Methods, devices, equipment, systems and media for extracting abnormal indicators of operating systems

Abstract

This specification provides one or more embodiments of a method, apparatus, device, distributed system, and storage medium for extracting abnormal indicators of an operating system. The method is applied to a multi-operating system scenario; the method includes: determining the operating status of the operating system based on the acquisition time of at least one resource of the operating system; if the operating status is unhealthy, collecting at least one indicator to be checked from the operating system, and acquiring at least one reference indicator from other operating systems whose operating status is healthy; performing outlier analysis on the indicator to be checked based on the reference indicator, and extracting abnormal indicators of the operating system in the unhealthy state. This embodiment achieves proactive identification of the operating status of the operating system and proactive investigation of operating systems in the unhealthy state to extract abnormal indicators.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of terminal technology, and in particular to a method, apparatus, device, distributed system, and storage medium for extracting abnormal indicators of an operating system. Background Technology

[0002] An operating system (OS) is a computer program that manages computer hardware and software resources. The operating system handles fundamental tasks such as managing and allocating memory, determining the priority of system resource allocation, controlling input and output devices, operating networks, and managing file systems. The operating system is the foundation for all application software; its healthy operation directly affects the quality of application software performance. Summary of the Invention

[0003] In view of the above, one or more embodiments of this specification provide a method, apparatus, device, distributed system, and storage medium for extracting abnormal indicators of an operating system.

[0004] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions:

[0005] According to a first aspect of one or more embodiments of this specification, a method for extracting abnormal indicators of an operating system is proposed, applicable to multi-operating system scenarios; the method includes:

[0006] The operating state of the operating system is determined based on the acquisition time of at least one resource of the operating system.

[0007] If the operating status is unhealthy, at least one indicator to be checked from the operating system is collected, and at least one reference indicator from other operating systems whose operating status is healthy is obtained.

[0008] Outlier analysis is performed on the indicators to be checked based on the reference indicators to extract abnormal indicators of the operating system that is in an unhealthy state.

[0009] According to a second aspect of one or more embodiments of this specification, an anomaly indicator extraction device for an operating system is proposed, applicable to multi-operating system scenarios; the device includes:

[0010] The running status determination module is used to determine the running status of the operating system based on the acquisition time of at least one resource of the operating system;

[0011] The indicator acquisition module is used to collect at least one indicator to be checked from the operating system if the running status is unhealthy, and to collect at least one reference indicator from other operating systems whose running status is healthy.

[0012] The abnormal indicator extraction module is used to perform outlier analysis on the indicator to be checked based on the reference indicator, and extract abnormal indicators of the operating system that are in an unhealthy state.

[0013] According to a third aspect of one or more embodiments of this specification, an electronic device is provided, the electronic device having multiple operating systems installed, the electronic device comprising:

[0014] processor;

[0015] Memory used to store processor-executable instructions;

[0016] The processor implements the method as described in any one of the first aspects by executing the executable instructions.

[0017] According to a fourth aspect of one or more embodiments of this specification, a distributed system is proposed, the distributed system comprising a plurality of data nodes, the data nodes having one or more operating systems installed;

[0018] Any of the data nodes is used to perform the method described in any one of the first aspects.

[0019] According to a fifth aspect of one or more embodiments of this specification, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of the method as described in any of the first aspects.

[0020] This specification provides one or more embodiments for multi-operating system scenarios, offering a method for extracting abnormal indicators of an operating system. This method determines the operating system's running status based on the acquisition time of at least one resource, initially assessing the operating system's health from a resource perspective, thus proactively identifying the operating system's running status. If the running status is unhealthy, at least one indicator to be checked from the operating system is statistically analyzed, along with at least one reference indicator from other operating systems with healthy running statuses. Outlier analysis is then performed on the indicator to be checked based on the reference indicator to automatically extract abnormal indicators from the operating system. This embodiment provides a proactive operating system troubleshooting solution, enabling the method provided in this specification to be executed in real-time or periodically to proactively monitor the operating system's running status and automatically extract abnormal indicators when the operating system is abnormal. This allows for the location of the cause of the abnormality based on the abnormal indicators, and the automatic extraction of abnormal indicators also improves efficiency. Attached Figure Description

[0021] Figure 1This is an exemplary embodiment of a distributed system structure diagram.

