A method for quickly locating problems that cause sporadic failures in operating systems

Abstract

The present invention relates to the field of operating system abnormality positioning, and specifically provides a method for quickly positioning the problem that causes the occasional fault of the operating system, including the following steps S1-S6 that are performed in sequence until the problem that causes the occasional fault of the operating system is determined, S1: determining whether the problem that causes the occasional fault of the operating system is a hardware problem; S2: determining whether the problem that causes the occasional fault of the operating system is an interrupt operation problem; S3: determining whether the problem that causes the occasional fault of the operating system is a CPU load abnormality problem; S4: determining whether the problem that causes the occasional fault of the operating system is a memory operation problem; S5: determining whether the problem that causes the occasional fault of the operating system is a disk operation problem; S6: determining whether the problem that causes the occasional fault of the operating system is a network operation problem. The method solves the technical problem that the prior art cannot quickly locate occasional crashes or occasional anomalies in the operating system.

Description

Technical Field

[0001] The invention relates to the field of operating system abnormality positioning, and specifically provides a method for quickly positioning problems that lead to occasional faults of an operating system. Background Art

[0002] With the continuous development of domestic operating systems, there are more and more application scenarios. However, in the process of adapting domestic operating systems to special customized hardware devices in various industries, they often encounter operating system abnormalities, such as occasional crashes during restart and occasional crashes during system operation. These problems often require coordination of senior engineers in multiple fields to discuss together, and it takes a lot of time to solve the problem.

[0003] Currently, there is no technology that can quickly locate specific problems of sporadic crashes or sporadic exceptions at the operating system level with a small number of engineers. Accordingly, the art needs a solution for quickly locating system exception problems to solve the above problems. Summary of the invention

[0004] In order to overcome the above-mentioned defects, the present invention is proposed to provide a solution to the technical problem in the prior art that sporadic crashes or sporadic anomalies cannot be quickly located in the operating system.

[0005] The present invention provides a method for quickly locating the problem causing the occasional failure of the operating system, and sequentially performing the following steps S1-S6 until the problem causing the occasional failure of the operating system is determined.

[0006] S1: Determine whether the problem that causes occasional operating system failures is a hardware problem by judging whether there are disk anomalies, memory bar anomalies, network card anomalies, or CPU internal watchdog anomalies;

[0007] S2: Check whether the number of interrupts in / proc / interrupts is increasing rapidly to determine whether the problem causing occasional failures of the operating system is an abnormal increase in interrupts.

[0008] S3: Use top to observe whether there is a continuous high load to determine whether the problem that causes occasional operating system failures is an abnormal CPU load problem;

[0009] S4: Check whether the value of the "available memory" part in the free command continues to decrease to determine whether the problem that causes occasional failures of the operating system is a memory allocation abnormality problem;

[0010] S5: Determine whether the problem causing the occasional failure of the operating system is an abnormal disk load problem by judging whether there is continuous writing to the disk or whether there are oversized files or folders;

[0011] S6: Determine whether the problem causing occasional failures of the operating system is an abnormal network load problem by judging whether there is a long-term high network traffic or a rapid increase in ports and sockets.

[0012] Further, the step S1 comprises:

[0013] When any of the following exceptions occurs: disk exception, memory bar exception, network card exception, and CPU internal watchdog exception, it is determined that the problem causing the occasional failure of the operating system is a hardware problem; otherwise, the problem causing the occasional failure of the operating system is not a hardware problem;

[0014] Replace the disk and observe whether the operating system abnormality is resolved. If so, there is a disk abnormality. If not, there is no disk abnormality.

[0015] Replace the memory module and observe whether the operating system exception is resolved. If so, the memory module exception exists. If not, the memory module exception does not exist.

[0016] Replace the network card and observe whether the operating system abnormality is resolved. If so, the network card abnormality exists. If not, the network card abnormality does not exist.

[0017] By turning on the CPU internal watchdog, observe whether the device restarts when an operating system exception occurs. If so, there is no CPU internal watchdog exception. If not, there is a CPU internal watchdog exception.

