Time-adjusted audit flow control method and apparatus

Abstract

The application discloses a time-adjusted audit traffic control method and device, which comprises the following steps: a traffic plug-in acquires the computing resource occupied by the traffic plug-in; the traffic plug-in judges whether the occupied computing resource is within a predetermined range; if the computing resource occupied by the traffic plug-in exceeds the predetermined range, the traffic plug-in increases the time interval for calling a packet capturing component; if the computing resource occupied by the traffic plug-in is within the predetermined range, the traffic plug-in maintains the time interval for calling the packet capturing component unchanged; and if the computing resource occupied by the traffic plug-in is lower than the predetermined range, the traffic plug-in shortens the time interval for calling the packet capturing component. The application solves the problem that the traffic plug-in occupies a large amount of processor resources in the prior art, thereby affecting the machine where the traffic plug-in is located, so that the CPU occupancy rate of the traffic plug-in is effectively controlled, and the normal operation of the audit service is ensured.

Description

Technical Field

[0001] This application relates to the field of database auditing, and more specifically, to a time-adjusted audit flow control method and apparatus. Background Technology

[0002] Database auditing (DBAudit) centers on security incidents and is based on comprehensive and precise auditing. It records database activities on the network in real time, performs granular auditing of database operations for compliance management, and provides real-time alerts for risky behaviors affecting the database. By recording, analyzing, and reporting user access to the database, it helps users generate compliance reports and trace the root causes of incidents. Simultaneously, it uses big data search technology to provide efficient querying of audit reports, pinpointing the causes of incidents for future querying, analysis, and filtering. This strengthens the monitoring and auditing of internal and external database network behavior, improving data asset security.

[0003] Figure 1 This is a schematic diagram of the architecture of a database auditing service based on existing technologies, such as... Figure 1 As shown, database traffic is generated when a database client accesses the database. This database traffic includes access requests sent by the database client to the database, and result sets sent by the database to the client in response to the access requests. The traffic plugin replicates the database traffic exchanged between the database client and the database. The traffic plugin then sends the replicated traffic to an auditing service for database auditing. It should be noted that the auditing service can be a single server, a server cluster, or an auditing program running on other devices. Figure 1 The example only shows the database traffic between a single database client and a single database. In real-world applications, there may be multiple database clients and multiple databases, resulting in a significant amount of actual database traffic. In such cases, the traffic plugin will acquire a large amount of database traffic, which will exhaust processor (CPU) resources and affect the operation of the machine where the traffic plugin is located. Summary of the Invention

[0004] This application provides a time-adjusted audit flow control method and apparatus to at least solve the problem in the prior art where flow plugins occupy a large amount of processor resources, thereby affecting the machine where the flow plugin is located.

[0005] According to one aspect of this application, a time-adjusted audit traffic control method is provided, comprising: a traffic plugin acquiring the computing resources occupied by the traffic plugin, wherein the traffic plugin is used to capture database traffic between a database client and a database, and send the captured database traffic to an audit service for auditing; the traffic plugin determining whether the occupied computing resources are within a predetermined range, wherein the predetermined range is pre-configured; if the computing resources occupied by the traffic plugin exceed the predetermined range, the traffic plugin increases the time interval for calling a packet capture component, wherein the packet capture component is located in the traffic plugin, and the traffic plugin captures database traffic through the packet capture component; if the computing resources occupied by the traffic plugin are within the predetermined range, the traffic plugin maintains the time interval for calling the packet capture component unchanged; if the computing resources occupied by the traffic plugin are below the predetermined range, the traffic plugin shortens the time interval for calling the packet capture component.

[0006] Furthermore, it also includes: after the traffic plugin increases the time interval for calling the packet capture component, or after the traffic plugin shortens the time interval for calling the packet capture component, determining again whether the computing resources occupied by the traffic plugin are within the predetermined range; if they are still not within the predetermined range, then increasing or decreasing the time interval for calling the packet capture component again until the computing resources occupied by the traffic plugin are within the predetermined range.

