Real-time performance bottleneck information acquisition method and device, terminal and storage medium

Abstract

The application discloses a kind of real-time performance bottleneck information acquisition method, device, terminal and storage medium, belong to real-time performance technical field, the method includes: using the kernel probe of being hung on each kernel critical section protection operation function to obtain abnormal event basic information;With resource kernel probe is hung on preset resource tracking function, event resource information is extracted using resource kernel probe;For abnormal event basic information and event resource information establish association;Using the abnormal event basic information and event resource information generates process relationship topological graph.It is convenient for developer to quickly understand the complex interactive state of system through topological graph, and locate the center point of abnormal cluster. It can comprehensively capture the related information of delay exception, and it is convenient for developer to quickly and accurately locate the real-time performance bottleneck point.

Description

Technical Field

[0001] This invention relates to the field of real-time performance technology, and in particular to a method, apparatus, terminal and storage medium for obtaining real-time performance bottleneck information. Background Technology

[0002] In safety-critical and high-reliability fields such as industrial control, automotive electronics, and aerospace, the Linux operating system has become the mainstream technology to replace traditional proprietary real-time operating systems (such as VxWorks and QNX) by incorporating the PREEMPT_RT (Real-Time Preemption) patch to achieve hard real-time or firm real-time capabilities.

[0003] The performance bottleneck of current real-time Linux systems has transcended the level of a single algorithm or scheduling strategy, becoming deeply embedded in the concurrent resource contention mechanism of the kernel space. Even in the fully preemptible kernel mode provided by PREEMPT_RT, latency still occurs due to underlying conflicts. Therefore, it is necessary to effectively analyze these underlying conflicts, identify the specific causes of latency, and optimize them to meet the stringent requirements for system real-time performance.

[0004] In existing technologies, tools such as perf and ftrace can be used to analyze underlying conflicts. However, in implementing this invention, the inventors discovered the following technical problems: These tools have limitations: they can only collect data from a single dimension (such as interrupt duration, call stack, and resource operation logs), requiring developers to manually sift through multi-source data and verify the associated logic one by one. This is inefficient and prone to missing key points. Summary of the Invention

[0005] This invention provides a method, apparatus, terminal, and storage medium for obtaining real-time performance bottleneck information, in order to solve the technical problem of low efficiency and accuracy of low-level analysis in the prior art.

[0006] In a first aspect, embodiments of the present invention provide a method for obtaining real-time performance bottleneck information, including:

[0007] Basic information about abnormal events is obtained by using kernel probes mounted on the protection operation functions of each kernel critical section;

[0008] The resource kernel probe is attached to a predefined resource tracing function, and the resource kernel probe is used to extract event resource information.

[0009] Establish a correlation between basic information of abnormal events and event resource information;

[0010] A process relationship topology diagram is generated using the basic information of the abnormal events and the event resource information.

[0011] Secondly, embodiments of the present invention also provide a real-time performance bottleneck information acquisition device, comprising:

[0012] The acquisition module is used to acquire basic information about abnormal events using kernel probes mounted on the protection operation functions of each kernel critical section;

[0013] The extraction module is used to attach the resource kernel probe to a preset resource tracing function and use the resource kernel probe to extract event resource information.

[0014] A module is established to create relationships between basic information and resource information of abnormal events.

[0015] The generation module is used to generate a process relationship topology diagram using the basic information of the abnormal event and the event resource information.

[0016] Thirdly, embodiments of the present invention also provide a terminal, including:

[0017] One or more processors;

[0018] Storage device for storing one or more programs.

[0019] When the one or more programs are executed by the one or more processors, the one or more processors implement the real-time performance bottleneck information acquisition method provided in the above embodiments.

[0020] Fourthly, embodiments of the present invention also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the real-time performance bottleneck information acquisition method provided in the above embodiments.