[0018] Further, the step S2 comprises:

[0019] S21: Check whether the irqbalance service is enabled: if yes, directly execute S23; if no, record the CPU number where the serial port interrupt is located, and execute step S22;

[0020] S22: Determine whether the CPU number used when the operating system is abnormal matches the CPU number where the serial port interrupt is located: if so, switch the CPU number where the serial port interrupt is located and then execute S23; if not, directly execute S23;

[0021] S23: Determine whether the content of / proc / interrupts contains a rapidly increasing number of interrupts within a preset time: If so, the problem that causes the occasional failure of the operating system is the abnormal growth of interrupts. Find the device driver location from the kernel source code according to the name of the interrupt processing function. If not, the problem that causes the occasional failure of the operating system is not the abnormal growth of interrupts.

[0022] Further, the step S3 comprises:

[0023] Use top to check whether there is a continuous high load:

[0024] If so, the problem that causes occasional failures of the operating system is abnormal CPU load. Record the process number that occupies the highest CPU, and use ltrace to analyze the time consumption of dynamic library calls, use strace to analyze the time consumption of system calls, and use perf to analyze the kernel time consumption for the program corresponding to the process number.

[0025] If not, the problem that caused the occasional operating system failure is not an abnormal CPU load problem.

[0026] Further, the step S4 comprises:

[0027] Run the free command to check the value of Available Memory and check whether it decreases continuously within the preset time. If so, the problem that causes sporadic operating system failures is abnormal memory allocation. Otherwise, the problem that causes sporadic operating system failures is not abnormal memory allocation.

[0028] Furthermore, when the problem causing the occasional failure of the operating system is a memory allocation exception, it is determined whether it is a kernel slab exception or an application memory leak exception; wherein,

[0029] By judging whether the slab in / proc / meminfo will continue to grow within the preset time: if so, there is a kernel slab abnormality. Observe / proc / slabinfo and check the allocation path of the continuously growing slab by increasing the KASAN parameter. If not, there is no kernel slab abnormality.

[0030] Whether there is an application memory leak is determined by judging whether the MemAvailable in / proc / meminfo continues to decrease within the preset time. If so, there is an application memory leak. The status of each process under / proc is traversed to determine that the process with memory leak has a continuously increasing VmSize and VmRSS within the preset time. If not, there is no memory leak in the application.

[0031] Further, the step S5 comprises:

[0032] When there is any abnormality in continuous writing and oversized files or folders, it is determined that the problem causing the occasional failure of the operating system is the abnormal disk load problem, otherwise the problem causing the occasional failure of the operating system is not the abnormal disk load problem; wherein,

[0033] By judging whether iotop continuously writes to the disk within a preset time: if so, there is a continuous write exception, the process number is obtained through iotop, the application corresponding to the process number and the application closely related to the application are obtained, the program source code of all related applications is analyzed, and the application with a logical problem in the program source code is determined to be the cause of the continuous write to disk exception. If not, there is no continuous write exception;

[0034] Use find or du to determine whether there are oversized files or folders in the disk IO: If so, there is an oversized file or folder exception. Use the package management command to find the software package to which the current oversized file or folder belongs, or use lsof to view the process executed by the oversized file, obtain the application corresponding to the software package or process and the application closely related to the application, analyze the program source code of all related applications, and determine that the application with logical problems in the program source code is the cause of the oversized file or folder exception. If not, there is no oversized file or folder exception.

[0035] Further, the step S6 comprises:

[0036] When there is any anomaly in the network traffic and the number of ports, it is determined that the problem causing the occasional failure of the operating system is the network load anomaly problem, otherwise the problem causing the occasional failure of the operating system is not the network load anomaly problem; wherein,

[0037] By judging whether there is high network traffic in the preset time through iftop, if yes, there is network traffic anomaly, record the network destination IP, destination port, source IP, source port and network protocol type, and find the service name of the corresponding network connection through the netstat command, if no, there is no network traffic anomaly;

[0038] By judging whether there is a rapid increase in ports and sockets within the preset time through iftop netstat: if so, there is an abnormal number of ports, and the network is strengthened through iptables; if not, there is no abnormal number of ports.