[0007] Further, the process of determining whether the computing resources occupied by the traffic plugin are within a predetermined range includes: the traffic plugin acquiring the computing resources occupied by the traffic plugin according to a predetermined period; the traffic plugin calculating the values ​​of the computing resources occupied by multiple traffic plugins acquired within a predetermined time period, wherein the length of the predetermined time period is the length of multiple predetermined periods; determining the number of values ​​of the computing resources occupied by multiple traffic plugins that are within the predetermined range; if the number exceeds a threshold, then determining that the computing resources occupied by the traffic plugin are within the predetermined range; if the number does not exceed the threshold, then determining that the computing resources occupied by the traffic plugin are not within the predetermined range.

[0008] Furthermore, the computing resources occupied are the processor utilization rate.

[0009] According to another aspect of this application, a time-adjusted audit traffic control device is also provided, located in a traffic plugin, comprising: an acquisition module for acquiring the computing resources occupied by the traffic plugin, wherein the traffic plugin is used to capture database traffic between a database client and a database, and send the captured database traffic to an audit service for auditing; a judgment module for judging whether the occupied computing resources are within a predetermined range, wherein the predetermined range is pre-configured; and a processing module for increasing the time interval for calling a packet capture component if the computing resources occupied by the traffic plugin exceed the predetermined range, wherein the packet capture component is located in the traffic plugin, and the traffic component captures database traffic through the packet capture component; if the computing resources occupied by the traffic plugin are within the predetermined range, the plugin maintains the time interval for calling the packet capture component unchanged; and if the computing resources occupied by the traffic plugin are below the predetermined range, the time interval for calling the packet capture component is shortened.

[0010] Furthermore, the processing module is also configured to: after the traffic plugin increases the time interval for calling the packet capture component, or after the traffic plugin shortens the time interval for calling the packet capture component, determine again whether the computing resources occupied by the traffic plugin are within the predetermined range; if they are still not within the predetermined range, then increase or decrease the time interval for calling the packet capture component again until the computing resources occupied by the traffic plugin are within the predetermined range.

[0011] Further, the determination module is configured to: acquire the computing resources occupied by the traffic plugin according to a predetermined period; count the values ​​of computing resources occupied by multiple traffic plugins acquired within a predetermined time period, wherein the length of the predetermined time period is the length of multiple predetermined periods; determine the number of values ​​of computing resources occupied by multiple traffic plugins that are within a predetermined range; if the number exceeds a threshold, determine that the computing resources occupied by the traffic plugin are within the predetermined range; if the number does not exceed the threshold, determine that the computing resources occupied by the traffic plugin are not within the predetermined range.

[0012] Furthermore, the computing resources occupied are the processor utilization rate.

[0013] According to another aspect of this application, an electronic device is also provided, including a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the above-described method steps.

[0014] According to another aspect of this application, a readable storage medium is also provided, on which computer instructions are stored, wherein the computer instructions, when executed by a processor, implement the above-described method steps.

[0015] In this embodiment, a traffic plugin is used to obtain the computing resources occupied by the traffic plugin. The traffic plugin captures database traffic between the database client and the database and sends the captured database traffic to an auditing service for auditing. The traffic plugin determines whether the occupied computing resources are within a predetermined range, where the predetermined range is pre-configured. If the computing resources occupied by the traffic plugin exceed the predetermined range, the traffic plugin increases the time interval for calling the packet capture component, which is located within the traffic plugin and captures database traffic through the packet capture component. If the computing resources occupied by the traffic plugin are within the predetermined range, the traffic plugin maintains the time interval for calling the packet capture component unchanged. If the computing resources occupied by the traffic plugin are below the predetermined range, the traffic plugin shortens the time interval for calling the packet capture component. This application solves the problem in the prior art where traffic plugins occupy a large amount of processor resources, thus affecting the machine where the traffic plugin is located, thereby effectively controlling the CPU utilization of the traffic plugin and ensuring the normal operation of the auditing service. Attached Figure Description

[0016] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a schematic diagram of the architecture of a database auditing service based on existing technologies;

[0018] Figure 2 This is a flowchart of a time-adjusted audit flow control method according to an embodiment of this application; and,

[0019] Figure 3 This is a schematic diagram illustrating the invocation of the packet capture component according to an embodiment of this application. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0022] The following implementation involves technical solutions related to database auditing. The technical terms involved in the following implementation are explained first.

[0023] Pcap

[0024] In the field of computer network management, Pcap (short for packet capture) is an application programming interface (API) for capturing network traffic. Pcap is written in C. On Unix-like systems, it is implemented using the libpcap library, while on Windows operating systems, it is implemented using the Npcap library. Previously, it could also be implemented using the WinPcap library, but the WinPcap library is no longer maintained. Plugins or components for packet capture can use libpcap to capture network packets transmitted on computer networks.