[0022] Figure 2 This is a flowchart illustrating an exemplary embodiment of a method for extracting abnormal indicators from an operating system.

[0023] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an exemplary embodiment.

[0024] Figure 4 This is a block diagram of an operating system anomaly indicator extraction device provided in an exemplary embodiment. Detailed Implementation

[0025] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0026] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0027] An operating system (OS) is a computer program that manages computer hardware and software resources. The operating system handles fundamental tasks such as managing and allocating memory, prioritizing system resource allocation, controlling input and output devices, operating the network, and managing the file system. The operating system also provides a user interface for interacting with the system.

[0028] Examples of operating systems include, but are not limited to, Windows, Linux, iOS, Android, and UNIX. The operating system is the foundation for all application software; its healthy operation directly affects the quality of application software performance.

[0029] This specification provides a method for extracting abnormal indicators of operating systems in a multi-operating system scenario to proactively troubleshoot the operating system. It determines the operating system's running status based on the acquisition duration of at least one resource, enabling proactive identification of the operating system's operational condition and initially determining its health from a resource perspective. If the operating status is unhealthy, at least one indicator to be checked from the operating system is statistically analyzed, along with at least one reference indicator from other operating systems that are in a healthy state. Outlier analysis is then performed on the indicator to be checked based on the reference indicator to automatically extract abnormal indicators from the operating system. This embodiment provides a technical solution for proactively troubleshooting the operating system, enabling the method provided in this specification to be executed in real-time or periodically to proactively monitor the operating system's operation and automatically extract abnormal indicators when the operating system is abnormal. This allows for the location of the cause of the abnormality based on the abnormal indicators, and the automatic extraction of abnormal indicators also improves troubleshooting efficiency.

[0030] In one exemplary embodiment, the operating system anomaly indicator extraction method provided in this specification can be applied to, for example... Figure 1 In the distributed system shown, the distributed system is a loosely coupled system composed of multiple data nodes 100 interconnected through communication lines. Each data node 100 is a computing device capable of independently processing a specific transaction; the computing device can be a physical device or a virtual machine. Each data node has one or more operating systems installed. Any data node in the distributed system can execute the abnormal indicator extraction method for the operating system provided in this embodiment. In one example, the data node has a computer program product installed, which includes computer programs / instructions. When executed by the processor in the data node, the computer programs / instructions can implement the steps in the abnormal indicator extraction method for the operating system provided in this embodiment.

[0031] In another exemplary embodiment, the operating system anomaly indicator extraction method provided in this specification can be applied to electronic devices having multiple operating systems. In one example, the electronic device has a computer program product installed, which includes computer programs / instructions that, when executed by a processor in the electronic device, can implement the steps in the operating system anomaly indicator extraction method provided in this specification.

[0032] Please see Figure 2 , Figure 2 This is a flowchart illustrating a method for extracting abnormal indicators of an operating system, provided in an embodiment of this specification. The method can be applied to multi-operating system scenarios. The method includes:

[0033] In step S101, the operating state of the operating system is determined based on the acquisition time of at least one resource of the operating system.

[0034] In step S102, if the operating state is unhealthy, at least one indicator to be checked from the operating system is collected, and at least one reference indicator from other operating systems whose operating state is healthy is obtained.

[0035] In step S103, outlier analysis is performed on the indicators to be checked based on the reference indicators to extract abnormal indicators of the operating system that is in an unhealthy state.

[0036] In this embodiment, data nodes in the distributed system or electronic devices with multiple operating systems can execute step S101 in real time or periodically according to actual conditions to actively perform health checks on the operating system's operation status, ensuring the good operation of the operating system. If the operating system's operating status is unhealthy, steps S102 and S103 are executed to automatically extract abnormal indicators of the operating system and locate the cause of the operating system's abnormality.