[0021] The real-time performance bottleneck information acquisition method, device, terminal, and storage medium provided in this invention acquire basic information of abnormal events by utilizing kernel probes mounted on the protection operation functions of each kernel critical section; attach resource kernel probes to preset resource tracing functions to extract event resource information; establish a correlation between the basic information of abnormal events and the event resource information; and generate a process relationship topology graph using the basic information of abnormal events and the event resource information. The kernel probes mounted on the protection operation functions of each kernel critical section can collect the raw kernel event stream in real time, accurately acquiring delayed abnormal events. Simultaneously, the resource kernel probes can capture single lock acquisitions, file read / write operations of specific bytes, comprehensively acquiring various information about resource operations. Furthermore, the kernel-state information is used to associate critical section timeout abnormal events with resource operations of the same process within the same time period in real time in user space, generating a process-resource topology graph. This allows developers to quickly understand the complex interactive states of the system and locate the center point of abnormal clusters through the topology graph. It can comprehensively capture relevant information of delayed abnormalities, facilitating developers to quickly and accurately locate real-time performance bottlenecks. Attached Figure Description

[0022] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0023] Figure 1 This is a flowchart illustrating the real-time performance bottleneck information acquisition method provided in Embodiment 1 of the present invention;

[0024] Figure 2 This is a schematic diagram of the process relationship topology in the real-time performance bottleneck information acquisition method provided in Embodiment 1 of the present invention;

[0025] Figure 3 This is a flowchart illustrating the real-time performance bottleneck information acquisition method provided in Embodiment 2 of the present invention;

[0026] Figure 4 This is a flowchart illustrating the real-time performance bottleneck information acquisition method provided in Embodiment 3 of the present invention;

[0027] Figure 5 This is a schematic diagram of the real-time performance bottleneck information acquisition device provided in Embodiment 4 of the present invention;

[0028] Figure 6 This is a schematic diagram of the terminal provided in Embodiment 5 of the present invention. Detailed Implementation

[0029] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0030] Example 1

[0031] Figure 1 This is a flowchart of a real-time performance bottleneck information acquisition method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where real-time performance bottleneck information in a real-time optimized operating system is comprehensively acquired. This method can be executed by a real-time performance bottleneck information acquisition device, and specifically includes the following steps:

[0032] Step 110: Obtain basic information about abnormal events using kernel probes mounted on the protection operation functions of each kernel critical section.

[0033] While the Linux operating system, after being optimized with the PREEMPT_RT patch, can improve real-time response capabilities, potential latency risks still exist in the kernel's native scheduling, interrupt handling, and resource management mechanisms. Specific bottlenecks include: uncontrollable kernel critical section latency: the duration of interrupt and preemption disabling operations easily exceeds thresholds and is difficult to correlate with specific resource access behaviors, making it impossible to pinpoint the root cause of latency; insufficient real-time performance of the perf tool, requiring offline data processing and unable to filter invalid information; basic ftrace functionality, requiring manual configuration of probe points and lacking built-in resource contention correlation analysis capabilities; high cost of multi-source data correlation: interrupt durations, call stacks, and resource operation logs collected by different tools are independent, requiring manual correlation, which is inefficient and error-prone; and the inability to intuitively present inter-process resource contention relationships and latency propagation paths, making it difficult to locate chained latency issues.

[0034] In this embodiment, delay anomalies can be detected first. For example, kernel probes attached to each kernel critical section protection function can be used to obtain basic information about the anomaly. For instance, the kprobe and tracepoint kernel probes can be attached to the kernel critical section protection function. When this function is called, information is collected as a basis for judging delay anomalies, and corresponding system information is collected when a delay anomaly occurs. The kernel critical section protection function can be a function or code region located in the kernel execution path, used to protect shared resources from concurrent access interference and ensuring the atomic execution of code segments through specific mechanisms, such as disabling interrupts, disabling preemption, or holding locks.

[0035] Step 120: Attach the resource kernel probe to the preset resource tracing function and use the resource kernel probe to extract event resource information.

[0036] In this embodiment, the resources that cause delays can be locks, file I / O, and sockets. For example, the corresponding resource tracing functions are still hooked through kprobe. The resource tracing functions can be lock operation tracing functions, file I / O tracing functions, and socket operation tracing functions. Resource probes are used to continuously collect resource operation information.

[0037] For example, the extraction of event resource information using a resource kernel probe may include: dynamically recording and maintaining the association between resources and accessing processes using a predefined resource hash table; collecting resource data from the resource kernel probe using a predefined resource structure, the resource data including: resource type, resource ID, operation type, current process ID, name, timestamp, and current kernel call stack; and sending the resource data to user space using a second circular buffer.

