Link tracing method and device

Abstract

The present application relates to the technical field of cloud, and provides a link tracing method and device, which are applied to a cloud server. The cloud server comprises a Java proxy module and an eBPF module. The Java proxy module determines an application call chain, and the eBPF module determines an infrastructure call chain. The application call chain is associated with the infrastructure call chain by means of a trace identifier and a span identifier. The Java proxy module reports to the eBPF module an association relationship between a packet feature code, and the trace identifier and the span identifier, so that the eBPF module parses an encrypted packet. Therefore, according to the call chain tracing method provided by the embodiments of the present application, a distributed application call chain can be associated with an infrastructure call chain of a virtual network and a physical network, so that full-link tracing can be realized.

Description

Link tracing method and device

[0001] This application claims priority to Chinese Patent Application No. 202310834172.8, filed with the Patent Office of China on July 7, 2023, entitled “A Full Link Tracking Method and Device,” the entire contents of which are incorporated herein by reference. Furthermore, this application claims priority to Chinese Patent Application No. 202310966690.5, filed with the Patent Office of China on August 2, 2023, entitled “Link Tracking Method and Device,” the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of cloud technology, and more specifically, to a link tracing method and device. Background Art

[0003] With the continuous development of cloud-native applications, more and more applications are split into multiple microservices, and the paths of the infrastructure network used to connect these microservices are becoming increasingly complex.

[0004] Therefore, how to track the links of microservice calls is an urgent problem to be solved.

[0005] Summary of the Invention

[0006] This application provides a link tracing method and device that can track the links of microservice calls. In addition, the link tracing method provided by this application associates the distributed application call chain with the infrastructure call chain of virtual networks and physical networks, enabling full-link tracing.

[0007] In a first aspect, a link tracing method is provided, which is applied to a cloud server, the cloud server including a Java proxy module and an extended Berkeley packet filter (eBPF) module, and multiple microservices are running in the cloud server, the method comprising: the Java proxy module intercepts a message to be encrypted generated by a current microservice, and injects a trace identifier, a parent span identifier and a current span identifier into the message to be encrypted, wherein the message to be encrypted is used to call a child microservice after encryption, the current span identifier is an identifier of the current microservice calling the child microservice, the parent span identifier is an identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate calls between the multiple microservices; the Java proxy module intercepts a request message, the request message is an encrypted message of the message to be encrypted; the Java proxy module determines a message feature code based on the request message, so as to and the association relationship between the message feature code and the trace identifier, the parent span identifier and the current span identifier; the Java agent module reports the association relationship to the eBPF module; the eBPF module determines the infrastructure call information in the process of the current microservice calling the child microservice according to the request message; the eBPF module determines the message feature code according to the request message; the eBPF module determines the trace identifier, the parent span identifier and the current span identifier according to the message feature code and the association relationship; the eBPF module determines the current link call information of the current microservice calling the child microservice, and the current link call information includes the trace identifier, the parent span identifier, the current span identifier and the infrastructure call information.

[0008] In the embodiment of the present application, the Java proxy module determines the application call chain, and the eBPF module determines the infrastructure call chain. Through the trace identifier and span identifier, the association between the application call chain and the infrastructure call chain is achieved. The Java proxy module reports the association between the message feature code and the trace identifier and span identifier to the eBPF module, thereby enabling the eBPF module to parse the encrypted request message. Therefore, the call chain tracing method provided in the embodiment of the present application can associate the distributed application call chain with the infrastructure call chain of the virtual network and the physical network, and can achieve full-link tracing.

[0009] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the eBPF module reports the current link call information to an aggregation module in the cloud management platform, and the aggregation module is used to aggregate multiple link call information.

[0010] In the embodiment of the present application, by integrating the link call information of multiple microservices, the full link tracking of the calls between each microservice can be performed.

[0011] In combination with the first aspect, in some implementations of the first aspect, the Java agent module determines the message feature code based on the request message, including: the Java agent module processes the request message according to a hash algorithm to determine the message feature code.

[0012] In an embodiment of the present application, the request message is processed by a hash algorithm, which not only realizes the correspondence between the request message and the message feature code, but also makes the length of the message feature code controllable, thereby reducing the overhead of the link tracking device in the process of determining and reporting the message feature code.

[0013] In combination with the first aspect, in certain implementations of the first aspect, the eBPF module determines the message feature code based on the request message, including: the eBPF module processes the request message according to the hash algorithm to determine the message feature code.

[0014] In the embodiment of the present application, the eBPF side processes the request message through a hash algorithm, which not only realizes the correspondence between the request message and the message signature code, but also makes the length of the message signature code controllable, reducing the overhead of the link tracking device during the process of determining and reporting the message signature code. In addition, the eBPF side uses the same message signature code generation method as the Java proxy side, so that the eBPF side can obtain the same message signature code, realize the parsing of the encrypted request message by the eBPF module, and thus can perform full-link call chain tracing.

[0015] In combination with the first aspect, in certain implementations of the first aspect, the Java agent module reports the association relationship to the eBPF module, including: the Java agent module reports the association relationship to the interface of the eBPF module; wherein, the method also includes: the eBPF module caches the association relationship.

[0016] In an embodiment of the present application, the association relationship reported by the Java agent module can be cached by the eBPF module, so that when the eBPF module needs to match the association relationship, it can conveniently call the data in the cache area, thereby improving efficiency.

