A CPU usage rate monitoring method, device and storage medium

Abstract

This application discloses a CPU utilization monitoring method, apparatus, and storage medium, relating to the field of electronic information. The CPU utilization monitoring method provided in this application acquires the CPU utilization of all processes, filters out the process with the highest CPU utilization, determines whether the CPU utilization of the process with the highest CPU utilization is within a preset fluctuation value, obtains monitoring results, and analyzes the CPU utilization status based on the monitoring results. Therefore, this solution can specifically identify the root cause of high CPU utilization. By introducing an eBPF program, the root cause of excessive CPU utilization can be verified. The eBPF program provides a mechanism for securely injecting code when kernel events and user program events occur. In this application, this code is used to dynamically track kernel performance events, thereby accurately determining the root cause of excessive CPU utilization.

Description

Technical Field

[0001] This application relates to the field of electronic information, and in particular to a method, apparatus and storage medium for monitoring CPU utilization. Background Technology

[0002] In recent years, with the rapid development of computer technology, the requirements for central processing units (CPUs) have become increasingly stringent. As software functionality increases, the CPU's workload grows. CPU usage per unit of time is typically calculated as a percentage. This includes not only user-mode and kernel-mode process execution, but also interrupt handling, I / O waiting, and kernel threads.

[0003] Existing CPU detection methods first obtain the CPU utilization rate of the monitored object within the current monitoring period, and then compare it with a preset value. When the actual CPU utilization rate is found to be greater than the preset value, the number of active sessions is obtained, and finally, a tiered alarm is issued according to specific alarm conditions. However, considering only the impact of the number of active sessions on CPU utilization rate is often insufficient and makes it difficult to further pinpoint the root cause of the problem. Therefore, when a high CPU utilization rate is found in the system, it may not be possible to directly identify the corresponding problem causing the high CPU utilization rate.

[0004] Given the above-mentioned technologies, finding a CPU utilization monitoring method that can identify the cause of high CPU utilization is an urgent problem to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a CPU utilization monitoring method, device, and storage medium to address the shortcomings of existing CPU detection methods. When the actual CPU utilization is found to be greater than a preset value, the method obtains the number of active sessions and then performs graded alarms according to specific alarm conditions. However, these methods only consider the impact of the number of active sessions on CPU utilization, which is often insufficient and makes it difficult to further locate the root cause of the problem. Therefore, when the system's CPU utilization is found to be very high, it may not be possible to directly find the problem related to the high CPU utilization.

[0006] To address the aforementioned technical problems, this application provides a CPU utilization monitoring method applied to a Linux system, comprising:

[0007] Calculate CPU utilization and determine whether the CPU utilization exceeds a threshold;

[0008] If the CPU utilization rate exceeds the threshold, obtain the CPU utilization of all processes and filter to find the process with the highest CPU utilization rate;

[0009] Determine whether the CPU utilization of the process with the highest CPU utilization is within a preset fluctuation value;

[0010] If so, the CPU usage status is analyzed based on the process with the highest CPU usage.

[0011] If not, investigate short-lived processes and obtain the trace point of the exec system call in the kernel;

[0012] Use eBPF programs to monitor the exec behavior of processes and obtain monitoring results;

[0013] Based on the monitoring results, the usage status of the CPU is analyzed.

[0014] Preferably, in kernel mode, the monitoring of process exec behavior using the eBPF program to obtain monitoring results includes:

[0015] Verify the BPF program, and define hash mappings and performance event mappings;

[0016] Add an exec entry point trace point handling function. When the entry point trace point handling function is triggered, process information is obtained. The process information includes process ID, parent process ID, running user, and parameter list.

[0017] The process information is stored in the hash map;

[0018] Add an exec exit trace point handling function, and when the exec exit trace point handling function is triggered, query the process information in the hash map;

[0019] Update the return value, submit it to the performance event mapping, and clear the hash mapping. The performance event mapping is then the monitoring result.

