this case, a preset warning value can be set. If the size of the first BPF map exceeds the preset warning value, some association relationships need to be deleted to ensure that there is enough space in the first BPF map to record new information.

[0082] In one example, some associations may be deleted according to a preset rule, for example, the preset rule is: if the inode of a file has not been deleted, the association corresponding to the file is deleted. That is, if the inode of a file has been deleted, the association corresponding to the file is retained. Because, if the inode of a file has been deleted, it is difficult to obtain the path information corresponding to the file by other means other than the first BPF map. If the association corresponding to the file is deleted from the first BPF map, it will be difficult to effectively observe the file later. On the contrary, if the inode of a file has not been deleted, it is possible to query the path information of the file by other means other than the first BPF map. That is, even if the association corresponding to the file is deleted from the first BPF map, there is a way to continue to observe the file, but the efficiency may be lower. For example, the complete path of the file can be queried according to the identification information of the file through the lsof command. For example, first set an independent thread, the independent thread is used to query the size of the first BPF map according to the second preset period, that is, regularly check the size of the first BPF map, for example, check the size of the first BPF map every 10 seconds. When the first BPF map is greater than or equal to the preset warning value, the independent thread traverses the first BPF map to query whether the inodes corresponding to the multiple groups of association relationships in the first BPF map exist. If the inodes corresponding to some association relationships do not exist, these association relationships continue to be saved; if the inodes corresponding to some association relationships still exist, these association relationships are removed from the first BPF map for space recovery. Taking the first target file involved in the embodiment of the present application as an example: the size of the first BPF map is queried according to the second preset period by an independent thread. When the first BPF map is greater than or equal to the preset warning value, check whether the inode corresponding to the first target file still exists in the file system of the electronic device. If the inode still exists in the file system, delete the target association relationship from the first BPF map; or, if the inode no longer exists in the file system, continue to maintain the target association relationship in the first BPF map.

[0083] Optionally, in a possible implementation, only the associations corresponding to some files may be recorded in the first BPF map. That is, the associations corresponding to all files are not saved in the first BPF map, so that in most scenarios, the size of the first BPF map can be prevented from exceeding the preset warning value, and there is no need to perform the above-mentioned space recovery operation. In one example, files can be filtered by thread and / or process. For example, when the thread corresponding to a file is a preset thread, and / or when the process corresponding to a file is a preset process, the association corresponding to the file is stored in the first BPF map. In other words, the scheme only focuses on files of specific threads and / or processes, thereby reducing unnecessary data collection and processing. Such a filtering mechanism can significantly improve the performance of the system, especially in a high-load environment.

[0084] For example, at the creation point of the inode of the first target file, the identifier of the thread corresponding to the first target file is queried (recorded as the first thread identifier). If the first thread identifier is the same as the preset thread identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map, otherwise the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0085] For another example, at the creation point of the inode of the first target file, the identifier of the process corresponding to the first target file (recorded as the first process identifier) ​​is queried. If the first process identifier is the same as the preset process identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map, otherwise the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0086] For another example: at the creation point of the inode of the first target file, the thread identifier (recorded as the first thread identifier) ​​and the process identifier (recorded as the first process identifier) ​​corresponding to the first target file are queried. If the first thread identifier is the same as the preset thread identifier, and the first process identifier is the same as the preset process identifier, the target association relationship corresponding to the first target file is recorded in the first BPF map, otherwise the target association relationship corresponding to the first target file is not recorded in the first BPF map.

[0087] It is understandable that in a file system, as a large number of files are created and deleted, there may be a conflict in the identification information of two files. For example, after a file has been deleted for a period of time, the system may assign its identification information to other files. At this time, it may appear that the identification information in two associations in the first BPF map is the same, that is, the keys of two data items in the first BPF map are the same, and there is no complex conflict resolution mechanism in the BPF technology, which may cause errors in subsequent path matching. In order to minimize this risk, an embodiment of the present application also provides a conflict handling mechanism, which supports the transfer of conflicting associations to an additional BPFmap (referred to as the second BPF map), and tries to ensure that the data in the original first BPF map is not abnormal.

[0088] For example, the electronic device can check the multiple groups of association relationships in the first BPF map according to the first preset period. For example, the multiple groups of association relationships in the first BPF map are checked every 30 seconds. In the case that the first identification information corresponding to at least two groups of association relationships in the first BPF map is the same, the at least two groups of association relationships are stored in the second BPF map, and the second BPF map is different from the first BPF map. That is, the electronic device maintains an additional second BPF map on the basis of the first BPF map. If conflicting relationships are found (that is, the identification information in two or more association relationships is the same), these conflicting association relationships are stored in the second BPF map and deleted from the first BPF map. In this way, the uniqueness of the identification information of each association relationship stored in the first BPF map can be ensured.