[0039] The working principle and beneficial effects of the present invention are:

[0040] In the technical solution of the present invention, abnormal problems are detected in six directions: common hardware, interrupt growth abnormality, CPU load abnormality, memory allocation abnormality, disk load abnormality, and network load abnormality, and the specific problem that causes the occasional failure of the operating system is located. This enables engineers to quickly locate the occasional failure to the specific problem, greatly reducing the personnel investment cost of the operating system during the hardware adaptation process. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The disclosure of the present invention will become more easily understood with reference to the accompanying drawings. It is easy for those skilled in the art to understand that these drawings are only for illustrative purposes and are not intended to limit the scope of protection of the present invention. In addition, similar numbers in the figures are used to represent similar components, among which:

[0042] Figure 1 It is a flow chart of a method for quickly locating problems that cause occasional failures of an operating system according to the present invention. DETAILED DESCRIPTION

[0043] Some embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0044] Figure 1 FIG. 1 is a flow chart of a method for quickly locating problems that cause occasional failures of an operating system according to the present invention. Figure 1 As shown, this embodiment proposes a method for quickly locating problems that cause sporadic failures of the operating system. Abnormal problem detection is performed in six directions, namely, common hardware, interrupt growth anomaly, CPU load anomaly, memory allocation anomaly, disk load anomaly, and network load anomaly, to locate the specific problem that causes sporadic failures of the operating system. The following describes the abnormality locating methods in the six directions.

[0045] In one embodiment, a Feiteng E2000 chip is used to install the Kylin embedded operating system V10 SP1, and a method for quickly locating problems that cause occasional failures of the operating system is performed.

[0046] 1. Determine whether there is any hardware abnormality

[0047] Factors that cause hardware abnormalities include disk abnormalities, memory stick abnormalities, network card abnormalities, and CPU internal watchdog abnormalities. When any of these factors is abnormal, it will be determined as a hardware abnormality, indicating that the problem that causes occasional failures of the operating system is a hardware problem.

[0048] 1.1 Replace the disk and see if the problem is solved:

[0049] 1.1.1 Yes, it means it is a disk problem;

[0050] 1.1.2 No, it means it is not a disk problem;

[0051] 1.2 Replace the memory module and see if the problem is solved:

[0052] 1.2.1 Yes, it means the problem is with the memory module;

[0053] 1.2.2 No, it means the problem is not with the memory module;

[0054] 1.3 Replace the network card and see if the problem is solved:

[0055] 1.3.1 Yes, it means the problem is with the network card;

[0056] 1.3.2 No, it means it is not a network card problem;

[0057] 1.4 Turn on the CPU internal watchdog and observe whether the device restarts when a problem occurs:

[0058] 1.4.1 Yes, it means it is not a problem with the CPU internal watchdog;

[0059] 1.4.2 No, it means there is a problem with the CPU internal watchdog.

[0060] By checking the disk, memory stick, network card and CPU internal watchdog one by one, when the problem causing occasional failure of the operating system is a hardware problem, the specific problem can be accurately located.

[0061] 2. Determine if there is an abnormality in the interrupt growth

[0062] 2.1 Check whether the irqbalance service is enabled.

[0063] 2.1.1 If this service is available, proceed directly to 2.2.

[0064] 2.1.2 If there is no such service, record the CPU number where the serial port interrupt is located (assuming it is CPU0), and check whether the CPU number used when the operating system has occasional failures matches CPU0.

[0065] 2.1.2.1 If it matches, switch the serial port interrupt to bind to another CPU number (such as CPU1), and then execute 2.2.

[0066] 2.1.2.2 If they do not match, proceed to 2.2.

[0067] 2.2 Pay attention to the content of / proc / interrupts for 5 minutes.

[0068] 2.2.1 If there is a rapid increase in the number of interrupts, the problem that causes occasional faults in the operating system is the abnormal growth of interrupts. The device driver location can be accurately found from the kernel source code based on the name of the interrupt processing function. When the device driver location is found, the crux of the problem has been found, and the system's occasional fault problem can be quickly located.

[0069] 2.2.2 If the number of interrupts does not increase rapidly, it means that the interrupts are normal, and the problem that causes occasional failures of the operating system is not an abnormal increase in interrupts.

[0070] In this embodiment, the abnormal growth of interrupts is usually determined through the / proc / interrupts file, which is a file that counts the number of interrupts in the Linux system. The file records the number of interrupts generated by each interrupt on each CPU. Normally, the number of interrupts will not increase too much. Only when occasional failures occur in the system will an interrupt show abnormal growth.