[0037] In some embodiments, the health status of the operating system can be determined based on the acquisition time of one or more resources. For example, the acquisition time of various resources of the operating system can be statistically analyzed. If the acquisition time of all resources is less than or equal to a preset time, it indicates that the resource acquisition efficiency of the operating system is high, and the operating system can be determined to be in a healthy state. Conversely, if the acquisition time of at least one resource is greater than the preset time, it indicates that the resource acquisition efficiency of the operating system is low, and the operating system can be determined to be in an unhealthy state. It is understood that the preset time for each resource can be the same or different, and the specific value of the preset time can be set according to the actual application scenario. For example, the preset time for a certain resource, such as CPU resources, can be determined based on the average acquisition time of CPU resources in one or more operating systems that are in a healthy state, as selected by the operators.

[0038] In some embodiments, at least one resource of the operating system includes, but is not limited to, processing resources (such as CPU resources), memory resources, network resources, I / O resources, or lock resources, etc.

[0039] For example, the acquisition time of the processing resources includes the time for requesting the allocation of processing resources, that is, the time elapsed from sending the processing resource allocation request to the allocation of the processing resource. The shorter the acquisition time of the processing resources, the more idle processing resources there are, and the healthier the operating system is. Conversely, the longer the acquisition time, the more likely the processing resources are being occupied, and the operating system may be in an unhealthy state.

[0040] For example, the acquisition time of the memory resource includes the time for requesting memory resource allocation, that is, the time elapsed from sending the memory resource allocation request to the memory resource being allocated. The shorter the acquisition time of the memory resource, the more free memory resources there are, and the healthier the operating system is. Conversely, the longer the acquisition time, the more memory resources may be occupied, and the operating system may be in an unhealthy state.

[0041] For example, the acquisition time of the network resource includes the data packet transmission and reception time, that is, the time required from sending a request data packet to receiving a response data packet. The shorter the acquisition time of the network resource, the better the network performance of the operating system and the healthier the operating system is. Conversely, the longer the acquisition time, the worse the network performance of the operating system and the more unhealthy the operating system may be.

[0042] For example, the acquisition time of the IO (input / output) resources includes the response time of input operations and / or output operations. The shorter the response time, the better the read / write performance of the operating system and the healthier the operating system is. Conversely, the longer the response time, the worse the read / write performance of the operating system and the more unhealthy the operating system may be.

[0043] For example, the acquisition time of the lock resource includes: the waiting time for accessing a shared resource; wherein at least two processes simultaneously accessing the shared resource have a mutual exclusion relationship, and if the shared resource is already occupied, other processes accessing the shared resource enter a waiting state until the shared resource is released. Therefore, the shorter the waiting time, the healthier the operating system is; conversely, the longer the waiting time, the more processes may need to access the shared resource, and the operating system may be in an unhealthy state.

[0044] In some embodiments, the operating system includes kernel mode and user mode. The program product implementing the abnormal indicator extraction method for the operating system provided in the embodiments of this specification can be installed in user mode. Further, the acquisition time of at least one resource of the operating system can be collected in kernel mode based on BPF technology. The Berkeley Packet Filter (BPF) aims to provide a method for filtering packets and to avoid useless packet copying from kernel mode to user mode. BPF's filtering function is implemented in the form of a BPF virtual machine machine language interpreter. Programs in this language can capture packet data, perform arithmetic operations on the data in the packets, and compare the results with constants, data in the packets, or test bits in the results. Based on the comparison result, it decides whether to accept or reject the packet. Without restarting the operating system, a program code for calculating the acquisition time of at least one resource of the operating system can be injected into kernel mode based on BPF technology. Then, by running this program code, after obtaining statistical information on the acquisition time of at least one resource of the operating system, the statistical information is reported to the program product in user mode.