[0038] In this embodiment, a hash table can be used to dynamically maintain the association between resources and accessing processes. The key in the hash table can be a resource identifier (such as the address of a lock), and the value is a structure containing a list of process IDs.

[0039] When operations such as lock acquisition / release, file read / write, and socket send / receive occur, the corresponding probe function is executed, and the execution result is filled into a pre-established resource structure resource_event. This resource structure can contain: resource type (lock, file, socket), resource ID (such as lock address, file descriptor), operation type (acquire / release, read / write); the ID, name, and timestamp of the current process; and the kernel call stack at the current moment.

[0040] The information in the above structure is used to send resource data from kernel mode to user mode using a second circular buffer, so that the data can be analyzed in user mode.

[0041] Step 130: Establish the association between the basic information of the abnormal event and the event resource information.

[0042] For example, in user space, the basic information of abnormal events and event resource information collected in the above steps can be associated using the process ID. This facilitates association later.

[0043] Step 140: Generate a process relationship topology diagram using the abnormal event basic information and event resource information.

[0044] Inter-process resource interactions during system runtime are implicit and constantly changing. Topology graphs can make these interactions explicit and fixed, effectively helping developers clearly understand which resources each program uses and facilitating the identification of performance issues.

[0045] Figure 2 This is a schematic diagram of the process relationship topology in the real-time performance bottleneck information acquisition method provided in Embodiment 1 of the present invention. See [link / reference]. Figure 2 Topology graphs can be used to show which processes are associated with which resources, as well as the direction and nature of these associations, directly displaying the runtime architecture of a real-time system. Topology graphs can graphically reveal circular waits. By statistically analyzing or visually enhancing the density of edges or the number of connections between nodes in the graph, hot resources, high-consuming processes, and unreasonable dependencies can be intuitively identified. Due to these advantages, topology graphs can be used in this embodiment to display the basic information on associated abnormal events and event resource information obtained in the above steps.

[0046] For example, this could include: using processes from exception event information and event resource information as nodes; using a combination of resource type and resource number as identifiers, and using process nodes pointing to resource nodes as edges; using operations or states as attributes of the edges. This clearly distinguishes processes and resources as two types of nodes, while the edges clearly represent the core relationships of node operations. This forms a subject-action-object triple structure, which aligns with the essence of system calls and kernel events, and can directly indicate waiting or holding relationships using direction, which is crucial for deadlock analysis. It also completely preserves the original information captured from kernel probes. This makes the process relationship topology graph very easy to understand and interpret, facilitating analysis and expansion by developers.

[0047] This embodiment acquires basic information about abnormal events by utilizing kernel probes mounted on the protection operation functions of each kernel critical section; it also mounts resource kernel probes on preset resource tracing functions to extract event resource information; it establishes a correlation between the basic information of abnormal events and the event resource information; and it generates a process relationship topology graph using the basic information of abnormal events and the event resource information. The kernel probes mounted on the protection operation functions of each kernel critical section can collect the raw kernel event stream in real time, accurately acquiring delayed abnormal events. Simultaneously, the resource kernel probes can capture single lock acquisitions, file read / write operations of specific bytes, comprehensively acquiring various information about resource operations. Furthermore, the kernel-state information is used to associate critical section timeout abnormal events with resource operations of the same process within the same time period in real time in user space, generating a process-resource topology graph. This allows developers to quickly understand the complex interactive states of the system and locate the center point of abnormal clusters through the topology graph. It can comprehensively capture relevant information about delayed abnormalities, enabling developers to quickly and accurately locate real-time performance bottlenecks.

[0048] Example 2

[0049] Figure 3This is a flowchart illustrating the real-time performance bottleneck information acquisition method provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiment and optimized. Specifically, the method of acquiring basic information of abnormal events using kernel probes mounted on each kernel critical section protection operation function is optimized as follows: kernel probes are mounted on each kernel critical section protection operation function respectively; the kernel probes are used to record the entry / exit timestamps of the function; the reference usage duration of the function is calculated based on the entry / exit timestamps, and the reference usage duration is compared with a preset duration threshold. Based on the comparison result, the abnormal event is determined, and the basic information of the abnormal event is recorded.

[0050] See Figure 3 The method for obtaining real-time performance bottleneck information includes:

[0051] Step 210: Attach kernel probes to each kernel critical section protection operation function; use the kernel probes to record the entry / exit timestamps of the functions.