[0017] In combination with the first aspect, in some implementations of the first aspect, the request message includes a Hypertext Transfer Protocol Secure (HTTPS) request message.

[0018] In combination with the first aspect, in some implementations of the first aspect, the multiple microservices are Java microservices.

[0019] In combination with the first aspect, in certain implementations of the first aspect, the thread for encrypting the message to be encrypted in the multiple microservices is asynchronous with the thread for sending and receiving the request message.

[0020] Due to different client frameworks or configurations used, the encryption thread and the network transceiver thread may be in different threads. In the case of thread asynchrony, the eBPF module cannot obtain the correspondence between the encrypted request message and the trace identifier and span identifier through the monitoring thread, so it needs to interact with other modules to obtain the correspondence. In the embodiment of the present application, through the interaction between the Java proxy module and the eBPF module, the eBPF module can parse the encrypted request message and obtain the correspondence between the message and the trace identifier and span identifier, thereby realizing the association between the application call chain and the infrastructure call chain.

[0021] In a second aspect, an embodiment of the present application provides a link tracking device, which includes a module for implementing the first aspect or any possible implementation method of the first aspect.

[0022] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the link tracking method of the first aspect or any possible implementation of the first aspect.

[0023] In a fourth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the link tracing method of the first aspect or any possible implementation of the first aspect.

[0024] In a fifth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the link tracking method of the first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] FIG1 is a system diagram of a cloud server system according to an embodiment of the present application.

[0026] FIG2 is a schematic block diagram of a link tracking device provided in an embodiment of the present application.

[0027] FIG3 is a schematic flowchart of a link tracing method provided in an embodiment of the present application.

[0028] FIG4 is a system module diagram of a message processing method 400 provided in an embodiment of the present application.

[0029] FIG5 is a schematic diagram of the architecture of a computing device provided in an embodiment of the application.

[0030] FIG6 is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of the present application.

[0031] FIG7 is a schematic diagram of a connection between computing devices 500A and 500B via a network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solution in this application will be described below with reference to the accompanying drawings.

[0033] This application will present various aspects, embodiments, or features in the context of systems that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in conjunction with the figures. Furthermore, combinations of these aspects may also be used.

[0034] Additionally, in the embodiments of this application, words such as "exemplary" and "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this application as "exemplary" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of the word "exemplary" is intended to present concepts in a concrete manner.

[0035] The business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field will know that with the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0036] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in yet other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically stated. The terms "including," "comprising," "having," and variations thereof mean "including but not limited to," unless otherwise specifically stated.

[0037] FIG1 is a system diagram of a cloud server system according to an embodiment of the present application.

[0038] As shown in Figure 1, the cloud management platform 110 is used to manage the infrastructure that provides multiple cloud services. This infrastructure includes multiple cloud data centers, each of which includes multiple cloud servers. Each cloud server contains cloud service resources and provides corresponding cloud services to tenants. For example, a cloud server can run multiple microservices.

[0039] The cloud management platform 110 provides an access interface (such as a user interface or application program interface (API)). Tenants can use the client to remotely access the access interface to register a cloud account and password on the cloud management platform and log in to the cloud management platform. After the cloud management platform successfully authenticates the cloud account and password, the tenant can further pay to select and purchase a virtual machine with specific specifications (processor, memory, disk) on the cloud management platform. After the payment is successful, the cloud management platform provides the remote login account and password for the purchased virtual machine. The client can remotely log in to the virtual machine and install and run the tenant's applications in the virtual machine. Tenants of cloud services can include individuals, enterprises, schools, hospitals, administrative agencies, etc.

[0040] The functions of the cloud management platform 110 include, but are not limited to, a user console, computing management services, network management services, storage management services, authentication services, and image management services. The user console provides an interface or API for interacting with tenants. The computing management service is used to manage servers running virtual machines and containers, as well as bare metal servers. The network management service is used to manage network services (such as gateways and firewalls). The storage management service is used to manage storage services (such as data bucket services). The authentication service is used to manage tenant accounts and passwords. The image management service is used to manage virtual machine images. Tenants can use the client 130 to log in to the cloud management platform 110 via the Internet 120 to manage the rented cloud services.

[0041] With the continuous development of cloud-native applications, more and more applications are split into multiple microservices, and the paths of the infrastructure network used to connect these microservices are becoming more and more complex. For example, in a distributed service architecture, after a request message flows from the gateway into the architecture, multiple microservices may be called to process the request message. If one of the microservices fails or the processing efficiency is too low, it will affect the final request message. It should be noted that multiple microservices may run in the same cloud server or in different cloud servers, and this application does not limit this.

[0042] In some embodiments, a link tracing technology represented by a Java agent can be used to trace the application call chain. For example, a trace identifier and a span identifier can be used to trace the application call chain.

[0043] By logging call information between microservices (such as time, interface, level, and results), and then linking these call information using span and trace identifiers, we can form an application call chain. By performing statistical analysis on the application call chain based on different dimensions and identifying abnormal calls, we can quickly locate the microservice causing the anomaly and resolve it.

[0044] Specifically, in the entire application call chain, the request message generated by a request will carry the trace identifier and be passed to the downstream microservice. In this way, the trace identifier can connect the entire application call chain belonging to the request.