[0045] Of course, other methods can also be used to obtain the acquisition time of at least one resource of the operating system. In one example, the kernel mode of the operating system can be reprogrammed to enable it to report the acquisition time of at least one resource to the user mode. In another example, code can be injected into the operating system through patching, and then, by running this code, statistical information on the acquisition time of at least one resource can be obtained and reported to the program product in the user mode. The patching method differs from using BPF technology to collect the acquisition time of at least one resource of the operating system. The code injected using BPF can be executed by a virtual machine, without altering the operating system itself, thus maximizing the security of the operating system. Errors in the injected code will not affect other functions of the operating system. In contrast, the code injected through patching is directly run by the processor in the physical machine, and errors in the injected code may affect other functions of the operating system.

[0046] In some embodiments, if the operating system is in an unhealthy state, at least one indicator to be checked in the operating system can be collected for outlier detection. For example, at least one indicator to be checked in the operating system can be collected, along with at least one reference indicator from at least one other operating system in a healthy state. Then, outlier analysis is performed on the indicator to be checked based on the reference indicator to extract abnormal indicators of the operating system. The reference indicator and the indicator to be checked are of the same type, such as both being CPU utilization. In this embodiment, outlier analysis quickly filters out abnormal indicators and pinpoints the cause of operating system anomalies.

[0047] Generally, if the content indicated by the indicator to be checked is not abnormal, the difference between the indicator to be checked and one or more reference indicators of the same type is not large, for example, they may all be within a preset difference range. If the content indicated by the indicator to be checked is abnormal, there may be a large difference between the indicator to be checked and one or more reference indicators of the same type. The outlier analysis process is to detect whether there are outliers among the indicators to be checked that differ significantly from one or more reference indicators of the same type. If so, the outlier is also the abnormal indicator of the operational indicator.

[0048] In one possible implementation, the difference between the indicator to be checked and the reference indicator can be compared. If the difference between the indicator to be checked and the reference indicator exceeds a preset difference, the indicator to be checked can be determined to be an abnormal indicator of the operating system in an unhealthy state, and the abnormal indicator can be extracted to locate the cause of the operating system abnormality. The reference indicator is an indicator of the same type as the indicator to be checked, such as CPU utilization, memory utilization, or packet loss rate.

[0049] In some embodiments, when the operating system is in an unhealthy state, all indicators to be checked in the operating system can be collected, along with all reference indicators from at least one other operating system in a healthy state. For each indicator to be checked, outlier analysis is performed on it based on at least one reference indicator of the same type, thereby extracting abnormal indicators of the operating system based on the outlier analysis results. In this embodiment, checking all indicators to be checked in the operating system helps to accurately pinpoint the root cause of the problem.

[0050] In one example, taking CPU utilization as an example, the CPU utilization of an operating system in an unhealthy state can be compared with one or more reference CPU utilizations of one or more other operating systems in a healthy state. If the difference between the CPU utilization to be checked and one or more reference CPU utilizations is greater than a preset difference, the CPU utilization to be checked is determined to be an abnormal indicator of the operating system in an unhealthy state, and the CPU resources of the operating system in an unhealthy state have abnormal problems.

[0051] In other embodiments, considering the large number of indicators to be checked in the operating system—potentially dozens or even hundreds—outlier analysis would be inefficient if performed on each indicator individually. Therefore, to improve efficiency, this specification considers that the health of the operating system is determined based on the acquisition time of various resources. If the acquisition time of a resource exceeds a preset time, it is highly probable that the resource is abnormal. For example, taking memory resources as an example, if the acquisition time of memory resources exceeds a preset time, it indicates a possible abnormality in the memory resources of the operating system. Therefore, the resource with the acquisition time exceeding the preset time can be identified as the resource to be checked, and at least one indicator to be checked for that resource is statistically analyzed. Furthermore, at least one reference indicator related to the resource to be checked is obtained from other operating systems in a healthy state. Then, outlier analysis is performed on the indicators to be checked based on the reference indicator to extract abnormal indicators of the operating system in an unhealthy state. In this embodiment, by analyzing only at least one indicator corresponding to the resource to be checked, the number of indicators to be analyzed is reduced, thus improving analysis efficiency.