[0071] 3. Determine whether the CPU load is abnormal

[0072] 3.1 Use top to check whether there is a continuous high load:

[0073] 3.1.1 If yes, the problem that caused the occasional failure of the operating system was abnormal CPU load. Record the process number that occupies the highest CPU, and use ltrace to analyze the time consumption of dynamic library calls, strace to analyze the time consumption of system calls, and perf to analyze the kernel time consumption for the program corresponding to the process number. Locate the specific link that consumes CPU in the program.

[0074] 3.1.2 If no, it means that there is no abnormality in the CPU load, that is, the problem that causes occasional failures of the operating system is not an abnormal CPU load problem.

[0075] In this embodiment, to determine whether the CPU load is abnormal, the CPU load can usually be observed. Normally, the CPU load will be maintained at a relatively low level, such as 5%-50%. If the CPU load often appears at 90% or even 100%, it means that some programs in the system are abnormal.

[0076] 4. Determine if there are any abnormalities in memory allocation

[0077] Pay attention to the value of the "Available Memory" part in the free command for 5 minutes to see if it continues to decrease. If it continues to decrease, it means that there is an abnormality in memory allocation. At this time, check Slab in / proc / meminfo and MemAvailable in / proc / meminfo to confirm whether it is a kernel slab abnormality or an application memory leak abnormality.

[0078] In this embodiment, the memory allocation is judged to be abnormal. Usually, the memory will be stably maintained within a certain range. If the available memory continues to decrease, it means that there is a problem with the system.

[0079] 4.1 Pay attention to the Slab in / proc / meminfo for 5 minutes to see if it continues to grow:

[0080] 4.1.1 If there is growth, there is a kernel slab abnormality. Observe / proc / slabinfo to see which slab will continue to grow. Specifically, by increasing the KASAN parameter, check the allocation path of the corresponding slab and determine the exact problem point of the memory allocation abnormality.

[0081] 4.1.2 If there is no growth, it means that there is no abnormality in the slab allocation driven by the Linux kernel, that is, there is no memory leak in the Linux kernel;

[0082] 4.2 Pay attention to MemAvailable in / proc / meminfo for 5 minutes to see if it continues to decrease:

[0083] 4.2.1 If it continues to decrease, it means that there is an application memory leak problem. Then determine the specific process with the memory leak, traverse the status of each process under / proc, and pay attention to VmSize and VmRSS to see if they continue to grow: if they continue to grow, it means that the process has a memory leak; if they do not continue to grow, it means that the process has no memory leak;

[0084] 4.2.2 If there is no continuous decrease, it means there is no application memory leak problem.

[0085] 5. Determine whether the disk load is abnormal

[0086] Factors that cause abnormal disk load include continuous writing and oversized files or folders. When any of these factors exist, it will be judged that the disk load is abnormal, indicating that the problem that causes occasional failures of the operating system is the abnormal disk load problem.

[0087] 5.1 Pay attention to iotop for 5 minutes to see if there is continuous writing to the disk:

[0088] 5.1.1 If there is continuous writing, there is a continuous writing exception. Get the process number through iotop. Analyze the program source code of the application corresponding to the process number to confirm whether there is a logic problem. If so, it means that the application causes the continuous writing exception. If not, expand the scope of investigation and find applications that are closely related to the application to see if there are logic problems in their program source codes. Similarly, finally determine that the application with logic problems in the program source code is the cause of the continuous writing exception.

[0089] 5.1.2 If there is no continuous writing, no need to pay attention, that is, there is no continuous writing anomaly.

[0090] 5.2 Use find or du to determine whether there are oversized files or folders:

[0091] 5.2.1 If yes, there is an oversized file or folder exception. Use the package management command to find which software package the current file or folder belongs to, or use lsof to check which process operates the oversized file. Then analyze the program source code of the application corresponding to the software package or process to analyze whether there is a logical problem. If so, it means that the application causes the oversized file or folder exception. If not, expand the scope of investigation and find applications that are closely related to the application to see if there are logical problems in their program source code. And so on, finally determine that the application with logical problems in the program source code is the cause of the oversized file or folder exception.