[0089] In the above example, the second BPF map records the conflicting association relationship. Subsequent electronic devices can use the first BPF map and the second BPF map at the same time for path matching. For example, when it is determined that the second target file is to be observed, the second identification information corresponding to the second target file is obtained, and the second identification information is used to uniquely identify the inode of the second target file. First, you can use the second identification information to search from the first BPF map. If the corresponding result is not retrieved, continue to search from the second BPF map. If there is an association relationship between the second identification information and the second path information in the second BPF map, the second path information can be determined as the path information of the second target file.

[0090] It is understandable that, since the second BPF map is used to store conflicting associations, two or more associations may be found when searching the second BPF map through the second identification information. At this time, the path information in all the associations found can be recorded and observed in turn; or the path information in one of the associations can be randomly selected for observation; or the path information in the association recorded the latest can be selected for observation, which is not limited in this application.

[0091] S230: Observe the first target file according to the first path information.

[0092] Exemplarily, after obtaining the first path information corresponding to the first target file, the first target file is observed according to the first path information. Specifically, the first target file can be observed according to the file observation index corresponding to the first target file, and the file observation index is used to tune the system performance of the electronic device, and the file observation index includes, for example, one or more of the following: the read step length of the first target file, or the hotness or coldness of the first target file, or the pre-reading parameters of the first target file, or the file page bumping of the first target file.

[0093] In summary, an embodiment of the present application provides a file observation method, which allows the path information of the target file to be obtained safely and accurately for file observation. This solution can not only reduce the probability of lock conflicts, livelocks, deadlocks and other problems, but also allow observation of any number of tracking points. In this solution, by using the unique identifier of the target file to match the corresponding path information, high-precision acquisition of path information can be achieved, and the overall level of kernel observability can be greatly improved, providing more powerful tool support for developers and operation and maintenance personnel.

[0094] For example, in an exemplary scenario, file page jitter may cause system cold start performance to deteriorate. The solution of the present application can accurately locate the specific path of the file that causes the cold start performance to deteriorate and produces jitter, so that performance optimization can be performed in a targeted manner. Figure 4 A statistical diagram of the number of thrashing times corresponding to different files in an actual application scenario is given. It should be understood that Figure 4 The horizontal axis represents different files (the numbers on the horizontal axis can be regarded as the identification of different files). Figure 4The vertical axis represents the number of filemapfaluts corresponding to the file, that is, the number of file bumps. The solid line in the figure is the statistical data under the overload state, and the dotted line in the figure is the statistical data under the unloaded state. According to the statistical data, the files to be observed can be determined. For example, the three files with the most bumps can be determined as the files to be observed. Based on the scheme provided in the embodiment of the present application, at the creation point of the inode corresponding to each file, the association relationship corresponding to each file (that is, the association relationship between the identification information and the path information of the file) has been stored in the BPF map in advance. After determining the file to be observed, according to the identification information of the file to be observed and the association relationship stored in the BPF map, the corresponding path information can be obtained by matching. The query results are shown in Table 1. In Table 1, in addition to the file name and path information (path), it also includes data such as the number of empty loads (count-empty), the number of heavy loads (count-heavy), the time consumed when the empty load (dur-empty), and the time consumed when the heavy load (dur-heavy) are included. These data can provide references when analyzing and processing the files to be observed, but these data are only used as examples in this application, and other types of data can also be used in actual scenarios.

[0095] Table 1

[0096] In addition, in an optional solution, the target association relationship of the target file is maintained by persistence, so that the path tracking capability of the file can be maintained even after the target file is deleted.

[0097] In another optional solution, by performing conflict management on the association relationship maintained in the first BPF map, the stability and performance of the system can be further improved.

[0098] Figure 4 A software architecture diagram for applying the solution of this application is shown below, which is briefly described below. Figure 4In the software architecture diagram shown, at the creation point of the inode of the first target file, the kernel observation module in the kernel space 102 is used as the execution subject to store the association relationship between the first path information and the first identification information of the first target file in the first BPF map. It can be understood that the data in the first BPF map is shared data between the user space and the kernel space. Therefore, when it is determined to observe the first target file, the kernel observation module or the processing module can obtain the target association relationship from the first BPFmap, and perform path matching based on the target association relationship, thereby obtaining the first path information of the first target file. Optionally, when the amount of data to be observed is relatively large, the processing module of the user space 101 can query the target association relationship and perform path matching, and when the amount of data to be observed is relatively small, the kernel observation module of the kernel space can query the target association relationship and perform path matching.