[0052] The indicators corresponding to each resource can be determined based on the pre-stored mapping relationship between resources and indicators. This mapping relationship can be determined manually or automatically by the electronic device based on the relevant resources involved in the statistical analysis of the relevant indicators. The indicators corresponding to different resources may have the same parts or may be different from each other, and can be specifically set according to the actual application scenario.

[0053] For example, taking CPU resources as an example, the metrics corresponding to CPU resources include, but are not limited to, CPU utilization (such as kernel-mode CPU utilization, user-mode CPU utilization, CPU utilization of various applications, and CPU utilization of soft interrupts, etc.), CPU cache capacity, CPU operating frequency, the percentage of total CPU time spent using internal virtual machines to run tasks, the number of context switches per second, the percentage of time the CPU is idle due to processes waiting for disk I / O (CPU iowait time), or the number of runnable queues, etc.

[0054] For example, the metrics corresponding to memory resources include, but are not limited to, memory utilization (such as kernel-mode memory utilization, user-mode memory utilization, cache utilization), memory operating frequency, storage speed, available memory size, swap partition size, or percentage of free swap partition.

[0055] For example, metrics corresponding to network resources include, but are not limited to, incoming network traffic per second, outgoing network traffic per second, packet loss rate, transmission rate, bandwidth, throughput, or latency, etc.

[0056] For example, the metrics corresponding to IO resources include, but are not limited to, disk remaining percentage, disk read speed, disk write speed, disk inode (index node) utilization, or disk IO read wait time, etc.

[0057] For example, the metrics corresponding to locked resources include, but are not limited to, the utilization rate of shared resources, the number of processes that need to use shared resources, and so on.

[0058] In some embodiments, taking the method provided in this specification as an example applied to data nodes in a distributed system, the distributed system includes multiple data nodes, each of which has one or more operating systems installed. Any data node can count the number of data nodes in the distributed system whose operating systems are in an unhealthy state. If the number of data nodes in an unhealthy state exceeds a preset threshold, the resources of the distributed system are considered overloaded, and a prompt message indicating the need for expansion is output. If the number of data nodes in an unhealthy state is lower than the preset threshold, outlier analysis can be performed on the indicators to be checked for the unhealthy operating systems by executing steps S102 and S103, thereby extracting abnormal indicators of the unhealthy operating systems to locate the cause of the operating system anomaly. It is understood that the preset threshold can be specifically set according to the actual application scenario, and this embodiment does not impose any restrictions on it. For example, the preset threshold could be 60% or 70% of the total number of data nodes in the distributed system, etc. This embodiment achieves proactive monitoring of the operating systems of each data node in the distributed system, which is beneficial to ensuring the healthy and stable operation of the distributed system.

[0059] Figure 3 This is a schematic structural diagram of an electronic device provided in an exemplary embodiment. Please refer to... Figure 3At the hardware level, the device includes a processor 302, an internal bus 304, a network interface 306, memory 308, and non-volatile memory 310, and may also include other hardware required for business operations. One or more embodiments of this specification can be implemented in software, for example, the processor 302 reads the corresponding computer program from the non-volatile memory 310 into memory 308 and then runs it. Of course, besides software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution entity of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices. The electronic device can be equipped with multiple operating systems.

[0060] Please refer to Figure 4 The operating system's anomaly indicator extraction device can be applied to, for example... Figure 3 The electronic devices shown or such Figure 1 The data nodes shown are used to implement the technical solution described in this specification. The abnormal indicator extraction device for this operating system may include:

[0061] The running status determination module 21 is used to determine the running status of the operating system based on the acquisition time of at least one resource of the operating system.