[0052] In this embodiment, before attaching the kernel probes to each kernel critical section protection operation function, the method may further include the following steps: configuring a preset duration threshold, a preset resource tracing function, and a data transmission buffer size; defining a data structure for storing information. For example, a duration threshold can be set as the basis for judging anomalies, and a resource tracing function for later use can be set to facilitate the collection of resource information. A data transmission buffer can be set to facilitate shared use by user mode and kernel mode, enabling data transfer between user mode and kernel mode. Furthermore, a `critical_event` data structure can be pre-established, with duration and critical section thresholds, to facilitate the identification of performance anomalies. When the duration of a critical section exceeds the threshold, it can be marked as an abnormal event. For example, this structure can record information such as process ID, CPU core number, critical section start timestamp, critical section end timestamp, critical section duration, process name, and call stack. For example, the following structure can be used:

[0053] struct critical_event {

[0054] u32 pid; / / Process ID

[0055] u32 cpu; / / CPU core number

[0056] u64 start_ts; / / Critical section start timestamp (ns)

[0057] u64 end_ts; / / Critical section end timestamp (ns)

[0058] u64 duration; / / Critical section duration (ns)

[0059] char comm[TASK_COMM_LEN]; / / Process name

[0060] u64 call_stack

[16] ; / / Call stack (first 16 levels).

[0061] Using the methods described above, data structures can be used to achieve preliminary filtering and labeling capabilities. This allows the system to focus on abnormal critical sections exceeding thresholds and their associated resource events, greatly improving analysis efficiency.

[0062] Correspondingly, the kernel critical section protection operation functions can be hooked via kprobe. These functions include: disable interrupts (irq_disable), enable interrupts (irq_enable), disable preemption (preempt_disable), and enable preemption (preempt_enable). The entry / exit timestamps of these functions are recorded, and the duration is calculated. If the duration exceeds a pre-set threshold, event information is collected and sent to user space.

[0063] Taking disabling interrupts as an example, it can be implemented in the following way:

[0064] int kprobe__irq_disable(struct pt_regs *ctx) {

[0065] u32 pid = bpf_get_current_pid_tgid() >> 32;

[0066] u64 ts = bpf_ktime_get_ns();

[0067] critical_start.update(&pid, &ts);

[0068] return 0;

[0069] }

[0070] / / Enable interrupts / preemption function exit probe (calculate duration and determine if threshold is exceeded)

[0071] int kretprobe__irq_enable(struct pt_regs *ctx) {

[0072] u32 pid = bpf_get_current_pid_tgid() >> 32;

[0073] u64 *start_ts = critical_start.lookup(&pid);

[0074] if (!start_ts) return 0;

[0075] u64 end_ts = bpf_ktime_get_ns();

[0076] u64 duration = end_ts - *start_ts;

[0077] critical_start.delete(&pid);

[0078] / / Collect event information if the threshold is exceeded

[0079] if (duration > CRITICAL_THRESHOLD) {

[0080] struct critical_event e = {};

[0081] e.pid = pid;

[0082] e.cpu = bpf_get_smp_processor_id();

[0083] e.start_ts = *start_ts;

[0084] e.end_ts = end_ts;

[0085] e.duration = duration;

[0086] bpf_get_current_comm(&e.comm, sizeof(e.comm));

[0087] / / Collect the call stack (kernel-mode symbols)

[0088] bpf_get_stack(ctx, e.call_stack, sizeof(e.call_stack), 0);

[0089] / / Send to user-space circular buffer

[0090] bpf_ringbuf_output(&critical_ringbuf, &e, sizeof(e), 0);

[0091] }

[0092] return 0;

[0093] }

[0094] The other three functions can also achieve their corresponding functions in the same way.

[0095] Step 220: Calculate the reference usage duration of the recording function based on the entry / exit timestamp, compare the reference usage duration with a preset duration threshold, determine the abnormal event based on the comparison result, and record the basic information of the abnormal event.

[0096] For example, the exit timestamp can be subtracted from the entry timestamp to obtain the reference usage duration, and the reference usage duration can be compared with a preset duration threshold. If it is greater than the preset duration threshold, an abnormal event is identified, and the basic information of the abnormal event is recorded using a data structure.