[0099] Corresponding to the methods provided in the above-mentioned method embodiments, the embodiments of the present application also provide corresponding electronic devices. Figure 6 A schematic structural diagram of an electronic device 300 provided in an embodiment of the present application is shown. The electronic device 300 includes: at least one processor 310 and at least one memory 320.

[0100] As an example, the storage 320 includes a memory and a hard disk, and data input, read, and stored are all carried out back and forth between them.

[0101] The memory may include random access memory (RAM), read-only memory (ROM), and cache memory (CACHE). The memory is the working place of the electronic device 300. Its task is to provide running space for the electronic device 300 and temporarily store data generated when the program is running. However, since the memory generally uses a semiconductor storage unit, the data is lost after power failure. In order to save the data, a storage device hard disk is needed whose data will not disappear after power failure.

[0102] The following is an example of a hard disk structure. The hard disk is divided into two areas. One is the index node inode area, which is used to store the file attribute information contained in the inode. The other is the data area, which stores the file data, that is, the actual content of the file. The file attribute information stored in the inode area includes directory entries and index nodes. Among them, the directory entry is used to record the name of the file (that is, the file name), the index node pointer, and the relationship with other directory entries. Multiple associated directory entries constitute the directory structure of the file system. The index node is used to record the metadata of the file. The index node corresponds to the file one by one and will be persistently stored on the disk.

[0103] The index node includes the inode number, file size, read and write permissions, file type, modification time, access time, etc. It also includes the function of a pointer to the file entity, but does not include the file name. This is because each index node has an inode number. After the terminal device opens a file, the terminal device uses the inode number to identify different files and no longer considers the file name.

[0104] As an example, the data area includes an index node area and a data block area. The index node area is used to store index nodes, and the data block area is used to store the actual content of the file.

[0105] In the solution provided in the embodiment of the present application, at the creation point of the inode of the target file, or when the target file is opened, the target association relationship between the identification information and the path information of the target file is stored in the BPF map in the memory. The eBPF program can directly access and operate these BPF map data stored in the memory at runtime. For example, both the program in the user space and the program in the kernel space can access and operate the BPF map to realize data exchange between the kernel space and the user space. Therefore, in the case of determining to observe the target file, the program in the kernel space (such as Figure 5 The kernel observation module in ) reads the BPF map from memory and searches for the path information corresponding to the target file through path matching; or, it can be done by a user space program (such as Figure 5 The processing module in the process reads the BPF map from the memory and searches for the path information corresponding to the target file through path matching.

[0106] It is understood that the memory may store computer executable program codes, which include instructions. The processor 310 may control the electronic device 300 to execute the file observation method provided by the present application by running the instructions stored in the memory.

[0107] It is also understandable that the electronic device 300 may also include Figure 6 This application does not limit other hardware structures not shown, such as display screens, sensors, cameras, communication modules, speakers, microphones, headphone jacks, etc.

[0108] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0109] An embodiment of the present application provides a computer program product. When the computer program product runs on a device, the device can implement the steps in the above-mentioned method embodiments when the device is executed.

[0110] The embodiment of the present application provides a chip, the chip is used to execute instructions, when the chip is running, the technical solution in the above embodiment is executed. The implementation principle and technical effect are similar, and will not be repeated here.

[0111] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber1ine, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DWD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0112] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera / electronic device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0113] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0115] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0116] It should be understood that the "embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, the various embodiments in the entire specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0117] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

[0118] In addition, it should be noted that the various numerical numbers involved in this application (such as the terms "first", "second", "third", "fourth" and other various terminology labels (if any) in the specification and claims and the above-mentioned drawings) are only distinguished for the convenience of description and are not used to limit the scope of this application. The size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic.

[0119] The terms "including" and "having" and any variations thereof mean "including but not limited to" unless specifically emphasized otherwise. For example, a process, method, system, product or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed but may include other steps or units not explicitly listed or inherent to such process, method, product or apparatus.

[0120] In the embodiments of the present application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0121] In the various embodiments of the present application, if there is no special explanation and logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships. The specific operating methods in the method embodiments of the present application can also be applied to device embodiments or system embodiments.