[0025] To address the problems in the prior art, a time-adjusted audit flow control method is provided in the following embodiments. Figure 2 This is a flowchart of a time-adjusted audit flow control method according to an embodiment of this application, such as... Figure 2 As shown below, Figure 2 The methods and steps involved are explained.

[0026] Step S202: The traffic plugin obtains the computing resources occupied by the traffic plugin, wherein the traffic plugin is used to capture the database traffic between the database client and the database, and send the captured database traffic to the audit service for auditing.

[0027] In this step, computing resources can include various types of computing resources, such as memory utilization. Considering that CPU utilization has a significant impact on the traffic plugin, in the following implementation, the computing resources used refer to the processor utilization.

[0028] In step S204, the traffic plugin determines whether the occupied computing resources are within a predetermined range, wherein the predetermined range is pre-configured.

[0029] In this step, the pre-configured range is provided through a software interface. After configuring the range, its upper limit can be obtained. This upper limit can then be incremented by a further value, and this incremented upper limit becomes the maximum computing resource limit available to the traffic plugin. If the traffic plugin's computing resource usage has reached this maximum, it can be suspended, or the time interval for the traffic plugin to call the packet capture component can be configured to the maximum configurable value.

[0030] Step S206: If the computing resources occupied by the traffic plugin exceed the predetermined range, the traffic plugin increases the time interval for calling the packet capture component, wherein the packet capture component is located in the traffic plugin, and the traffic component captures database traffic through the packet capture component. In this step, the time interval can be increased according to the length in the first step.

[0031] Step S208: If the computing resources occupied by the traffic plugin are within the predetermined range, the traffic plugin maintains the time interval for calling the packet capture component unchanged.

[0032] In this step, when the computing resources used by the traffic plugin are within a predetermined range, information on the computing resources provided by the device or virtual device where the traffic plugin is located is obtained. Then, the predetermined range, the computing resources used by the traffic plugin, and the frequency at which the traffic plugin calls the packet capture component are saved. When a user needs to install the traffic plugin on another device or virtual device, the saved information can be searched based on the computing resources of the other device or virtual device input by the user, and the range of computing resources used by the traffic plugin to be installed. The most similar information is found, and the frequency of calling the packet capture component in that most similar information is used as the default frequency after the traffic plugin is installed on the other device or virtual device.

[0033] Step S210: If the computing resources occupied by the traffic plugin are lower than the predetermined range, the traffic plugin shortens the time interval for calling the packet capture component. In this step, the time interval can be shortened according to the length in step one.

[0034] The above steps solve the problem in existing technologies where traffic plugins occupy a large amount of processor resources, thus affecting the machine on which the traffic plugin is located. This effectively controls the CPU utilization of the traffic plugin and ensures the normal operation of the machine on which the traffic plugin is located.

[0035] In an optional implementation, after the traffic plugin increases or decreases the time interval for calling the packet capture component, it is determined again whether the computing resources occupied by the traffic plugin are within the predetermined range. If they are still not within the predetermined range, the time interval for calling the packet capture component is increased or decreased again until the computing resources occupied by the traffic plugin are within the predetermined range. In this optional implementation, the time interval can be increased or decreased according to a second step size, where the second step size is greater than the first step size, preferably 1.5 times the first step size.

[0036] In the steps above, it is necessary to determine the computing resources consumed by the traffic plugin. There are many ways to do this, for example,

[0037] Method 1: The determination of whether the computing resources occupied by the traffic plugin are within a predetermined range includes: the traffic plugin acquiring the computing resources occupied by the traffic plugin according to a predetermined period; the traffic plugin counting the values ​​of the computing resources occupied by multiple traffic plugins acquired within a predetermined time period, wherein the length of the predetermined time period is the length of multiple predetermined periods; determining the number of values ​​of the computing resources occupied by multiple traffic plugins that are within the predetermined range; if the number exceeds a threshold, then it is determined that the computing resources occupied by the traffic plugin are within the predetermined range; if the number does not exceed the threshold, then it is determined that the computing resources occupied by the traffic plugin are not within the predetermined range.