[0097] Optionally, the method may further include the following steps: initializing the data transmission buffer, wherein the data transmission buffer is a first circular buffer and a second circular buffer; and using the first circular buffer and the second circular buffer to transmit data from kernel mode to user mode.

[0098] Accordingly, the method of using the kernel probe to record the entry / exit timestamps of the function can be optimized as follows: using a data structure that stores time information to record abnormal event information, the abnormal event information including: process information, CPU, entry / exit timestamps, duration and call stack information.

[0099] After recording the abnormal event information, the first circular buffer is used to send the abnormal event information and the corresponding call stack information to the user space so that the data can be processed in the user space.

[0100] Step 230: Attach the resource kernel probe to the preset resource tracing function and use the resource kernel probe to extract event resource information.

[0101] Step 240: Generate a process relationship topology diagram using the abnormal event basic information and event resource information.

[0102] This embodiment optimizes the acquisition of basic information about abnormal events using kernel probes mounted on each kernel critical section protection operation function as follows: Kernel probes are mounted on each kernel critical section protection operation function; the kernel probes record the entry / exit timestamps of the function; the reference usage duration of the function is calculated based on the entry / exit timestamps, and the reference usage duration is compared with a preset duration threshold. Based on the comparison result, the abnormal event is determined, and the basic information of the abnormal event is recorded. This ensures the real-time performance and completeness of abnormal delay event capture.

[0103] Example 3

[0104] Figure 4 This is a flowchart illustrating the real-time performance bottleneck information acquisition method provided in Embodiment 3 of the present invention. This embodiment is based on the above embodiment and optimized. After establishing the association between the basic information of abnormal events and the event resource information, and before generating the process relationship topology using the basic information of abnormal events and the event resource information, the method may further include the following steps: in user space, converting the original numerical information in the abnormal event information and the event resource information into corresponding strings; converting the kernel stack address in the abnormal event information and the event resource information into a function name.

[0105] See Figure 4 The method for obtaining real-time performance bottleneck information includes:

[0106] Step 310: Use kernel probes mounted on the protection operation functions of each kernel critical section to obtain basic information about abnormal events.

[0107] Step 320: Attach the resource kernel probe to the preset resource tracing function and use the resource kernel probe to extract event resource information.

[0108] Step 330: Establish the association between the basic information of the abnormal event and the event resource information.

[0109] Step 340: In user mode, convert the original numerical information in the abnormal event information and event resource information into corresponding strings.

[0110] In this embodiment, the data transmitted from the kernel is binary data, which is inconvenient to process later. Therefore, in this embodiment, it needs to be deserialized to parse the binary data transmitted from the kernel into an object string. For example, this can be achieved as follows: event = b["critical_event"].event(data).

[0111] Step 350: Convert the kernel stack address in the abnormal event information and event resource information into a function name.

[0112] In addition, symbol resolution is required to convert the kernel addresses in the call stack into function names. For example, this can be achieved using `b.ksym(addr)`.

[0113] Then, the above data can be structured by constructing an event dictionary, forming the following standardized fields: PID, process name, CPU, latency (microseconds), and symbolic call stack. This facilitates the later drawing of process relationship topology diagrams.

[0114] Step 360: Generate a process relationship topology diagram using the abnormal event basic information and event resource information.

[0115] This embodiment, after establishing the association between the basic information and resource information of abnormal events, and before generating the process relationship topology graph using the basic information and resource information of abnormal events, may further add the following steps: In user space, converting the original numerical information in the abnormal event information and resource information into corresponding strings; converting the kernel stack address in the abnormal event information and resource information into function names. This can improve the understandability of the data and debugging efficiency, facilitate subsequent semantic-based filtering and aggregation, and further enhance the visualization effect and information content of the topology graph.

[0116] Example 4

[0117] Figure 5 This is a schematic diagram of the real-time performance bottleneck information acquisition device provided in Embodiment 4 of the present invention. See also... Figure 5 The real-time performance bottleneck information acquisition device includes:

[0118] The acquisition module 410 is used to acquire basic information about abnormal events using kernel probes mounted on the protection operation functions of each kernel critical section;

[0119] Extraction module 420 is used to attach the resource kernel probe to a preset resource tracing function and use the resource kernel probe to extract event resource information;

[0120] Module 430 is established to create a relationship between basic information and resource information of abnormal events.