[0020] Preferably, in user space, the monitoring of process execution behavior using the eBPF program to obtain monitoring results includes:

[0021] Define the BPF application and performance event buffers, and set the size of the BPF mapping space;

[0022] Initialize the BPF program and mount it to the corresponding trace point;

[0023] Configure a performance event callback function and read data from the performance event buffer in a loop. The read data is used to characterize the monitoring results.

[0024] Preferably, the calculation of CPU utilization includes:

[0025] Read the CPU data from the / proc / stat file to confirm the number of cores;

[0026] Calculate the total CPU utilization, user-mode CPU utilization, kernel-mode CPU utilization, I / O wait CPU utilization, and interrupt CPU utilization respectively.

[0027] Preferably, it further includes:

[0028] Enable call relationship sampling, generate an interrupt every first preset time interval, and record the process and function on the interrupt;

[0029] Locate the function causing the problem and output it to the analysis results.

[0030] Preferably, before calculating the CPU utilization and determining whether the CPU utilization exceeds a threshold, the method further includes:

[0031] Initialize the CPU configuration, including setting the threshold and configuring the interval time.

[0032] Preferably, after locating the function causing the problem and outputting it to the analysis results, the method further includes:

[0033] Based on the analysis results, corresponding solutions are adopted, as follows:

[0034] If the CPU utilization of the process is high, then terminate the process with the highest CPU utilization.

[0035] If the CPU utilization is high in user mode, then investigate process performance issues.

[0036] If the CPU utilization is high in kernel mode, investigate the use of system calls;

[0037] If the CPU utilization for I / O waiting is high, check if there are I / O problems with the system storage.

[0038] If the interrupted CPU usage is high, investigate the processing service interrupt in the kernel.

[0039] To address the aforementioned problems, this application also provides a CPU utilization monitoring device, comprising:

[0040] The calculation module is used to calculate the CPU utilization rate and determine whether the CPU utilization rate exceeds the threshold. If so, the acquisition module is activated.

[0041] The acquisition module is used to acquire the CPU usage of all processes and filter out the process with the highest CPU usage.

[0042] The judgment module is used to determine whether the CPU utilization of the process with the highest CPU utilization is within a preset fluctuation value. If yes, the process ends; otherwise, the monitoring module is activated.

[0043] The investigation module is used to investigate short-lived processes and obtain trace points of the exec system call in the kernel;

[0044] The monitoring module is used to monitor the exec behavior of processes using eBPF programs, obtain monitoring results, and enable the analysis module.

[0045] The analysis module is used to analyze the CPU usage status of the process based on the CPU usage rate or monitoring results.

[0046] To address the aforementioned issues, this application also provides a CPU utilization monitoring device, including a memory for storing computer programs;

[0047] A processor, used to implement the steps of the CPU utilization monitoring method described above when executing the computer program.

[0048] To address the aforementioned problems, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the CPU utilization monitoring method described above.

[0049] The CPU utilization monitoring method provided in this application obtains the CPU utilization of all processes, filters out the process with the highest CPU utilization, and determines whether the CPU utilization of the process with the highest CPU utilization is within a preset fluctuation value. If so, the CPU utilization status is analyzed based on the process with the highest CPU utilization. If not, short-lived processes are investigated, the trace point of the exec system call in the kernel is obtained, and the exec behavior of the process is monitored using an eBPF program to obtain the monitoring results. Based on the monitoring results, the CPU utilization status is analyzed. Therefore, this solution can specifically identify the root cause of high CPU utilization. By introducing an eBPF program, the root cause of the problem of excessive CPU utilization can be verified. The eBPF program provides a mechanism for secure code injection when kernel events and user program events occur through packet filtering technology. In this application, this code is used to dynamically track kernel performance events, thereby accurately determining the root cause of excessive CPU utilization.

