Process monitoring method and computing device

Abstract

The embodiment of the invention provides a process monitoring method and computing equipment, running information of a target process at a detection point of a process management function is obtained, a process change event is generated according to the running information, at least one detection point is set in the process management function, and the process change event comprises an identifier and an event type of the target process. The event type comprises a creation type, a destruction type and an update type; and notifying the target object of the process change event. According to the process monitoring method and the computing device, the target object can timely sense the process change event in the operating system and the event type of the process change event, the real-time performance of process monitoring is improved, all processes in the operating system do not need to be inquired every time, and the system overhead is low.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular, to a process monitoring method and a computing device. Background Art

[0002] An operating system runs in a computing device, and the operating system can implement task processing and resource allocation through multiple processes. In practical applications, users usually want to monitor and perceive various events of each process in a timely manner, including creation events, destruction events, and update events.

[0003] In the related art, in an operating system (for example, a Linux system), the process information of each process can be periodically queried by calling a process status (ps) command or implementing a process monitoring (top) command, so as to timely monitor and perceive various events of processes in the system through the process information of each process.

[0004] However, if the query cycle is set to be short, it is necessary to frequently traverse and query all processes in the operating system. Although the real-time performance of process monitoring can be guaranteed, the system overhead is too large. If the query cycle is set to be long, it may not be possible to perceive the process from creation to destruction of some processes in time, resulting in poor real-time performance of process monitoring. Summary of the invention

[0005] The embodiments of the present application provide a process monitoring method and a computing device, which can be used to improve the real-time performance of process monitoring and reduce system overhead during process monitoring.

[0006] In a first aspect, an embodiment of the present application provides a process monitoring method, the method comprising:

[0007] Obtaining the running information of the target process at the detection point of the process management function, and generating a process change event according to the running information, wherein at least one detection point is set in the process management function, and the process change event includes the identifier and event type of the target process, and the event type includes a creation type, a destruction type, and an update type;

[0008] Notifies the target object of a process change event.

[0009] In the above technical solution, the target object can timely perceive the process change events in the operating system and the event type of the process change events, which is conducive to improving the real-time performance of process monitoring, and there is no need to query all processes in the operating system each time, and the system overhead is low.

[0010] In a possible implementation, the process management function includes a process execution function, in which a first detection point and a second detection point are set; obtaining running information of a target process at the detection point of the process management function, and generating a process change event according to the running information, including:

[0011] Acquire first running information of the target process at a first detection point of the process execution function, where the first detection point is used to collect running information of the process execution function in the early stage of execution, and the first running information includes a process identifier PID and startup information of the target process;

[0012] Generate a first process change event according to the first operation information;

[0013] Acquire second running information of the target process at a second detection point of the process execution function, where the second detection point is used to collect running information of the process execution function after execution, and the second running information includes a PID, a process name, and an execution result of the target process;

[0014] A second process change event is generated according to the second running information.

[0015] In the above technical solution, by obtaining the running information of the process execution function at the detection point and generating the first process change event or the second process change event, the target object can timely perceive the process change event of the target process during the process execution.

[0016] In a possible implementation, generating a first process change event according to the first running information includes:

[0017] The first operation information is stored in a first data table, and a first process change event is generated according to the event type indicated by the first detection point and the first operation information.

[0018] In the above technical solution, the first operation information can be stored in a first data table so that the computing device can quickly query or filter the target process based on the first data table.

[0019] In a possible implementation, storing the first operation information in a first data table includes:

[0020] Obtaining a first configuration file, the first configuration file including a whitelist, a blacklist, and preset parameters;

[0021] Determine whether the target process is a process specified for monitoring by the target object according to the first configuration file and the startup information of the target process in the first running information;

[0022] When it is determined that the target process is a process designated for monitoring by the target object, the first operation information is stored in the first data table.

[0023] In the above technical solution, the target process can be matched based on the first configuration file to quickly determine whether the target process is a process specified to be monitored by the target object. If the target process is determined to be a process specified to be monitored by the target object, the first running information is stored in the first data table, so that the computing device can quickly query or filter the target process based on the first data table.

[0024] In a possible implementation, generating a first process change event according to the first running information includes:

[0025] According to the first operation information, determining whether the target process is a process specified for monitoring by the target object;

[0026] When it is determined that the target process is a process specified for monitoring by the target object, the first operation information is stored in a first data table, and a first process change event is generated according to the event type indicated by the first detection point and the first operation information.