Claims

1. A file observation method, characterized in that: Applied to electronic equipment, the method comprises: Acquire first identification information corresponding to a first target file, where the first identification information is used to uniquely identify an index node inode of the first target file; Determining first path information corresponding to the first identification information through first Berkeley packet filter mapping information BPF map, where the target association relationship between the first identification information and the first path information is pre-recorded in the first BPF map, and the first path information is used to indicate a storage address of the first target file in a storage space of the electronic device; The first target file is observed according to the first path information.

2. The method according to claim 1, characterized in that Before acquiring the first identification information corresponding to the first target file at the target observation position, the method further includes: At the creation point of the inode, the target association relationship is recorded in the first BPF map.

3. The method according to claim 2, characterized in that After recording the target association relationship in the first BPF map, the method further includes: When the first target file is deleted or destroyed, the target association relationship continues to be maintained.

4. The method according to claim 2 or 3, characterized in that: The recording of the target association relationship in the first BPF map includes: When the thread corresponding to the first target file is a preset thread, and / or when the process corresponding to the first target file is a preset process, the target association relationship is recorded in the first BPF map.

5. The method according to any one of claims 1 to 3, characterized in that The determining, by using a first BPF map, first path information corresponding to the first identification information includes: Reading the target association relationship from the first BPF map through a processing module, wherein the processing module is located in a user space of the electronic device; Based on the target association relationship, the first path information corresponding to the first identification information is determined by the processing module.

6. The method according to claim 5, characterized in that The determining, by the processing module, first path information corresponding to the first identification information includes: When the amount of the data to be observed is greater than or equal to a preset threshold, the first path information corresponding to the first identification information is determined by the processing module, and the first target file is associated with the data to be observed.

7. The method according to any one of claims 1 to 3, characterized in that The determining, by using a first BPF map, first path information corresponding to the first identification information includes: Reading the target association relationship from the first BPF map through a kernel observation module, wherein the kernel observation module is located in a kernel space of the electronic device; Based on the target association relationship, the first path information corresponding to the first identification information is determined by the kernel observation module.

8. The method according to claim 7, characterized in that The determining, by the kernel observation module, the first path information corresponding to the first identification information includes: When the amount of the data to be observed is less than a preset threshold, the first path information corresponding to the first identification information is determined by the kernel observation module, and the first target file is associated with the data to be observed.

9. The method according to any one of claims 1 to 3, characterized in that The obtaining of first identification information corresponding to the first target file includes: The first identification information is obtained through a file structure and / or an inode structure corresponding to the first target file.

10. The method according to any one of claims 1 to 3, characterized in that A plurality of sets of association relationships are recorded in the first BPF map, wherein the plurality of sets of association relationships include the target association relationship; The method further comprises: Checking the plurality of association relationships in the first BPF map according to a first preset period; In the case that the first identification information corresponding to at least two groups of association relationships in the first BPF map is the same, the at least two groups of association relationships are stored in a second BPF map, and the second BPF map is different from the first BPF map.

11. The method according to claim 10, characterized in that After storing the at least two groups of association relationships in the second BPF map, the method further includes: Obtaining second identification information corresponding to the second target file, where the second identification information is used to uniquely identify an inode of the second target file; Determine, by using the second BPF map, second path information corresponding to the second identification information, wherein the at least two groups of association relationships include an association relationship between the second identification information and the second path information; The second target file is observed through the second path information.

12. The method according to any one of claims 1 to 3, characterized in that The method further comprises: querying the size of the first BPF map according to a second preset period by an independent thread; When the first BPF map is greater than or equal to a preset warning value, checking whether the inode corresponding to the first target file still exists in the file system of the electronic device; If the inode still exists in the file system, deleting the target association relationship from the first BPF map; or, In a case where the inode no longer exists in the file system, the target association relationship continues to be maintained in the first BPF map.

13. The method according to any one of claims 1 to 3, characterized in that The observing the first target file according to the first path information includes: Obtain a file observation indicator corresponding to the first target file, where the file observation indicator is used to optimize the system performance of the electronic device, and the file observation indicator includes one or more of the following: The read step length of the first target file, or the hotness or coldness of the first target file, or the pre-reading parameter of the first target file, or the file page jitter of the first target file.

14. An electronic device, characterized in that: The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method according to any one of claims 1 to 13.

15. A chip system, characterized in that: The chip system is applied to an electronic device, and the chip system includes one or more processors, and the one or more processors are used to call computer instructions so that the electronic device executes the method as described in any one of claims 1-13.

16. A computer program product, characterized in that The invention comprises a computer program, which, when being executed, enables the method according to any one of claims 1 to 13 to be performed.

Images