[0050] The CPU utilization monitoring device and computer-readable storage medium provided in this application correspond to the CPU utilization monitoring method described above, and therefore have the same beneficial effects. Attached Figure Description

[0051] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 A flowchart of a CPU utilization monitoring method provided in this application embodiment;

[0053] Figure 2 A schematic diagram of a CPU utilization monitoring device provided in an embodiment of this application;

[0054] Figure 3 This is a structural diagram of a CPU utilization monitoring device provided in another embodiment of this application. Detailed Implementation

[0055] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0056] The core of this application is to provide a CPU utilization monitoring method, device, and storage medium to address the shortcomings of existing CPU detection methods. When the actual CPU utilization is found to be greater than a preset value, the method obtains the number of active sessions and then performs graded alarms according to specific alarm conditions. However, these methods only consider the impact of the number of active sessions on CPU utilization, which is often insufficient and makes it difficult to further locate the root cause of the problem. Therefore, when the system's CPU utilization is found to be very high, it may not be possible to directly find the problem related to the high CPU utilization.

[0057] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0058] Figure 1 A flowchart of a CPU utilization monitoring method provided in this application embodiment, applied to a Linux system, such as... Figure 1 As shown, the method includes:

[0059] S10: Calculate CPU utilization and determine whether CPU utilization exceeds the threshold. If so, proceed to S11.

[0060] It's worth noting that CPU utilization is a common performance metric across various systems. When high CPU utilization impacts system performance, troubleshooting becomes crucial. When commands like `top` and `ps` are insufficient for pinpointing the cause, a finer-grained approach is needed to investigate the problem, enabling auditing, error correction, and optimization.

[0061] Linux is a multitasking operating system. Each CPU's time is divided into short time slices, which are then allocated to various tasks in turn by the scheduler, giving users the impression that tasks are running simultaneously. Generally speaking, CPU utilization is the percentage of total CPU time excluding idle time. The `top` command calculates an average over 3 seconds by default, while the `ps` command uses the entire lifecycle of a process and is the sum of user-mode and kernel-mode CPU utilization.

[0062] Linux provides information about the system's internal state to user space through the / proc virtual filesystem. / proc / stat provides system CPU and task statistics, while / proc / pid / stat provides process CPU and task statistics. Each time a file is read, the kernel automatically refreshes the data via a system call. From this, we can obtain user-mode CPU time, kernel-mode CPU time, idle time, I / O wait time, interrupt handling time, and thus determine CPU utilization.

[0063] When CPU utilization is too low, it indicates that the system performance is not being fully utilized; when it is too high, significant response latency and increased machine temperature will occur. Here, we ignore the performance bottlenecks of the hardware itself and mainly discuss the problem of excessive CPU utilization caused by software. Therefore, the discussion of CPU utilization in this embodiment is mainly based on the software level, and no restrictions are placed on the threshold or the specific method of calculating CPU utilization.

[0064] S11: Get the CPU usage of all processes and filter out the process with the highest CPU usage;

[0065] A process is a running activity of a program on a certain set of data in a computer. It is the basic unit for system resource allocation and scheduling and the foundation of the operating system structure. In early process-oriented computer architectures, a process was the basic execution entity of a program; in contemporary thread-oriented computer architectures, a process is a container for threads. A program is a description of instructions, data, and their organization; a process is the entity of a program. In this embodiment, the specific methods for obtaining process usage and selecting the processes with the highest CPU usage are not limited. It can be understood that the processes mentioned in this embodiment refer to all processes running in the entire computer.

[0066] S12: Determine whether the CPU usage of the process with the highest CPU usage is within the preset fluctuation value. If not, proceed to S13; if yes, proceed to S15.

[0067] In this embodiment, the specific value of the preset fluctuation value is not limited. Generally, we allow a 30% error value, meaning the preset fluctuation value is 70%. If it is outside the error range, meaning the process with the highest CPU usage does not reach 70% of the set peak value, then it is not within the preset fluctuation value, indicating that the high CPU usage is not caused by process occupancy, and proceed to step S13. If it is within the error range, meaning the process with the highest CPU usage is exactly above 70% of the set peak value, then it is within the preset fluctuation value, indicating that the high CPU usage is caused by process occupancy, and therefore proceed to step S15.