[0038] Method 2: The determination of whether the computing resources occupied by the traffic plugin are within a predetermined range includes: the traffic plugin acquiring the computing resources occupied by the traffic plugin according to a predetermined period; the traffic plugin calculating the values ​​of the computing resources occupied by multiple traffic plugins acquired within a predetermined time period, wherein the length of the predetermined time period is the length of multiple predetermined periods; determining whether the average value of the computing resources occupied by multiple traffic plugins is within the predetermined range; if it is, then it is determined that the computing resources occupied by the traffic plugin are within the predetermined range; if not, then it is determined that the computing resources occupied by the traffic plugin are not within the predetermined range.

[0039] These two methods can be used individually or in combination. For example, method one can yield result one, and method two can yield result two. If result one and result two are consistent, the judgment result from result one or result two is adopted. If result one and result two are inconsistent, it is determined that the computing resources occupied by the traffic plugin are within the predetermined range.

[0040] The methods described above can be applied to a variety of scenarios. Figure 3 This is a schematic diagram illustrating the invocation of the packet capture component according to an embodiment of this application, as shown below. Figure 3 As shown, its architecture is similar to Figure 1 The architecture shown is the same. Figure 3 In this process, the traffic plugin captures traffic between the database client and the database. The traffic plugin then sends the captured database traffic to the auditing service. In the following implementation, the traffic plugin is referred to as the Rmagent plugin. Figure 3 The system uses the Rmagent plugin to control traffic. For example, the traffic plugin can obtain the load level of the computing resources used by the auditing service (e.g., CPU usage, memory usage, etc.) and control the quantity or rate of database traffic sent to the auditing service based on this load. Alternatively, the traffic plugin can also obtain the amount of database traffic to be audited. If the amount of database traffic to be audited exceeds the upper limit of a second predetermined range, the plugin reduces the amount of database traffic sent to the auditing service or lowers the rate at which it is sent. If the amount of database traffic to be audited is below the lower limit of the predetermined range, the plugin increases the amount of database traffic sent to the auditing service or accelerates the rate at which it is sent. If the amount of database traffic to be audited is within the predetermined range, the plugin continues to send database traffic at the previous rate.

[0041] As an optional implementation, the traffic plugin determines that the database traffic to be audited exceeds the upper limit of a second predetermined range, wherein the second predetermined range is pre-configured; if it exceeds the second predetermined range, the traffic plugin increases the time interval for calling the packet capture component; if it is within the second predetermined range, the traffic plugin maintains the time interval for calling the packet capture component unchanged; if it is below the second predetermined range, the traffic plugin shortens the time interval for calling the packet capture component.

[0042] This control method manages the traffic sent by the plugin to the audit service, preventing excessive load on the audit service and potential problems. However, traffic plugins can also consume significant computing resources, leading to issues. To address this, in the following implementation, a threshold can be set for the computing resource usage of the traffic plugin. If this threshold is reached, the traffic plugin can be suspended, ceasing to acquire database traffic and send no database traffic to the audit service. In this optional implementation, auditing is suspended and halted when the traffic plugin's process consumes computing resources (e.g., CPU usage) to a threshold. If user traffic is high, the plugin's high traffic acquisition will result in high CPU usage, easily reaching the CPU threshold and causing suspension. This would interrupt the audit service, which users generally do not accept. However, increasing the plugin threshold would mean consuming even more user resources, which users might also find unacceptable. Therefore, controlling the computing resource usage of the traffic plugin without causing audit service interruptions is a problem that needs to be solved.

[0043] When solving this problem, the following principles can be considered:

[0044] 1. Keep the CPU usage of the traffic plugin within a threshold to avoid consuming too much user resources.

[0045] 2. Audit data (i.e., database traffic) must be continuously available; the audit cannot be stopped.

[0046] 3. Automatic adjustment, avoiding manual intervention.

[0047] As can be seen from the above three points, the CPU threshold needs to be set, and it is necessary to ensure that the auditing service does not stop auditing because the traffic plugin does not capture database traffic.

[0048] exist Figure 3 In this example, the traffic plugin (Rmagent) captures database traffic by calling a packet capture component. There are many ways to implement a packet capture component; for example, it can be done using the Pcap component. In one example, Rmagent uses the Pcap component to capture traffic and adjusts the PCAP call timing. This will be explained below.