[0045] Each microservice also generates a span identifier. The span identifier generated by the current microservice is called the current span identifier. A microservice upstream and adjacent to the current microservice is called the parent microservice. The span identifier passed by the parent microservice is called the parent span identifier. As requests are passed through various microservices in the form of request messages, the current microservice becomes the parent microservice, and the current span identifier becomes the parent span identifier. This allows you to locate the specific location of a call or process in the application call chain using the parent span identifier and the current span identifier.

[0046] For example, suppose microservice A calls microservice B. When microservice A generates request message 1, if it is not called by any other microservice, in other words, it has no parent microservice, then microservice A can inject the trace identifier and the current span identifier into request message 1. In this case, the current span identifier injected by microservice A is used to trace the call from microservice A to microservice B.

[0047] After receiving request message 1, if microservice B needs to call another microservice (such as microservice C), it can generate request message 2. Microservice B can inject a new span identifier into request message 2 as the current span identifier. The trace identifier and the span identifier injected by microservice A are retained, but the span identifier injected by microservice A serves as the parent span identifier. The current span identifier injected by microservice B is now used to trace the call from microservice B to microservice C.

[0048] After receiving request message 2, if microservice C needs to call another microservice (such as microservice D), it can generate a request message 3. Microservice C can inject another span identifier into request message 3 as the current span identifier. In this case, the trace identifier and the span identifier injected by microservice B are still retained, but the span identifier injected by microservice B serves as the parent span identifier. The span identifier injected by microservice A is not retained. In this case, the current span identifier injected by microservice C is used to trace the call from microservice C to microservice D.

[0049] In this way, in scenarios where multiple microservices process request messages, the application call chain can be determined by combining trace identifiers, span identifiers, and logs. Trace identifiers link the entire application call chain for a request message, while the current span identifier and its parent span identifiers can be used to locate the specific location of a call or process within the application call chain. For simplicity, the call or process corresponding to a single span identifier is referred to as a single span.

[0050] Using trace and span identifiers only captures application call chains, not infrastructure call chains. Application call chains are call chains at the application layer. Infrastructure call chains are not limited to the application layer and can also involve infrastructure layers such as the network layer, transport layer, link layer, and physical layer. In other words, the Java agent cannot trace call chains involving infrastructure layers such as the network layer, transport layer, link layer, and physical layer.

[0051] This is partly because Java agents cannot perform tracing at the kernel level.

[0052] For example, a Java agent running in one process cannot track how a single span progresses through the operating system stack of another process.

[0053] For another example, the Java agent cannot track which intermediate service network elements the call process corresponding to a span identifier passes through. For example, if microservice A sends a message to microservice B via intermediate service network element engine x (Nginx), the Java agent cannot track that the call process corresponding to the span identifier passes through Nginx, which is a load balancer.

[0054] Kernel state is the opposite of user state. Kernel state has higher permissions and can mobilize more resources. User state has lower permissions and can mobilize fewer resources. Kernel state programs run in kernel state space, while user state programs run in user state space.

[0055] In some embodiments, the extended Berkeley packet filter (eBPF) technology can be used to track the infrastructure call chain of a single span. The infrastructure call chain may include, for example, a call chain from an application to an operating system and then to an intermediate service network element.

[0056] Generally speaking, adding new features to the kernel requires modifying the kernel source code, an invasive operation that poses a significant risk to system stability. However, eBPF technology can increase kernel extensibility without modifying the kernel source code, making the kernel more flexible.

[0057] eBPF can intercept system calls, filter network packets, and perform other low-level operations through kernel-mode programs to extract data, which can then be processed by user-mode programs.

[0058] For example, by intercepting the request message through a kernel-mode program and parsing the trace identifier and span identifier in the request message, the infrastructure call chain obtained by eBPF and the application call chain obtained by the Java agent can be associated to achieve full-link tracing.

[0059] However, eBPF cannot parse the trace and span identifiers in encrypted request messages, making it impossible to correlate the infrastructure call chain with the application call chain.

[0060] Figure 2 is a schematic block diagram of a link tracking device 200 provided in an embodiment of the present application. The link tracking device 200 can be run in any cloud server, which is not limited in the present application. For example, it can be run in an elastic cloud server.

[0061] The link tracking device 200 may include a Java agent module 210 and an eBPF module 220. When a user registers a new microservice application (e.g., through the cloud management platform 110), the registration information may be pushed to the configuration center 230, which may then enable some configuration items of the Java agent module 210 and the eBPF module 220.

[0062] In some embodiments, the configuration center 230 may be located in the cloud management platform 110 .

[0063] The Java agent module 210 can be used to track application call chains, and the eBPF module 220 can be used to track infrastructure call chains. The Java agent module 210 can interact with the eBPF module 220. Through the mutual collaboration of these two modules, the application call chain and the infrastructure call chain can be associated, thereby achieving full-link tracing.

[0064] There can be multiple elastic cloud servers, and each elastic cloud server can run multiple microservices. In some embodiments, the number of Java agent modules 210 is the same as the number of microservices. In some embodiments, the number of eBPF modules 220 is the same as the number of elastic cloud servers.

[0065] The detailed description of the device embodiment is given below and will not be repeated here. The following first describes the method embodiment of the present application.

[0066] FIG3 is a schematic flowchart of a link tracing method 300 provided in an embodiment of the present application.