[0062] The indicator acquisition module 22 is used to collect at least one indicator to be checked from the operating system if the running status is unhealthy, and to collect at least one reference indicator from other operating systems whose running status is healthy.

[0063] The abnormal indicator extraction module 23 is used to perform outlier analysis on the indicator to be checked based on the reference indicator, and extract abnormal indicators of the operating system that are in an unhealthy state.

[0064] In some embodiments, the operating status determination module 21 is specifically used to: determine the operating status of the operating system as healthy if the acquisition time of each resource of the operating system is less than or equal to a preset time; and determine the operating status of the operating system as unhealthy if the acquisition time of at least one resource is greater than the preset time.

[0065] In some embodiments, at least one resource of the operating system includes: processing resources, memory resources, network resources, I / O resources, or lock resources; the acquisition time of the processing resources includes: the time for requesting allocation of processing resources; the acquisition time of the memory resources includes: the time for requesting allocation of memory resources; the acquisition time of the network resources includes: the time for sending and receiving data packets; the acquisition time of the I / O resources includes: the response time for input operations and / or output operations; the acquisition time of the lock resources includes: the waiting time for accessing a shared resource; wherein at least two processes simultaneously accessing the shared resource have a mutual exclusion relationship.

[0066] In some embodiments, the indicator acquisition module 22 is specifically used to: identify resources whose acquisition duration is longer than a preset duration as resources to be inspected, and to count at least one indicator to be inspected for the resources to be inspected; wherein, the reference indicator includes reference indicators for the resources to be inspected in other operating systems where the running status is healthy.

[0067] In some embodiments, the abnormal indicator extraction module 23 is specifically used to: if the difference between the indicator to be checked and the reference indicator exceeds a preset difference, determine that the indicator to be checked is an abnormal indicator of the operating system in an unhealthy state.

[0068] In some embodiments, the operating system includes kernel mode and user mode; the acquisition time of at least one resource of the operating system is collected in kernel mode based on BPF technology.

[0069] In some embodiments, the method is applied to a distributed system comprising multiple data nodes, each data node having one or more operating systems installed; or the method is applied to an electronic device having multiple operating systems.

[0070] In some embodiments, the method is applied to a distributed system, and the apparatus further includes a quantity statistics module, configured to: output a prompt message indicating that expansion is needed if the number of data nodes in the distributed system whose operating system is in an unhealthy state exceeds a preset threshold; and extract abnormal indicators of the operating system in an unhealthy state if the number of data nodes in the distributed system whose operating system is in an unhealthy state is less than the preset threshold.

[0071] In some embodiments, this specification also provides an electronic device, which has multiple operating systems installed, and the electronic device includes:

[0072] processor;

[0073] Memory used to store processor-executable instructions;

[0074] The processor implements the method described above by running the executable instructions.

[0075] In some embodiments, please refer to Figure 1 The embodiments of this specification also provide a distributed system, which includes multiple data nodes, each of which has one or more operating systems installed.

[0076] Each of the data nodes is used to perform the method described in any one of the above statements.

[0077] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory including instructions that can be executed by a processor of the device to perform the described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0078] A non-transitory computer-readable storage medium that, when instructions in the storage medium are executed by a terminal's processor, enables the terminal to perform the methods described above.

[0079] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0080] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0081] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0082] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0083] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0084] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0085] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” used in one or more embodiments of this specification and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0086] It should be understood that although the terms first, second, third, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of one or more embodiments of this specification, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."

[0087] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit the scope of one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this specification should be included within the scope of protection of one or more embodiments of this specification.