[0049] The rmagent plugin calls the application programming interface (API) in the pcap component to obtain database traffic. This process mainly consumes CPU resources, so the CPU usage can be adjusted by changing the timing of API calls.

[0050] First, read the CPU threshold value CPU_LIMIT from the configuration file. You can also define another threshold HIGH_CPU_LIMIT = CPU_LIMIT + a predetermined percentage (for example, if the CPU threshold value is 20% and the predetermined percentage is 5%, then HIGH_CPU_LIMIT is 25%, and the CPU will eventually stabilize between 20% and 25%).

[0051] Then, a thread is used to calculate the CPU utilization of the traffic plugin and determine whether the CPU utilization exceeds the limit. Considering that CPU utilization fluctuates significantly, an optional implementation can calculate the CPU utilization over a period of time. For example, Linux can calculate it by reading information from a stat file, while Windows can obtain it by calling apiGetProcessTimes(). The limit is determined by the number of times the CPU utilization exceeds the limit; for example, if it exceeds the limit 24 out of 30 times, it is considered to have exceeded the limit.

[0052] After detecting that the CPU usage has reached the threshold HIGH_CPU_LIMIT, the traffic plugin increases the time interval for API calls. After a predetermined period (e.g., 1 minute), it checks again. If the CPU usage still exceeds HIGH_CPU_LIMIT, it continues to increase the API call time interval. It should be noted that this only increases the call time interval, but does not stop the auditing process.

[0053] Since determining if CPU usage is over the limit takes time, the traffic acquisition plugin needs to wait a while after adjusting the API call time before making the next adjustment. Ultimately, if CPU usage is detected to be within the range of [CPU_LIMIT, HIGH_CPU_LIMIT], the API call interval will remain unchanged; if CPU usage is detected to drop below CPU_LIMIT, the API call interval will be set to 0, and the detection will restart.

[0054] In this embodiment, an electronic device is provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to perform the methods described in the above embodiments.

[0055] The aforementioned program can run on a processor or be stored in memory (or a computer-readable medium). Computer-readable media include both permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0056] These computer programs may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes can be implemented using different modules, and different steps can be implemented using different modules.

[0057] This embodiment provides such a device or system. The device, referred to as a time-adjusted audit traffic control device, is located within a traffic plugin. The device includes: an acquisition module for acquiring the computing resources occupied by the traffic plugin, wherein the traffic plugin captures database traffic between the database client and the database and sends the captured database traffic to an audit service for auditing; a judgment module for determining whether the occupied computing resources are within a predetermined range, wherein the predetermined range is pre-configured; and a processing module for increasing the time interval for calling the packet capture component if the computing resources occupied by the traffic plugin exceed the predetermined range, wherein the packet capture component is located within the traffic plugin and captures database traffic through the packet capture component; if the computing resources occupied by the traffic plugin are within the predetermined range, the plugin maintains the time interval for calling the packet capture component unchanged; and if the computing resources occupied by the traffic plugin are below the predetermined range, the time interval for calling the packet capture component is shortened.

[0058] The system or apparatus is used to implement the functions of the methods in the above embodiments. Each module in the system or apparatus corresponds to each step in the method, as has been described in the method and will not be repeated here.

[0059] Optionally, the processing module is further configured to: after the traffic plugin increases the time interval for calling the packet capture component, or after the traffic plugin shortens the time interval for calling the packet capture component, determine again whether the computing resources occupied by the traffic plugin are within the predetermined range; if they are still not within the predetermined range, increase or decrease the time interval for calling the packet capture component again until the computing resources occupied by the traffic plugin are within the predetermined range.

[0060] Optionally, the determination module is configured to: acquire the computing resources occupied by the traffic plugin according to a predetermined period; count the values ​​of computing resources occupied by multiple traffic plugins acquired within a predetermined time period, wherein the length of the predetermined time period is the length of multiple predetermined periods; determine the number of values ​​of computing resources occupied by multiple traffic plugins that are within a predetermined range; if the number exceeds a threshold, determine that the computing resources occupied by the traffic plugin are within the predetermined range; if the number does not exceed the threshold, determine that the computing resources occupied by the traffic plugin are not within the predetermined range.

[0061] Optionally, the computing resources used are the processor utilization rate.

[0062] The above optional implementation method solves the problem in the prior art that traffic plugins occupy a lot of processor resources, thereby affecting the machine where the traffic plugin is located. This effectively controls the CPU utilization of the traffic plugin and ensures the normal operation of the audit service.