[0067] The method 300 may be applied to a cloud server, which may include the link tracking device 200 , and may run multiple microservices in the cloud server.

[0068] In some embodiments, the aforementioned multiple microservices are Java microservices. Java microservices are microservices written in the Java language.

[0069] It should be noted that the present application does not limit the multiple microservices tracked by the link tracking device 200 to only running on the same cloud server. For example, the link tracking device 200 can also track multiple microservices running on different cloud servers.

[0070] S310, the Java agent module 210 intercepts the message to be encrypted generated by the current microservice, and injects the trace identifier, the parent span identifier and the current span identifier into the message to be encrypted.

[0071] Among them, the message to be encrypted is used to call the child microservice after encryption, the current span identifier is the identifier of the current microservice calling the child microservice, the parent span identifier is the identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate the calls between the multiple microservices.

[0072] In some embodiments, the message to be encrypted includes a Hypertext Transfer Protocol Secure (HTTPS) message. However, it should be noted that the message to be encrypted in the embodiments of the present application is not limited to an HTTPS request message, and for example, it can also be compatible with a Hypertext Transfer Protocol (HTTP) message.

[0073] In some embodiments, the Java agent module 210 may inject a trace identifier, a parent span identifier, and a current span identifier into the request header of the message to be encrypted.

[0074] The microservice where the message to be encrypted is currently located is called the current microservice. The parent microservice is the microservice upstream and adjacent to the current microservice. The child microservice is the microservice downstream and adjacent to the current microservice. The message to be encrypted is the message generated by the current microservice to call the child microservice.

[0075] The embodiments of this application do not limit how the encrypted message is generated. For example, the encrypted message can be a decrypted message sent by a parent microservice, meaning that the current microservice merely forwards the message. Another example is that the current microservice can add some information to the message sent by the parent microservice to generate the encrypted message. Another example is that the current microservice can reconstruct a new encrypted message.

[0076] It is understood that S310 injects the parent span identifier into the message to be encrypted, indicating that the current microservice has a parent microservice. Obviously, method 300 provided in this embodiment of the application is not limited to tracing the current microservice if a parent microservice exists. If the current microservice does not have a parent microservice, S310 may only inject the trace identifier and the current span identifier into the message to be encrypted.

[0077] In some embodiments, when the current microservice receives a request from a parent microservice as a server, it caches the trace identifier and the parent span identifier as a call chain context. For example, the trace identifier and the parent span identifier can be cached in the form of thread variables.

[0078] In this way, when the current microservice generates a message to be encrypted as a client, the Java agent module 210 can intercept the message to be encrypted, obtain the trace identifier and the parent span identifier from the call chain context, and generate a new span identifier as the current span identifier to be injected into the intercepted message to be encrypted.

[0079] When the first microservice generates a message to be encrypted, the call chain context does not contain a trace identifier or a parent span identifier. In this case, the Java agent module 210 can generate a trace identifier and a current span identifier and inject them into the request message. Obviously, the situation where the first microservice (i.e., the current microservice without a parent microservice) generates a message to be encrypted is also within the scope of the embodiments of the present application.

[0080] To facilitate understanding of the relationship between the Java agent module 210, the eBPF module 220 and the microservice, an explanation is provided below with reference to FIG3 and FIG4.

[0081] 4 is a schematic diagram of the system modules of a message processing method 400 provided in an embodiment of the present application. The execution subject of the message processing method 400 may be a microservice, and the Java agent module 210 and the eBPF module 220 may monitor the execution process of the microservice 400 through the method 300.

[0082] S410: Generate a message to be encrypted.

[0083] S420: Encrypt the message to be encrypted to obtain a request message.

[0084] S430, calling a socket to send an application programming interface (API).

[0085] S440, calling the network transceiver system.

[0086] 4 , S410 , S420 , and S430 are executed in the user state space, and S440 is executed in the kernel state space.

[0087] The Java agent module 210 and the microservice executing method 400 run in the same process. The Java agent module 210 and the eBPF module 220 run in different processes. The eBPF module 220 may include an eBPF user-mode program 221 and an eBPF kernel-mode program 222, wherein the eBPF user-mode program 221 runs in user-mode space and the eBPF kernel-mode program 222 runs in kernel-mode space. The eBPF user-mode program 221 can be used to process request messages, and the eBPF kernel-mode program 222 can be used to intercept low-level operations such as system calls and filtering network packets, and to extract information such as request messages.

[0088] Referring to Figure 4, S310 can be executed in the user space by the Java agent module 210 when S410 is executed. For example, the configuration center 230 can deploy and start an application request interceptor in the Java agent module 210, and the application request interceptor can be used to monitor microservice application requests. When the microservice generates a message to be encrypted, the callback method is triggered, and the Java agent module 210 intercepts the message to be encrypted. For another example, the application request interceptor can intercept the method of the web client to process the message to be encrypted. When this method is executed, it indicates that a microservice is generating a message to be encrypted, and the Java agent module 210 can intercept the message to be encrypted.

[0089] S320: The Java agent module 210 intercepts the request message.

[0090] The request message is the encrypted message of the message to be encrypted.

[0091] In some embodiments, the request message includes a Hypertext Transfer Protocol Secure (HTTPS) message.

[0092] 4 , S320 may be executed by the Java agent module 210 in the user space when S420 is executed.