Claims

1. A method for extracting abnormal indicators of an operating system, applicable to multi-operating system scenarios; The operating system includes kernel mode and user mode, and the method includes: Based on BPF technology, a program code is injected into the kernel mode of the operating system to count the acquisition time of at least one resource of the operating system without restarting the operating system. The acquisition time of at least one resource of the operating system is obtained by running the program code and reported to the user mode. The program code injected based on BPF technology is executed by the virtual machine. Perform the following steps in the user mode: The operating status of the operating system is determined based on the acquisition time of at least one resource of the operating system reported to the user space. If the running status is unhealthy, the resource whose acquisition time is longer than a preset time is identified as the resource to be inspected, and at least one indicator to be inspected is collected for the resource to be inspected, as well as at least one reference indicator from other operating systems in which the running status is healthy; wherein, the reference indicator includes reference indicators for the resource to be inspected from other operating systems in which the running status is healthy. Outlier analysis is performed on the indicators to be checked based on the reference indicators to extract abnormal indicators of the operating system that is in an unhealthy state.

2. The method according to claim 1, wherein determining the operating state of the operating system based on the acquisition time of at least one resource of the operating system includes: If the acquisition time of each resource of the operating system is less than or equal to the preset time, the operating status of the operating system is determined to be healthy. If the acquisition time of at least one resource exceeds the preset time, the operating system is determined to be in an unhealthy state.

3. The method according to claim 1, wherein at least one resource of the operating system includes: Processing resources, memory resources, network resources, I / O resources, or lock resources; The time taken to acquire the processing resources includes: the time taken to request the allocation of processing resources; The time taken to acquire the memory resources includes the time taken to request the allocation of memory resources; The acquisition time of the network resources includes: the time for sending and receiving data packets; The acquisition time of the IO resources includes: the response time of input operations and / or output operations; The acquisition time of the lock resource includes: the waiting time for accessing a shared resource; wherein at least two processes accessing the shared resource at the same time have a mutual exclusion relationship.

4. The method according to claim 1, wherein performing outlier analysis on the indicator to be inspected based on the reference indicator includes: If the difference between the indicator to be checked and the reference indicator exceeds a preset difference, the indicator to be checked is determined to be an abnormal indicator of the operating system in an unhealthy state.

5. The method according to claim 1, wherein the method is applied to a distributed system, the distributed system comprising multiple data nodes, and the data nodes having one or more operating systems installed; or The method is applied to electronic devices with multiple operating systems.

6. The method according to claim 5, wherein the method is applied to a distributed system, and the method further comprises: If the number of data nodes in the distributed system whose operating system is in an unhealthy state exceeds a preset threshold, a prompt message indicating that expansion is required will be output. If the number of data nodes in the distributed system whose operating system is in an unhealthy state is lower than the preset threshold, the abnormal indicators of the unhealthy operating system are extracted.

7. An abnormal indicator extraction device for an operating system, applicable to multi-operating system scenarios; The operating system includes kernel mode and user mode, and the device includes: The resource acquisition duration determination module is used to inject a piece of program code into the kernel mode of the operating system based on BPF technology to count the acquisition duration of at least one resource of the operating system without restarting the operating system. The program code is executed to count the acquisition duration of at least one resource of the operating system and report it to the user mode. The program code injected based on BPF technology is executed by the virtual machine. The user mode includes: The running status determination module is used to determine the running status of the operating system based on the acquisition time of at least one resource of the operating system reported to the user space. The indicator acquisition module is used to identify the resource whose acquisition time is longer than a preset time as the resource to be inspected if the running status is unhealthy, and to collect at least one indicator to be inspected for the resource to be inspected, as well as at least one reference indicator from other operating systems in which the running status is healthy; wherein, the reference indicator includes reference indicators for the resource to be inspected from other operating systems in which the running status is healthy. The abnormal indicator extraction module is used to perform outlier analysis on the indicator to be checked based on the reference indicator, and extract abnormal indicators of the operating system that are in an unhealthy state.

8. An electronic device, the electronic device having multiple operating systems installed, the electronic device comprising: processor; Memory used to store processor-executable instructions; The processor implements the method as described in any one of claims 1 to 6 by executing the executable instructions.

9. A distributed system comprising multiple data nodes, wherein each data node is equipped with one or more operating systems; Any of the data nodes is used to perform the method of any one of claims 1 to 6.

10. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1 to 6.

Images