[0063] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A time-adjustment-based audit flow control method, characterized in that, include: The traffic plugin obtains the computing resources occupied by the traffic plugin, wherein the traffic plugin is used to capture the database traffic between the database client and the database, and send the captured database traffic to the audit service for auditing; The traffic plugin determines whether the computing resources it occupies are within a predetermined range, wherein the predetermined range is pre-configured; wherein the traffic plugin acquires the computing resources it occupies according to a predetermined period; the traffic plugin counts the values ​​of computing resources occupied by multiple traffic plugins acquired within a predetermined time period, wherein the length of the predetermined time period is the length of multiple predetermined periods; it determines the number of times the values ​​of computing resources occupied by multiple traffic plugins are within the predetermined range; if the number exceeds a threshold, it is determined that the computing resources occupied by the traffic plugin are within the predetermined range; if the number does not exceed the threshold, it is determined that the computing resources occupied by the traffic plugin are not within the predetermined range. If the computing resources occupied by the traffic plugin exceed the predetermined range, the traffic plugin increases the time interval for calling the packet capture component, wherein the packet capture component is located in the traffic plugin, and the traffic plugin captures database traffic through the packet capture component; If the computing resources occupied by the traffic plugin are within the predetermined range, the traffic plugin maintains the time interval for calling the packet capture component unchanged; If the computing resources used by the traffic plugin are lower than the predetermined range, the traffic plugin will shorten the time interval for calling the packet capture component.

2. The method according to claim 1, characterized in that, Also includes: After the traffic plugin increases the time interval for calling the packet capture component, or after the traffic plugin shortens the time interval for calling the packet capture component, it is determined again whether the computing resources occupied by the traffic plugin are within the predetermined range. If they are still not within the predetermined range, the time interval for calling the packet capture component is increased or decreased again until the computing resources occupied by the traffic plugin are within the predetermined range.

3. The method according to any one of claims 1 to 2, characterized in that, The computing resources used are the processor utilization rate.

4. A time-adjusted audit flow control device, characterized in that, Located in the traffic plugin, it includes: The acquisition module is used to acquire the computing resources occupied by the traffic plugin, wherein the traffic plugin is used to capture the database traffic between the database client and the database, and send the captured database traffic to the audit service for auditing; A judgment module is used to determine whether the occupied computing resources are within a predetermined range, wherein the predetermined range is pre-configured; wherein the traffic plugin obtains the computing resources occupied by the traffic plugin according to a predetermined period; the traffic plugin counts the values ​​of the computing resources occupied by multiple traffic plugins obtained within a predetermined time period, wherein the length of the predetermined time period is the length of multiple predetermined periods; it determines the number of values ​​of the computing resources occupied by multiple traffic plugins that are within the predetermined range; if the number exceeds a threshold, it is determined that the computing resources occupied by the traffic plugin are within the predetermined range; if the number does not exceed the threshold, it is determined that the computing resources occupied by the traffic plugin are not within the predetermined range. The processing module is configured to: increase the time interval for calling the packet capture component if the computing resources occupied by the traffic plugin exceed the predetermined range, wherein the packet capture component is located in the traffic plugin and the traffic plugin captures database traffic through the packet capture component; maintain the time interval for calling the packet capture component unchanged if the computing resources occupied by the traffic plugin are within the predetermined range; and shorten the time interval for calling the packet capture component if the computing resources occupied by the traffic plugin are below the predetermined range.

5. The apparatus according to claim 4, characterized in that, The processing module is also used for: After the traffic plugin increases the time interval for calling the packet capture component, or after the traffic plugin shortens the time interval for calling the packet capture component, it is determined again whether the computing resources occupied by the traffic plugin are within the predetermined range. If they are still not within the predetermined range, the time interval for calling the packet capture component is increased or decreased again until the computing resources occupied by the traffic plugin are within the predetermined range.

6. The apparatus according to any one of claims 4 to 5, characterized in that, The computing resources used are the processor utilization rate.

7. An electronic device comprising a memory and a processor; wherein, The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the steps of the method according to any one of claims 1 to 3.

8. A readable storage medium having computer instructions stored thereon, wherein, When executed by a processor, the computer instructions implement the steps of the method described in any one of claims 1 to 3.

Images