[0093] S420 can be encrypted based on Java Secure Socket Extension (JSSE). Accordingly, the Java proxy module 210 can intercept the request message by setting an interceptor.

[0094] For example, the configuration center 230 can deploy and start a JSSE encryption API interceptor in the Java agent module 210. The JSSE encryption API interceptor can monitor whether the system calls sun.security.ssl.OutputRecord.write(). The JSSE encryption API interceptor can be used to monitor the Secure Sockets Layer (SSL) encryption class. When the encryption method is called, a callback method is triggered, and the Java agent module 210 intercepts the request message.

[0095] S330: The Java agent module 210 determines the message feature code and the association relationship between the message feature code and the trace identifier, the parent span identifier, and the current span identifier based on the request message.

[0096] The message signature code can reflect the characteristics of the request message. One request message corresponds to one message signature code, and different request messages correspond to different message signature codes. In other words, there is a one-to-one correspondence between request messages and message signature codes.

[0097] The current span identifier is injected by Java agent module 210 at S320 , so Java agent module 210 has information about the current span identifier. Before encrypting the message, Java agent module 210 can obtain the trace identifier and parent span identifier of the message to be encrypted. In this way, Java agent module 210 can associate this information to obtain an association relationship.

[0098] In some embodiments, the Java agent module 210 determines the message feature code according to the request message, including: the Java agent module 210 processes the request message according to a hash algorithm to determine the message feature code.

[0099] The hash algorithm can map a request message into a message signature of a certain length. This algorithm ensures a one-to-one correspondence between request messages and message signatures. That is, the same request message corresponds to the same message signature, and different request messages correspond to different message signatures.

[0100] The embodiments of the present application are not limited to determining the message signature code only by the hash algorithm. For example, the request message itself can be used as the message signature code. However, the number of bytes of the request message itself is often large, which will make the message signature code longer. However, this does not affect the implementation of the embodiments of the present application. The embodiments of the present application can also determine the message signature code based on the request message using other algorithms, such as performing variable byte encoding (VarByte) on the request message to obtain the message signature code.

[0101] In an embodiment of the present application, the request message is processed by a hash algorithm, which not only realizes the correspondence between the request message and the message feature code, but also makes the length of the message feature code controllable, thereby reducing the overhead of the link tracking device 200 in the process of determining and reporting the message feature code.

[0102] S340 , the Java agent module 210 reports the association relationship to the eBPF module 220 .

[0103] In some embodiments, the thread for encrypting the message to be encrypted in the aforementioned multiple microservices is asynchronous with the thread for sending and receiving the request message.

[0104] Due to the different client frameworks or configurations used, the encryption thread and the network transceiver thread may be in different threads. In the case of thread asynchrony, the eBPF module 220 cannot obtain the correspondence between the encrypted message and the trace identifier and span identifier through the monitoring thread, so it is necessary to interact with other modules to obtain the correspondence. In the embodiment of the present application, through the interaction between the Java agent module 210 and the eBPF module 220, the eBPF module 220 can parse the encrypted message and obtain the correspondence between the message and the trace identifier and span identifier, thereby realizing the association between the application call chain and the infrastructure call chain.

[0105] For example, the eBPF user-mode program 221 may set a monitoring interface, so that the Java agent module 210 may report the association relationship to the monitoring interface of the eBPF module 220. When the monitoring interface monitors a reporting request, it may receive the association relationship.

[0106] It can be understood that the association relationship is the association relationship between the message feature code, the trace identifier, the parent span identifier and the current span identifier.

[0107] In some embodiments, the Java agent module 210 reports the association relationship to the eBPF module 220, including: the Java agent module 210 reports the association relationship to the interface of the eBPF module 220; wherein, the method 300 also includes: the eBPF module 220 caches the association relationship.

[0108] For example, the eBPF user-mode program 221 may set a cache area in the user-mode space, where the cache area is used to cache the association relationship between the message signature, the trace identifier, the parent span identifier, and the current span identifier.

[0109] In an embodiment of the present application, the association relationship reported by the Java agent module 210 can be cached by the eBPF module 220, so that when the eBPF module 220 needs to match the association relationship, it can conveniently call the data in the cache area, thereby improving efficiency.

[0110] S350: The eBPF module 220 determines the infrastructure calling information in the process of the current microservice calling the child microservice according to the request message.

[0111] 4 , the eBPF kernel-mode program 222 loaded in the kernel-mode space can determine the infrastructure call information of the current microservice calling the child microservice.

[0112] The infrastructure call information in the process of the current microservice calling the child microservice according to the request message can be understood as the infrastructure call information of the current microservice calling the child microservice, and can also be understood as the infrastructure call information in the process of the current microservice sending the request message to the child microservice.

[0113] In some embodiments, the eBPF kernel-mode program 222 can determine the call chain from the application to the operating system, such as the call chain from the application to iptables. Iptables is a network firewall in Linux that can be used to manage the processing and forwarding of network packets. This application does not limit the specific form of the operating system; for example, the operating system may also include a network interface card (ETH).

[0114] In some embodiments, the eBPF kernel-mode program 222 can determine the call chain from the application to the intermediate service network element, for example, the call chain from the application to Envoy, where Envoy is an open source cloud-native proxy. This application does not limit the specific form of the intermediate service network element, for example, the intermediate service network element can also include Nginx.