[0121] The generation module 440 is used to generate a process relationship topology diagram using the abnormal event basic information and event resource information.

[0122] The real-time performance bottleneck information acquisition device provided in this embodiment acquires basic information about abnormal events by using kernel probes mounted on the protection operation functions of each kernel critical section; it also mounts resource kernel probes on preset resource tracing functions to extract event resource information; it establishes a correlation between the basic information of abnormal events and the event resource information; and it generates a process relationship topology graph using the basic information of abnormal events and the event resource information. The kernel probes mounted on the protection operation functions of each kernel critical section can collect the raw kernel event stream in real time, accurately acquiring delayed abnormal events. Simultaneously, the resource kernel probes can capture single lock acquisitions, file read / write operations of specific bytes, comprehensively acquiring various information about resource operations. Furthermore, the kernel-state information is used to associate critical section timeout abnormal events with resource operations of the same process within the same time period in real time in user space, generating a process-resource topology graph. This allows developers to quickly understand the complex interaction states of the system and locate the center point of anomaly clusters through the topology graph. It can comprehensively capture relevant information about delayed abnormalities, facilitating developers to quickly and accurately locate real-time performance bottlenecks.

[0123] Based on the above embodiments, the acquisition module includes:

[0124] The mounting unit is used to mount kernel probes to each kernel critical section protection operation function;

[0125] A recording unit is used to record the entry / exit timestamps of the function using the kernel probe;

[0126] The comparison unit is used to calculate the reference usage duration of the function based on the entry / exit timestamp, compare the reference usage duration with a preset duration threshold, determine the abnormal event based on the comparison result, and record the basic information of the abnormal event.

[0127] Based on the above embodiments, the device further includes:

[0128] The configuration module is used to configure preset duration thresholds, preset resource tracking functions, and data transmission buffer sizes.

[0129] Define the module, which is used to define the data structure for storing information.

[0130] Based on the above embodiments, the device further includes:

[0131] An initialization module is used to initialize the data transmission buffer, which is a first circular buffer and a second circular buffer.

[0132] Accordingly, the recording unit is used for:

[0133] An abnormal event information is recorded using a data structure that stores time information. The abnormal event information includes: process information, CPU, entry / exit timestamp, duration, and call stack information.

[0134] The exception event information and call stack information are sent to user space through the first circular buffer.

[0135] Based on the above embodiments, the extraction module includes:

[0136] The association record unit is used to dynamically record and maintain the association between resources and access processes using a predefined resource hash table;

[0137] The acquisition unit is used to collect resource data from the resource kernel probe using a predefined resource structure. The resource data includes: resource type, resource ID, operation type, current process ID, name, timestamp, and the kernel call stack at the current moment.

[0138] The sending unit is used to send the resource data to the user space using the second circular buffer.

[0139] Based on the above embodiments, the device further includes:

[0140] The first conversion unit is used in user mode to convert the original numerical information in the abnormal event information and event resource information into corresponding strings;

[0141] The second conversion unit is used to convert the kernel stack address in the abnormal event information and event resource information into a function name.

[0142] Based on the above embodiments, the generation module includes:

[0143] The first unit is used to treat processes in abnormal event information and event resource information as nodes;

[0144] The second unit is used to identify the resource node by a combination of resource type and resource number, and to use the process node pointing to the resource node as an edge.

[0145] The third element is used as a unit to utilize operations or states as attributes of edges.

[0146] The real-time performance bottleneck information acquisition device provided in the embodiments of the present invention can execute the real-time performance bottleneck information acquisition method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0147] Example 5

[0148] Figure 6 This is a schematic diagram of the structure of a terminal provided in Embodiment 5 of the present invention. Figure 6 A block diagram is shown of an exemplary terminal 12 suitable for implementing embodiments of the present invention. Figure 6 The terminal 12 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0149] like Figure 6 As shown, terminal 12 is presented in the form of a general-purpose computing terminal. The components of terminal 12 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0150] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0151] Terminal 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by terminal 12, including volatile and non-volatile media, removable and non-removable media.

[0152] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. Terminal 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (… Figure 6 Not shown; usually referred to as a "hard drive"). Although Figure 6 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. System memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of the present invention.

[0153] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of the present invention.