[0092] 5.2.2 If there is no continuous writing, there is no need to pay attention, that is, there is no abnormality of oversized files or folders.

[0093] In this embodiment, to determine whether the disk load is abnormal, the disk load can usually be observed. Normally, the disk load will maintain a very low level, such as 0%-5%. If the disk load often appears above 50%, it means that some problems in the system are abnormal.

[0094] 6. Determine whether the network load is abnormal

[0095] Factors that cause network load abnormalities include network traffic and the number of ports. When any of these factors is abnormal, it will be determined that the network load is abnormal, indicating that the problem that causes occasional failures of the operating system is the abnormal network load.

[0096] 6.1 Watch iftop for 5 minutes to see if there is long-term high network traffic:

[0097] 6.1.1 If there is a long-term high network traffic, there is a network traffic anomaly. Record the network destination IP, destination port, source IP, source port, and network protocol type. Use the netstat command to find the service name of the corresponding network connection, that is, find the application with the problem. Analyze the program source code of the application to find the problem.

[0098] 6.1.2 If there is no long-term high network traffic, there is no need to pay attention, that is, there is no network traffic abnormality;

[0099] 6.2 Pay attention to netstat for 5 minutes to check whether there is a rapid increase in ports and sockets:

[0100] 6.2.1 If there is a rapid increase, there is an abnormal number of ports, and the network should be strengthened through iptables;

[0101] 6.2.2 If not, no need to worry, that is, there is no abnormal number of ports.

[0102] In this embodiment, the network load is judged to be abnormal. Usually, the load is low, such as 0%-30%. If it is continuously maintained above 90%, it indicates that there is a problem with the system.

[0103] It should be pointed out that although the various steps in the above embodiments are described in a specific order, those skilled in the art can understand that in order to achieve the effects of the present invention, different steps do not have to be performed in such an order, and they can be performed simultaneously (in parallel) or in other orders. These changes are within the scope of protection of the present invention.

[0104] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A method for quickly locating problems that cause sporadic failures of an operating system, characterized in that: Perform the following steps S1-S6 in sequence until the problem that causes the occasional failure of the operating system is determined. S1: Determine whether the problem that causes occasional operating system failures is a hardware problem by judging whether there are disk anomalies, memory bar anomalies, network card anomalies, or CPU internal watchdog anomalies; S2: Check whether the number of interrupts in / proc / interrupts is increasing rapidly to determine whether the problem causing occasional failures of the operating system is an abnormal increase in interrupts. S3: Use top to observe whether there is a continuous high load to determine whether the problem that causes occasional operating system failures is an abnormal CPU load problem; S4: Check whether the value of the "available memory" part in the free command continues to decrease to determine whether the problem that causes occasional failures of the operating system is a memory allocation abnormality problem; S5: Determine whether the problem causing the occasional failure of the operating system is an abnormal disk load problem by judging whether there is continuous writing to the disk or whether there are oversized files or folders; S6: Determine whether the problem causing the occasional failure of the operating system is an abnormal network load problem by judging whether there is a long-term high network traffic or whether there is a rapid increase in ports and sockets; The step S2 comprises: S21: Check whether the irqbalance service is enabled: if yes, directly execute S23; if no, record the CPU number where the serial port interrupt is located, and execute step S22; S22: Determine whether the CPU number used when the operating system is abnormal matches the CPU number where the serial port interrupt is located: if so, switch the CPU number where the serial port interrupt is located and then execute S23; if not, directly execute S23; S23: Determine whether the content of / proc / interrupts contains a rapidly increasing number of interrupts within a preset time: If so, the problem that causes the occasional failure of the operating system is the abnormal growth of interrupts. Find the device driver location from the kernel source code according to the name of the interrupt processing function. If not, the problem that causes the occasional failure of the operating system is not the abnormal growth of interrupts.