[0115] S360: The eBPF module determines the message feature code according to the request message.

[0116] Referring to Figure 4, S440 is executed in the kernel space. The eBPF kernel program 222 loaded in the kernel space can determine the infrastructure call information of the request message. For example, the eBPF kernel program 222 can load an eBPF probe (probe or tracepoint), which can be used to monitor whether the kernel program calls the network transceiver system, that is, whether S440 is executed. For example, it can monitor whether tcp_sendmsg() is called. When the eBPF probe monitors the execution of S440, the eBPF kernel program 222 can obtain the request message to be sent and write the request message to the BPF storage (map).

[0117] To interact with the eBPF user-mode program 221, the eBPF kernel-mode program 222 can also use the perf_event_open() function to create a perf_event, which can be bound to the network transceiver system. Once a kernel event for a network transceiver system call occurs, the eBPF user-mode program 221 can be notified to obtain a new request message from the BPF map.

[0118] In this way, when the eBPF kernel-mode program 222 detects that S440 is executed, it can notify the eBPF user-mode program 221 to obtain the request message, and the eBPF user-mode program 221 determines the message feature code based on the request message.

[0119] In some embodiments, the eBPF module 220 determines the message feature code according to the request message, including: the eBPF module 220 processes the request message according to the hash algorithm to determine the message feature code.

[0120] The hash algorithm can map a request message into a message signature of a certain length. This algorithm ensures a one-to-one correspondence between request messages and message signatures. That is, the same request message corresponds to the same message signature, and different request messages correspond to different message signatures.

[0121] The embodiments of the present application are not limited to determining the message signature code using only a hash algorithm. For example, the request message itself can be used as the message signature code. However, the number of bytes in the request message itself is often large, which will result in a longer message signature code. However, this does not affect the implementation of the embodiments of the present application. The embodiments of the present application can also determine the message signature code based on the request message using other algorithms, such as performing VarByte encoding on the request message to obtain the message signature code.

[0122] In one embodiment, the eBPF module 220 may determine the message signature in the same manner as the Java agent module 210. In another embodiment, the eBPF module 220 may determine the message signature in a manner that differs from the Java agent module 210. In this way, the eBPF module 220 may search for the correct association relationship using a message signature that is not completely consistent with the Java agent module 210.

[0123] In the embodiment of the present application, the eBPF side processes the request message through a hash algorithm, which not only realizes the correspondence between the request message and the message signature code, but also makes the length of the message signature code controllable, thereby reducing the overhead of the link tracking device 200 during the process of determining and reporting the message signature code. In addition, the eBPF side uses the same message signature code generation method as the Java proxy side, so that the eBPF side can obtain the same message signature code, and realizes the parsing of the encrypted request message by the eBPF module 220, thereby enabling full-link call chain tracing.

[0124] S370: The eBPF module 220 determines the trace identifier, the parent span identifier, and the current span identifier according to the message feature code and the association relationship.

[0125] For example, the eBPF module 220 may use the message signature to perform a match in the association relationship to obtain a trace identifier, a parent span identifier, and a current span identifier that match the message signature. The association relationship may be stored in a memory cache of the eBPF module 220.

[0126] S380: The eBPF module determines the current link call information of the current microservice calling the child microservice.

[0127] The current link call information includes the trace identifier, the parent span identifier, the current span identifier and the infrastructure call information.

[0128] The current link call information includes not only the application call chain information but also the infrastructure call information. The application call chain information includes the trace ID, the parent span ID, and the current span ID.

[0129] In the embodiment of the present application, the Java agent module 210 determines the application call chain, and the eBPF module 220 determines the infrastructure call chain. Through the trace identifier and the span identifier, the association between the application call chain and the infrastructure call chain is achieved. The Java agent module 210 reports the association between the message feature code and the trace identifier and the span identifier to the eBPF module 220, thereby enabling the eBPF module 220 to parse the encrypted message. Therefore, the call chain tracing method provided in the embodiment of the present application can associate the distributed application call chain with the infrastructure call chain of the virtual network and the physical network, and can achieve full-link tracing.

[0130] The above method 300 tracks the current link call information for the current microservice. It is understood that method 300 can track each current microservice. When these current microservices become parent microservices, method 300 completes tracking of the parent microservices. When these microservice calls are completed, method 300 completes tracking of all microservice calls. Therefore, method 300 can obtain integrated link call information for each request message. This integrated link call information includes application call information and infrastructure call information, as well as information on multiple link calls.

[0131] In some embodiments, the cloud server includes a link tracking device 200, and the device 200 may also include an aggregation module. The method 300 also includes: the eBPF module 220 reports the current link call information to the aggregation module, and the aggregation module is used to aggregate multiple link call information.

[0132] It should be noted that the Java agent module 210 and the eBPF module 220 can run on the tenant's cloud server, where the tenant's various microservices are running. The aggregation module can run in the management and operation area, such as the cloud management platform 110.

[0133] The aggregation module can aggregate multiple link call information. In other words, the aggregation module can generate a full link trace for a stream consisting of multiple request messages based on the current link call information of multiple request messages. For example, multiple link call information can be aggregated through 5-tuple matching.

[0134] In the embodiment of the present application, by integrating the link call information of multiple microservices, the full link tracking of the calls between each microservice can be performed.