[0068] S13: Investigate short-lived processes and obtain the trace point of the exec system call in the kernel;

[0069] In practical work, we occasionally encounter situations where the system's CPU utilization and average system load are very high, but we cannot find any applications that are using high CPU. The reason for this problem is that the process may be constantly crashing and restarting, or it may be calling exec to execute external commands inside other applications. These commands usually take a long time to execute, but they are difficult to detect using top and pidstat. Processes in the above two situations are called short-lived processes.

[0070] The `exec` system's function is to locate an executable file based on a specified filename and replace the contents of the calling process with it. In other words, it executes an executable file within the calling process. This executable file can be a binary file or any executable script file under Linux. Unlike normal processes, functions in the `exec` family do not return upon successful execution. This is because the calling process's entity, including its code segment, data segment, and stack, has been replaced with new content. Only superficial information such as the process ID remains unchanged, somewhat resembling the "golden cicada shedding its shell" stratagem from the Thirty-Six Stratagems. It appears to be the same old shell, but a new soul has been infused into it. Only if the call fails will it return -1, and execution will continue from the original call point.

[0071] S14: Use the eBPF program to monitor the exec behavior of the process, obtain the monitoring results, and then proceed to S15.

[0072] It should be noted that the Extended Berkeley Packet Filter (eBPF) is a packet filtering technology that provides a mechanism for secure code injection when kernel events and user program events occur. It can be used to dynamically track kernel performance events and is a key technology introduced in this embodiment for tracking high CPU utilization. In this embodiment, no specific monitoring behavior is limited.

[0073] S15: Analyze the CPU usage status based on monitoring results or the process with the highest CPU usage.

[0074] The CPU utilization monitoring method provided in this application obtains the CPU utilization of all processes, filters out the process with the highest CPU utilization, and determines whether the CPU utilization of the process with the highest CPU utilization is within a preset fluctuation value. If so, the CPU utilization status is analyzed based on the process with the highest CPU utilization. If not, short-lived processes are investigated, the trace point of the exec system call in the kernel is obtained, and the exec behavior of the process is monitored using an eBPF program to obtain the monitoring results. Based on the monitoring results, the CPU utilization status is analyzed. Therefore, this solution can specifically identify the root cause of high CPU utilization. By introducing an eBPF program, the root cause of the problem of excessive CPU utilization can be verified. The eBPF program provides a mechanism for secure code injection when kernel events and user program events occur through packet filtering technology. In this application, this code is used to dynamically track kernel performance events, thereby accurately determining the root cause of excessive CPU utilization.

[0075] The above embodiments do not limit the specific monitoring method. Here, a preferred solution is provided: in kernel mode, the eBPF program is used to monitor the exec behavior of the process, and the monitoring results include:

[0076] Verify the BPF program, and define hash mappings and performance event mappings;

[0077] Add an exec entry point trace point handler function. When the entry point trace point handler function is triggered, process information is obtained. The process information includes process ID, parent process ID, running user, and parameter list.

[0078] Store process information in a hash map;

[0079] Add an exec exit trace point handling function, and query process information in the hash map when the exec exit trace point handling function is triggered;

[0080] Update the return value, submit it to the performance event map, and clear the hash map. The performance event map will then display the monitoring results.

[0081] The Berkeley Packet Filter (BPF) falls under the eBPF category mentioned above. It's important to note that the operating system requires two CPU states: kernel mode and user mode. Kernel mode is used to run operating system programs and operate hardware. User mode is used to run user programs, and privileged instructions can only be used by the operating system and not by user programs. Examples include initiating I / O memory clearing, modifying the program status word, setting the clock, and enabling / disabling terminal halting.

[0082] Kernel mode and user mode are two execution levels in an operating system. A program running at privilege level 3 is considered to be running in user mode. This is the lowest privilege level, the privilege level for ordinary user processes, and most programs that users directly interact with run in user mode. A program running at privilege level 0 is considered to be running in kernel mode. Programs running in user mode cannot directly access operating system kernel data structures and programs. When we execute a program in the system, it spends most of its time running in user mode. It switches to kernel mode when it needs the operating system's help to complete tasks that it does not have the authority or ability to perform. Non-privileged instructions are instructions that can be used in user mode.