2. A method for quickly locating problems that cause sporadic failures of an operating system according to claim 1, characterized in that: The step S1 comprises: When any of the following exceptions occurs: disk exception, memory bar exception, network card exception, and CPU internal watchdog exception, it is determined that the problem causing the occasional failure of the operating system is a hardware problem; otherwise, the problem causing the occasional failure of the operating system is not a hardware problem; Replace the disk and observe whether the operating system abnormality is resolved. If so, there is a disk abnormality. If not, there is no disk abnormality. Replace the memory module and observe whether the operating system exception is resolved. If so, the memory module exception exists. If not, the memory module exception does not exist. Replace the network card and observe whether the operating system abnormality is resolved. If so, the network card abnormality exists. If not, the network card abnormality does not exist. By turning on the CPU internal watchdog, observe whether the device restarts when an operating system exception occurs. If so, there is no CPU internal watchdog exception. If not, there is a CPU internal watchdog exception.

3. A method for quickly locating problems that cause sporadic failures of an operating system according to claim 1, characterized in that: The step S3 comprises: Use top to check whether there is a continuous high load: If so, the problem that causes occasional failures of the operating system is abnormal CPU load. Record the process number that occupies the highest CPU, and use ltrace to analyze the time consumption of dynamic library calls, use strace to analyze the time consumption of system calls, and use perf to analyze the kernel time consumption for the program corresponding to the process number. If not, the problem that caused the occasional operating system failure is not an abnormal CPU load problem.

4. A method for quickly locating problems that cause sporadic failures of an operating system according to claim 1, characterized in that: The step S4 comprises: Use the free command to check the value of the "Available Memory" part to determine whether it continues to decrease within the preset time. If so, the problem that causes the occasional failure of the operating system is abnormal memory allocation. Otherwise, the problem that causes the occasional failure of the operating system is not abnormal memory allocation.

5. A method for quickly locating problems that cause sporadic failures of an operating system according to claim 4, characterized in that: When the problem that causes occasional operating system failures is a memory allocation exception, determine whether it is a kernel slab exception or an application memory leak exception; By judging whether the slab in / proc / meminfo will continue to grow within the preset time: if so, there is a kernel slab abnormality. Observe / proc / slabinfo and check the allocation path of the continuously growing slab by increasing the KASAN parameter. If not, there is no kernel slab abnormality. Whether there is an application memory leak is determined by judging whether the MemAvailable in / proc / meminfo continues to decrease within the preset time. If so, there is an application memory leak. The status of each process under / proc is traversed to determine that the process with memory leak has a continuously increasing VmSize and VmRSS within the preset time. If not, there is no memory leak in the application.

6. A method for quickly locating problems that cause sporadic failures of an operating system according to claim 1, characterized in that: The step S5 comprises: When there is any abnormality in continuous writing and oversized files or folders, it is determined that the problem causing the occasional failure of the operating system is the abnormal disk load problem, otherwise the problem causing the occasional failure of the operating system is not the abnormal disk load problem; wherein, By judging whether iotop continuously writes to the disk within a preset time: if so, there is a continuous write exception, the process number is obtained through iotop, the application corresponding to the process number and the application closely related to the application are obtained, the program source code of all related applications is analyzed, and the application with a logical problem in the program source code is determined to be the cause of the continuous write to disk exception. If not, there is no continuous write exception; Use find or du to determine whether there are oversized files or folders in the disk IO: If so, there is an oversized file or folder exception. Use the package management command to find the software package to which the current oversized file or folder belongs, or use lsof to view the process executed by the oversized file, obtain the application corresponding to the software package or process and the application closely related to the application, analyze the program source code of all related applications, and determine that the application with logical problems in the program source code is the cause of the oversized file or folder exception. If not, there is no oversized file or folder exception.

7. A method for quickly locating problems that cause sporadic failures of an operating system according to claim 1, characterized in that: The step S6 comprises: When there is any anomaly in the network traffic and the number of ports, it is determined that the problem causing the occasional failure of the operating system is the network load anomaly problem, otherwise the problem causing the occasional failure of the operating system is not the network load anomaly problem; wherein, By judging whether there is high network traffic in the preset time through iftop, if yes, there is network traffic anomaly, record the network destination IP, destination port, source IP, source port and network protocol type, and find the service name of the corresponding network connection through the netstat command, if no, there is no network traffic anomaly; By judging whether there is a rapid increase in ports and sockets within the preset time through iftop netstat: if so, there is an abnormal number of ports, and the network is strengthened through iptables; if not, there is no abnormal number of ports.

Images