[0135] Furthermore, the aggregation module can persist the aggregated integrated link call information in the database, thereby facilitating subsequent query or display of these call chains.

[0136] The method embodiments of the present application are described in detail above. The following describes the device embodiments of the present application. The device embodiments correspond to the method embodiments, so for parts not described in detail, please refer to the previous method embodiments. The device can implement any possible implementation method of the above method.

[0137] Referring to FIG2 , the link tracking device 200 includes: a Java module 210, which is used to intercept the to-be-encrypted message generated by the current microservice and inject a trace identifier, a parent span identifier and a current span identifier into the to-be-encrypted message, wherein the to-be-encrypted message is used to call the child microservice after encryption, the current span identifier is the identifier of the current microservice calling the child microservice, the parent span identifier is the identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate calls between the multiple microservices; intercept a request message, which is the encrypted message of the to-be-encrypted message; determine a message feature code based on the request message, and compare the message feature code with the t The association relationship between the race identifier, the parent span identifier and the current span identifier; reporting the association relationship to the eBPF module 220; the eBPF module 220 is used to determine the infrastructure call information in the process of the current microservice calling the child microservice according to the request message; determining the message feature code according to the request message; determining the trace identifier, the parent span identifier and the current span identifier according to the message feature code and the association relationship; determining the current link call information of the current microservice calling the child microservice, the current link call information including the trace identifier, the parent span identifier, the current span identifier and the infrastructure call information.

[0138] The Java agent module 210 and the eBPF module 220 can both be implemented in software or hardware. For example, the implementation of the Java agent module 210 will be described below using the Java agent module 210 as an example. Similarly, the implementation of the eBPF module 220 can refer to the implementation of the Java agent module 210.

[0139] As an example of a software functional unit, the Java agent module 210 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the Java agent module 210 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0140] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0141] As an example of a hardware functional unit, Java agent module 210 may include at least one computing device, such as a server. Alternatively, Java agent module 210 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0142] The multiple computing devices included in the Java agent module 210 can be distributed in the same region or in different regions. The multiple computing devices included in the Java agent module 210 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the Java agent module 210 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0143] It should be noted that, in other embodiments, the Java agent module 210 can be used to execute any step in the link tracing method, and the eBPF module 220 can be used to execute any step in the link tracing method. The steps that the Java agent module 210 and the eBPF module 220 are responsible for implementing can be specified as needed. The full functions of the link tracking device 200 are realized by respectively implementing different steps in the link tracing method through the Java agent module 210 and the eBPF module 220.

[0144] This application also provides a computing device 500. As shown in Figure 5, computing device 500 includes a bus 502, a processor 504, a memory 506, and a communication interface 508. Processor 504, memory 506, and communication interface 508 communicate with each other via bus 502. Computing device 500 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 500.

[0145] Bus 502 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG5 shows a single line, but this does not imply a single bus or type of bus. Bus 502 may include a path for transmitting information between various components of computing device 500 (e.g., memory 506, processor 504, and communication interface 508).

[0146] The processor 504 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0147] The memory 506 may include volatile memory, such as random access memory (RAM). The memory 506 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0148] The memory 506 stores executable program code, and the processor 504 executes the executable program code to implement the functions of the aforementioned Java module 210 and eBPF module 220, thereby implementing the link tracing method. In other words, the memory 506 stores instructions for executing the link tracing method.

[0149] The communication interface 508 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 500 and other devices or a communication network.

[0150] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0151] As shown in Figure 6, the computing device cluster includes at least one computing device 500. The memory 506 in one or more computing devices 500 in the computing device cluster may store the same instructions for executing the link tracing method.

[0152] In some embodiments, the memory 506 of one or more computing devices 500 in the computing device cluster may also store partial instructions for executing the link tracing method. In other words, the combination of one or more computing devices 500 can jointly execute instructions for executing the detection link tracing method.

[0153] It should be noted that the memory 506 in different computing devices 500 in the computing device cluster can store different instructions, each for executing a portion of the functions of the link tracking apparatus 200. In other words, the instructions stored in the memory 506 in different computing devices 500 can implement the functions of one or more modules in the Java agent module 210 and the eBPF module 220.

[0154] In some embodiments, one or more computing devices in a computing device cluster may be connected via a network, which may be a wide area network or a local area network.

[0155] Figure 7 illustrates a possible implementation. As shown in Figure 7 , two computing devices 500A and 500B are connected via a network. Specifically, the connection to the network is achieved through a communication interface within each computing device. In this possible implementation, memory 506 within computing device 500A stores instructions for executing the functions of Java agent module 210. Simultaneously, memory 506 within computing device 500B stores instructions for executing the functions of eBPF module 220.

[0156] The connection method between the computing device clusters shown in Figure 7 can be considered to be that the link tracing method provided by this application requires a large amount of application call chain tracing and infrastructure call chain tracing, so it is considered to hand over the functions implemented by the Java agent module 210 to the computing device 500B for execution.

[0157] It should be understood that the functionality of the computing device 500A shown in FIG7 may also be implemented by multiple computing devices 500. Similarly, the functionality of the computing device 500B may also be implemented by multiple computing devices 500.

[0158] In some embodiments, the memory 506 of one or more computing devices 500 in the computing device cluster may also store partial instructions for executing the link tracing method. In other words, the combination of one or more computing devices 500 can jointly execute the instructions for executing the link tracing method.