[0027] In the above technical solution, when it is determined that the target process is a process specified for monitoring by the target object, the first operation information can be stored in a first data table so that the computing device can quickly query or filter the target process based on the first data table.

[0028] In a possible implementation, judging, according to the first running information, whether the target process is a process designated for monitoring by the target object includes:

[0029] Get a first configuration file;

[0030] According to the first configuration file and the startup information of the target process in the first operation information, it is determined whether the target process is a process specified for monitoring by the target object, and the first configuration file includes a white list, a black list and preset parameters.

[0031] In the above technical solution, the target process can be matched based on the first configuration file to quickly determine whether the target process is a process specified for monitoring by the target object.

[0032] In a possible implementation, generating a second process change event according to the second running information includes:

[0033] Determine whether the PID of the target process exists in the first data table;

[0034] In the case where the PID of the target process exists in the first data table, determining whether the execution result of the target process in the second operation information is successful;

[0035] If the execution result is execution failure, deleting the process information of the target process in the first data table, and generating a second process change event according to the event type indicated by the second detection point and the second operation information;

[0036] When the execution result is successful, a second process change event is generated according to the event type indicated by the second detection point and the second operation information.

[0037] In the above technical solution, if the target process fails to execute, the computing device does not need to continue to monitor the target process. The process information of the target process can be deleted in the first data table to reduce the amount of data for subsequent data queries based on the first data table and improve query efficiency; by generating a second process change event corresponding to the target process, the target object can promptly perceive the changes of the target process during the process execution.

[0038] In a possible implementation, the process management function includes a process update function, in which a third detection point and a fourth detection point are provided; obtaining operation information of the target process at the detection point of the process management function, and generating a process change event according to the operation information, including:

[0039] Obtaining third running information of the target process at a third detection point of the process update function, where the third detection point is used to collect running information of the process update function in the early stage of execution, and the third running information includes the PID of the target process and the current process name;

[0040] In the case of determining that the PID of the target process exists in the first data table, determining whether the target process is in a process name update state;

[0041] When the target process is in a process name update state, the current process name of the target process in the third operation information is determined as the process name of the target process before the update, and fourth operation information of the target process at a fourth detection point of the process update function is obtained, the fourth detection point is used to collect the operation information of the process update function after execution, and the fourth operation information includes the PID of the target process, the updated process name and the update result;

[0042] A third process change event is generated according to the process name of the target process before being updated and the fourth running information.

[0043] In the above technical solution, by acquiring the running information of the process update function at the detection point and generating the third process change event, the target object can timely perceive the changes of the target process during the process update.

[0044] In a possible implementation, generating a third process change event according to the process name of the target process before the update and the fourth running information includes:

[0045] Determine whether the PID of the target process exists in the first data table;

[0046] In the case where the PID of the target process exists in the first data table, determining whether the update result of the target process in the fourth operation information is a successful update;

[0047] When the update result is successful, the process name of the target process stored in the first data table is updated according to the updated process name of the target process in the fourth operation information, and a third process change event is generated according to the event type indicated by the fourth detection point, the process before the update of the target process and the fourth operation information.

[0048] In the above technical solution, the target process can be quickly screened through the first data table, and when it is determined that the target process is in a process name update state, the current process name of the target process is determined as the process name before the target process is updated, so that the subsequent computing device can search and update the corresponding data of the target process after the process name of the target process is updated. By generating the third process change event, the target object can timely perceive the changes of the target process during the process update process.

[0049] In a possible implementation, the process management function includes a process exit function, in which a fifth detection point is set; obtaining running information of the target process at the detection point of the process management function, and generating a process change event according to the running information, including:

[0050] Acquire fifth running information of the target process at the fifth detection point of the process exit function, where the fifth detection point is used to collect running information of the process exit function when it is executed, and the fifth running information includes the PID and process name of the target process;

[0051] Determine whether the PID of the target process exists in the first data table;

[0052] If the PID of the target process exists in the first data table, deleting the process information of the target process in the first data table;

[0053] A fourth process change event is generated according to the event type indicated by the fifth detection point and the fifth operation information.

[0054] In the above technical solution, by obtaining the running information of the process exit function at the detection point and generating the fourth process change event, the target object can timely perceive the changes of the target process during the process exit. During the process exit, the process information of the target process can be deleted in the first data table to reduce the amount of data for subsequent data query based on the first data table and improve the query efficiency.