[0083] This embodiment defines the monitoring method for the kernel mode, namely, using hash mapping and performance events to reflect whether the CPU utilization in the kernel mode, i.e., the operating system, is too high, thereby ensuring accurate identification of performance monitoring in the kernel mode.

[0084] The above embodiments limit the monitoring method in kernel mode. Considering the corresponding user mode, in user mode, the eBPF program is used to monitor the exec behavior of the process, and the monitoring results include:

[0085] Define the BPF application and performance event buffers, and set the size of the BPF mapping space;

[0086] Initialize the BPF program and mount it to the corresponding trace point;

[0087] Configure a performance event callback function and read data from the performance event buffer in a loop. The read data is used to characterize the monitoring results.

[0088] This embodiment defines the monitoring method for user mode, namely, using BPF programs and performance time to reflect whether the CPU utilization in the kernel mode, i.e., the running software, is too high, thereby ensuring accurate identification of performance monitoring in user mode.

[0089] The above embodiments do not limit the specific method for calculating CPU utilization. A preferred solution is provided here, which includes:

[0090] Read the CPU data from the / proc / stat file to confirm the number of cores;

[0091] Calculate the total CPU utilization, user-mode CPU utilization, kernel-mode CPU utilization, I / O wait CPU utilization, and interrupt CPU utilization respectively.

[0092] This embodiment defines the steps involved in calculating CPU utilization. By calculating CPU utilization under various conditions, the threshold corresponding to the computer in different operating states can be accurately obtained.

[0093] Considering the potential for high CPU utilization due to interrupts, we provide the following preferred solutions, which also include:

[0094] Enable call relationship sampling, generate an interrupt every first preset time interval, and record the process and function on the interrupt;

[0095] Locate the function causing the problem and output it to the analysis results.

[0096] An interruption refers to a situation during computer operation where unexpected circumstances arise requiring host intervention. In this case, the machine automatically stops the currently running program and switches to a program to handle the new situation. After handling the new situation, the machine returns to the previously suspended program and resumes execution. In this embodiment, the specific duration of the first preset time is not limited.

[0097] In this embodiment, additional monitoring of interrupts is added, making the method for monitoring specific problems of excessive CPU utilization more comprehensive.

[0098] Considering the need for initial CPU configuration, a preferred approach is provided here, which includes the following steps before calculating CPU utilization and determining whether CPU utilization exceeds a threshold:

[0099] Initialize CPU configuration, including setting thresholds and configuring interval times.

[0100] This means that before monitoring CPU usage, the CPU configuration is pre-initialized to achieve accurate monitoring of the environment.

[0101] Considering that further processing is needed after obtaining the analysis results to resolve the high CPU usage issue, a preferred solution is provided here. After locating the function causing the problem and outputting it to the analysis results, the solution also includes:

[0102] Based on the analysis results, corresponding solutions are adopted, as follows:

[0103] If a process has high CPU usage, terminate the process with the highest CPU usage.

[0104] If CPU utilization is high in user mode, investigate process performance issues.

[0105] If CPU utilization is high in kernel mode, investigate the use of system calls;

[0106] If CPU utilization is high due to I / O wait, check if there are I / O problems with the system storage.

[0107] If the CPU utilization is high and interrupts occur, investigate the interrupt handling in the kernel.

[0108] In other words, by monitoring the results obtained through the above embodiments, a specific solution corresponding to the current high CPU utilization can be obtained, thereby effectively solving the problem of high CPU utilization.

[0109] The CPU utilization monitoring method has been described in detail in the above embodiments. This application also provides embodiments corresponding to the CPU utilization monitoring device. It should be noted that this application describes the embodiments of the device part from two perspectives: one is based on the functional module, and the other is based on the hardware.

[0110] Figure 2 A schematic diagram of a CPU utilization monitoring device provided in this application embodiment is shown. The device includes:

[0111] The calculation module 10 is used to calculate the CPU utilization and determine whether the CPU utilization exceeds the threshold. If so, the acquisition module is activated.