[0159] The present application also provides a computer program product containing instructions. This computer program product can be software or a program product containing instructions that can be run on a computing device or stored in any available medium. When this computer program product is run on at least one computing device, it causes the at least one computing device to perform the link tracing method described above.

[0160] Embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of storing data on a computing device, or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, or a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the link tracing method described above.

[0161] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0162] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0163] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of modules is only a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0164] Modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical units, that is, they may be located in one place or distributed across multiple modules. Some or all of the modules may be selected to achieve the purpose of the present embodiment according to actual needs.

[0165] In addition, the functional modules in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more modules may be integrated into one unit.

[0166] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0167] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A link tracking method, characterized in that: The method is applied to a cloud server, the cloud server includes a Java proxy module and an extended Berkeley packet filter eBPF module, and multiple microservices are running in the cloud server. The method includes: The Java proxy module intercepts the message to be encrypted generated by the current microservice, and injects a trace identifier, a parent span identifier and a current span identifier into the message to be encrypted, wherein the message to be encrypted is used to call the child microservice after encryption, the current span identifier is the identifier of the current microservice calling the child microservice, the parent span identifier is the identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate calls between the multiple microservices; The Java proxy module intercepts a request message, wherein the request message is an encrypted message of the message to be encrypted; The Java agent module determines the message feature code and the association relationship between the message feature code and the trace identifier, the parent span identifier and the current span identifier according to the request message; The Java agent module reports the association relationship to the eBPF module; The eBPF module determines the infrastructure calling information in the process in which the current microservice calls the child microservice according to the request message; The eBPF module determines the message feature code according to the request message; The eBPF module determines the trace identifier, the parent span identifier, and the current span identifier according to the message feature code and the association relationship; The eBPF module determines the current link call information of the current microservice calling the child microservice, where the current link call information includes the trace identifier, the parent span identifier, the current span identifier, and the infrastructure call information.

2. The method according to claim 1, characterized in that Also includes: The eBPF module reports the current link call information to an aggregation module in the cloud management platform, and the aggregation module is used to aggregate multiple link call information.

3. The method according to claim 1 or 2, characterized in that: The Java agent module determines the message feature code according to the request message, including: The Java proxy module processes the request message according to a hash algorithm to determine the message feature code.

4. The method according to claim 3, characterized in that The eBPF module determines the message feature code according to the request message, including: The eBPF module processes the request message according to the hash algorithm to determine the message feature code.

5. The method according to any one of claims 1 to 4, characterized in that: The Java agent module reports the association relationship to the eBPF module, including: The Java agent module reports the association relationship to the interface of the eBPF module; The method further comprises: The eBPF module caches the association relationship.

6. The method according to any one of claims 1 to 5, characterized in that The request message includes a Hypertext Transfer Protocol Security (HTTPS) request message.

7. The method according to any one of claims 1 to 6, characterized in that: The multiple microservices are Java microservices.

8. The method according to any one of claims 1 to 7, characterized in that The threads for encrypting the to-be-encrypted messages in the multiple microservices are asynchronous with the threads for sending and receiving the request messages.

9. A link tracking device, characterized in that: The device is applied to a cloud server, in which a plurality of microservices are running, and the device comprises: A Java proxy module is used to intercept the message to be encrypted generated by the current microservice, and inject a trace identifier, a parent span identifier and a current span identifier into the message to be encrypted, wherein the message to be encrypted is used to call the child microservice after encryption, the current span identifier is the identifier of the current microservice calling the child microservice, the parent span identifier is the identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate calls between multiple microservices; intercept a request message, the request message is the encrypted message of the message to be encrypted; determine a message feature code and an association relationship between the message feature code and the trace identifier, the parent span identifier and the current span identifier according to the request message; report the association relationship to the extended Berkeley packet filter eBPF module; The eBPF module is used to determine the infrastructure call information of the current microservice calling the child microservice according to the request message; determine the message feature code according to the request message; determine the trace identifier, the parent span identifier and the current span identifier according to the message feature code and the association relationship; determine the current link call information of the current microservice calling the child microservice, and the current link call information includes the trace identifier, the parent span identifier, the current span identifier and the infrastructure call information.

10. The device according to claim 9, characterized in that The eBPF module is also used to report the current link call information to the aggregation module in the cloud management platform; The aggregation module is used to aggregate multiple link call information.

11. The device according to claim 9 or 10, characterized in that The Java agent module is specifically used for: The request message is processed according to a hash algorithm to determine the message feature code.

12. The device according to claim 11, characterized in that The eBPF module is specifically used for: The request message is processed according to the hash algorithm to determine the message feature code.

13. The device according to any one of claims 9 to 12, characterized in that The Java agent module is specifically used to report the association relationship to the interface of the eBPF module; The eBPF module is specifically used to cache the association relationship.

14. The device according to any one of claims 9 to 13, characterized in that The request message includes a Hypertext Transfer Protocol Security (HTTPS) request message.

15. The device according to any one of claims 9 to 14, characterized in that The multiple microservices are Java microservices.

16. The device according to any one of claims 9 to 15, characterized in that The threads for encrypting the to-be-encrypted messages in the multiple microservices are asynchronous with the threads for sending and receiving the request messages.

17. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 8.

18. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 8.

19. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 8.

Images