[0154] Terminal 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing terminal, display 24, etc.), and with one or more terminals that enable a user to interact with terminal 12, and / or with any terminal (e.g., network card, modem, etc.) that enables terminal 12 to communicate with one or more other computing terminals. This communication can be performed via input / output (I / O) interface 22. Furthermore, terminal 12 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of terminal 12 via bus 18. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with terminal 12, including but not limited to: microcode, terminal drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0155] Processing unit 16 executes various functional applications and data processing by running programs stored in system memory 28, such as implementing the real-time performance bottleneck information acquisition method provided in this embodiment of the invention.

[0156] Example 6

[0157] Embodiment 6 of the present invention also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the real-time performance bottleneck information acquisition method as described in any of the above embodiments.

[0158] The computer storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0159] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0160] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0161] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or terminal. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0162] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for obtaining real-time performance bottleneck information, characterized in that, include: Basic information about abnormal events is obtained by using kernel probes mounted on the protection operation functions of each kernel critical section; The resource kernel probe is attached to a predefined resource tracing function, and the resource kernel probe is used to extract event resource information. Establish a correlation between basic information of abnormal events and event resource information; A process relationship topology diagram is generated using the aforementioned abnormal event basic information and event resource information; The process relationship topology graph generated using the abnormal event basic information and event resource information includes: Use the processes in the basic information of abnormal events and the event resource information as nodes; The resource type and resource number are used as identifiers, and the process node points to the resource node as edges. Use operations or states as attributes of edges.

2. The method according to claim 1, characterized in that, The method of obtaining basic information about abnormal events using kernel probes mounted on the protection operation functions of each kernel critical section includes: The kernel probes are attached to each kernel critical section protection operation function respectively; The kernel probe is used to record the entry / exit timestamps of the function; The reference usage duration of the function is calculated based on the entry / exit timestamp, and the reference usage duration is compared with a preset duration threshold. An abnormal event is determined based on the comparison result, and the basic information of the abnormal event is recorded.

3. The method according to claim 2, characterized in that, Before using kernel probes mounted on the protection operation functions of each kernel critical section to obtain basic information about abnormal events, the method further includes: Configure preset duration thresholds, preset resource tracing functions, and data transfer buffer sizes; Define the data structure for storing information.

4. The method according to claim 3, characterized in that, The method further includes: Initialize the data transmission buffer, which is a first circular buffer and a second circular buffer; Accordingly, the step of using the kernel probe to record the function's entry / exit timestamps includes: A data structure storing time information is used to record basic information about abnormal events, including: process information, CPU, entry / exit timestamp, duration, and call stack information. The basic information of the exception event and the call stack information are sent to the user space through the first circular buffer.

5. The method according to claim 1, characterized in that, The extraction of event resource information using resource kernel probes includes: A predefined resource hash table is used to dynamically record and maintain the association between resources and accessing processes; Resource data is collected by a resource kernel probe using a predefined resource structure. The resource data includes: resource type, resource ID, operation type, current process ID, name, timestamp, and current kernel call stack. The resource data is sent to user space using a second circular buffer.

6. The method according to claim 1, characterized in that, After establishing the association between the basic information of abnormal events and the event resource information, and before generating a process relationship topology graph using the basic information of abnormal events and the event resource information, the method further includes: In user mode, the original numerical information in the basic information of the abnormal event and the event resource information is converted into corresponding strings; Convert the kernel stack address in the basic information and resource information of the abnormal event into a function name.

7. A device for acquiring real-time performance bottleneck information, characterized in that, include: The acquisition module is used to acquire basic information about abnormal events using kernel probes mounted on the protection operation functions of each kernel critical section; The extraction module is used to attach the resource kernel probe to a preset resource tracing function and use the resource kernel probe to extract event resource information. A module is established to create relationships between basic information and resource information of abnormal events. The generation module is used to generate a process relationship topology diagram using the basic information of the abnormal event and the event resource information; The generation module includes: The first unit is used to treat processes in the basic information of abnormal events and the information of event resources as nodes; The second unit is used to identify the resource node by a combination of resource type and resource number, and to use the process node pointing to the resource node as an edge. The third element is used as a unit to utilize operations or states as attributes of edges.

8. A terminal, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the real-time performance bottleneck information acquisition method as described in any one of claims 1-6.

9. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the real-time performance bottleneck information acquisition method as described in any one of claims 1-6.

Images