[0112] Module 11 is used to obtain the CPU usage of all processes and filter out the process with the highest CPU usage.

[0113] The judgment module 12 is used to determine whether the CPU usage of the process with the highest CPU usage is within the preset fluctuation value. If it is, the analysis module is activated; otherwise, the monitoring module is activated.

[0114] The investigation module 13 is used to investigate short-lived processes and obtain the trace point of the exec system call in the kernel;

[0115] Monitoring module 14 is used to monitor the exec behavior of processes using eBPF programs, obtain monitoring results, and start the analysis module;

[0116] Analysis module 15 is used to analyze the CPU usage status based on the monitoring results.

[0117] Since the embodiments of the apparatus and the embodiments of the method correspond to each other, please refer to the description of the embodiments of the method for the embodiments of the apparatus and their corresponding beneficial effects, which will not be repeated here.

[0118] Figure 3 A structural diagram of a CPU utilization monitoring device provided in another embodiment of this application is shown below. Figure 3 As shown, the CPU utilization monitoring device includes: a memory 20 for storing computer programs;

[0119] The processor 21 is used to implement the steps of the CPU utilization monitoring method mentioned in the above embodiments when executing a computer program.

[0120] The CPU usage monitoring device provided in this embodiment may include, but is not limited to, smartphones, tablets, laptops, or desktop computers.

[0121] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from Digital Signal Processor (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an Artificial Intelligence (AI) processor, which handles computational operations related to machine learning.

[0122] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 20 is used to store at least the following computer program 201, which, after being loaded and executed by the processor 21, can implement the relevant steps of the CPU utilization monitoring method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, and the storage method may be temporary or permanent storage. The operating system 202 may include Windows, Unix, Linux, etc. The data 203 may include, but is not limited to, the data involved in the CPU utilization monitoring method.

[0123] In some embodiments, the CPU utilization monitoring device may further include a display screen 22, an input / output interface 23, a communication interface 24, a power supply 25, and a communication bus 26.

[0124] Those skilled in the art will understand that Figure 3 The structure shown does not constitute a limitation on the CPU usage monitoring device and may include more or fewer components than shown.

[0125] The CPU utilization monitoring device provided in this application includes a memory and a processor. When the processor executes a program stored in the memory, it can implement the following method: the CPU utilization monitoring method involved in the above embodiments.

[0126] Since the embodiments of the apparatus and the embodiments of the method correspond to each other, please refer to the description of the embodiments of the method for the embodiments of the apparatus and their corresponding beneficial effects, which will not be repeated here.

[0127] Finally, this application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps described in the above method embodiments.

[0128] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] Since the embodiments of the readable storage medium portion correspond to the embodiments of the method portion, the embodiments of the apparatus portion and their corresponding beneficial effects are described in the description of the embodiments of the method portion, and will not be repeated here.

[0130] The foregoing provides a detailed description of a CPU utilization monitoring method, apparatus, and computer-readable storage medium. The various embodiments in the specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

[0131] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for monitoring CPU utilization, characterized in that, Applied to Linux systems, including: Calculate CPU utilization and determine whether the CPU utilization exceeds a threshold; If the CPU utilization rate exceeds the threshold, obtain the CPU utilization of all processes and filter to find the process with the highest CPU utilization rate; Determine whether the CPU utilization of the process with the highest CPU utilization is within a preset fluctuation value; If not, investigate short-lived processes and obtain the trace point of the exec system call in the kernel; the short-lived process is a process that keeps crashing and restarting, or an external command with a short execution time that is executed by the application's internal call to exec. Use eBPF programs to monitor the exec behavior of processes and obtain monitoring results; Based on the monitoring results, the CPU usage status is analyzed. In kernel mode, the monitoring results obtained by using the eBPF program to monitor the exec behavior of processes include: Verify the BPF program, and define hash mappings and performance event mappings; Add an exec entry point trace point handling function. When the entry point trace point handling function is triggered, process information is obtained. The process information includes process ID, parent process ID, running user, and parameter list. The process information is stored in the hash map; Add an exec exit trace point handling function, and when the exec exit trace point handling function is triggered, query the process information in the hash map; Update the return value, submit it to the performance event mapping, and clear the hash mapping. The performance event mapping then represents the monitoring result. In user space, the monitoring results obtained by using eBPF programs to monitor the exec behavior of processes include: Define the BPF procedure and performance event buffers, and set the BPF mapping space size; Initialize the BPF program and mount it to the corresponding trace point; Configure a performance event callback function and read data from the performance event buffer in a loop. The read data is used to characterize the monitoring results.

2. The CPU utilization monitoring method according to claim 1, characterized in that, The calculation of CPU utilization includes: Read the CPU data from the / proc / stat file to confirm the number of cores; Calculate the total CPU utilization, user-mode CPU utilization, kernel-mode CPU utilization, I / O wait CPU utilization, and interrupt CPU utilization respectively.

3. The CPU utilization monitoring method according to any one of claims 1 to 2, characterized in that, Also includes: Enable call relationship sampling, generate an interrupt every first preset time interval, and record the process and function on the interrupt; Locate the function causing the problem and output it to the analysis results.

4. The CPU utilization monitoring method according to claim 3, characterized in that, Before calculating CPU utilization and determining whether CPU utilization exceeds a threshold, the method further includes: Initialize the CPU configuration, including setting the threshold and configuring the interval time.

5. The CPU utilization monitoring method according to claim 4, characterized in that, After locating the function causing the problem and outputting it to the analysis results, the following is also included: Based on the analysis results, corresponding solutions are adopted, as follows: If the CPU utilization is high in user mode, then investigate process performance issues. If the CPU utilization is high in the kernel mode, investigate the use of system calls; If the CPU utilization for I / O waiting is high, check if there are I / O problems with the system storage. If the interrupted CPU usage is high, investigate the processing service interrupt in the kernel.

6. A CPU utilization monitoring device, characterized in that, include: The calculation module is used to calculate the CPU utilization rate and determine whether the CPU utilization rate exceeds the threshold. If so, the acquisition module is activated. The acquisition module is used to acquire the CPU usage of all processes and filter out the process with the highest CPU usage. The judgment module is used to determine whether the CPU utilization of the process with the highest CPU utilization is within a preset fluctuation value. If yes, the process ends; otherwise, the monitoring module is activated. The investigation module is used to investigate short-lived processes and obtain trace points of the exec system call in the kernel; the short-lived process is a process that keeps crashing and restarting, or an external command with a short execution time that is executed by the application's internal call to exec. The monitoring module is used to monitor the exec behavior of processes using eBPF programs, obtain monitoring results, and enable the analysis module. The analysis module is used to analyze the CPU usage status based on the CPU usage rate or monitoring results of the process to obtain the CPU usage status; In kernel mode, the monitoring results obtained by using the eBPF program to monitor the exec behavior of processes include: Verify the BPF program, and define hash mappings and performance event mappings; Add an exec entry point trace point handling function. When the entry point trace point handling function is triggered, process information is obtained. The process information includes process ID, parent process ID, running user, and parameter list. The process information is stored in the hash map; Add an exec exit trace point handling function, and when the exec exit trace point handling function is triggered, query the process information in the hash map; Update the return value, submit it to the performance event mapping, and clear the hash mapping. The performance event mapping then represents the monitoring result. In user space, the monitoring results obtained by using eBPF programs to monitor the exec behavior of processes include: Define the BPF procedure and performance event buffers, and set the BPF mapping space size; Initialize the BPF program and mount it to the corresponding trace point; Configure a performance event callback function and read data from the performance event buffer in a loop. The read data is used to characterize the monitoring results.

7. A CPU utilization monitoring device, characterized in that, Includes memory used to store computer programs; A processor, configured to implement the steps of the CPU utilization monitoring method as described in any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the CPU utilization monitoring method as described in any one of claims 1 to 5.

Images