[0055] In a possible implementation, notifying a target object of a process change event includes:

[0056] Generate corresponding notification messages based on process change events;

[0057] Sends a notification message to the target object.

[0058] In the above technical solution, a corresponding notification message is generated based on the process change event and sent to the target object, so that the target object can timely perceive the process change event of the target process and the event type of the process change event, which is conducive to improving the real-time performance of process monitoring.

[0059] In a possible implementation, generating a corresponding notification message based on a process change event includes:

[0060] According to the process change event, determine whether the target process is the process specified for notification by the target object;

[0061] In the case where the target process is a process for which notification is specified by the target object, determining whether a PID of the target process exists in the second data table;

[0062] When it is determined that the PID of the target process exists in the second data table, a corresponding notification message is generated based on the process change event.

[0063] In the above technical scheme, when it is determined that the target process is the process specified for notification by the target object, the target process can be quickly screened through the second data table, and after the screening is passed, a corresponding notification message is generated based on the process change event, so that the target object can promptly perceive the process change event of the target process and the event type of the process change event, which is conducive to improving the real-time performance of process monitoring.

[0064] In a possible implementation, the creation type further includes a second creation type; judging, according to the process change event, whether the target process is a process for which notification is specified by the target object, includes:

[0065] Obtain a second configuration file, the second configuration file including a plurality of preset process names;

[0066] In the case where the event type in the process change event is the second creation type or the destruction type, judging whether the target process is a process specified for notification by the target object according to the process name of the target process in the process change event and the second configuration file;

[0067] When the event type in the process change event is an update type, it is determined whether the target process is a process designated for notification by the target object according to the process name of the target process in the process change event before the update and the second configuration file.

[0068] In the above technical solution, the second configuration file can be obtained, and the target process can be quickly matched based on the first configuration file to quickly determine whether the target process is a process specified for notification by the target object.

[0069] In a possible implementation, the creation type further includes a second creation type; and generating a corresponding notification message based on the process change event includes:

[0070] When the event type in the process change event is the second creation type and the execution result of the target process is successful execution, a first notification message is generated, and the first notification message is used to indicate that the target process is successfully created;

[0071] When the event type in the process change event is the second creation type and the execution result of the target process is execution failure, deleting the process information of the target process in the second data table, and generating a second notification message, the second notification message is used to indicate that the creation of the target process has failed;

[0072] When the event type in the process change event is an update type, the process name of the target process stored in the second data table is updated according to the updated process name of the target process in the process change event, and a third notification message is generated, where the third notification message is used to indicate that the process name of the target process is updated successfully;

[0073] When the event type in the process change event is a destruction type, the process information of the target process is deleted in the second data table, and a fourth notification message is generated, where the fourth notification message is used to indicate that the target process is destroyed.

[0074] In the above technical solution, different notification messages can be selected according to the event type of the process change event to improve the flexibility of the process change event notification.

[0075] In a possible implementation, the creation type includes a first creation type; and the method further includes:

[0076] When the event type in the process change event is the first creation type, the first running information in the process change event is stored in the second data table.

[0077] In the above technical solution, when it is determined that the target process is the process specified for notification by the target object, the first running information can be stored in the second data table so that the computing device can quickly query or filter the target process based on the second data table.

[0078] In a possible implementation, notifying a target object of a process change event includes:

[0079] According to the process change event, determine whether the target process is the process specified for notification by the target object;

[0080] In the case of determining that the target process is the process for which the target object specifies notification, determining whether the second data table includes the PID of the target process;

[0081] In the case where it is determined that the PID of the target process exists in the second data table, generating a corresponding notification message based on the process change event;

[0082] Sends a notification message to the target object.

[0083] In the above technical scheme, when it is determined that the target process is the process specified for notification by the target object, the target process can be quickly screened through the second data table, and after the screening is passed, a corresponding notification message is generated based on the process change event and sent to the target object, so that the target object can timely perceive the process change event of the target process and the event type of the process change event, which is conducive to improving the real-time performance of process monitoring.

[0084] In a possible implementation, the creation type further includes a second creation type; judging, according to the process change event, whether the target process is a process for which notification is specified by the target object, includes:

[0085] Obtain a second configuration file, the second configuration file including a plurality of preset process names;

[0086] When the event type of the target process in the process change event is the second creation type or the destruction type, judging whether the target process is a process specified for notification by the target object according to the process name of the target process in the process change event and the second configuration file;

[0087] When the event type of the target process in the process change event is an update type, it is determined whether the target process is a process designated for notification by the target object according to the process name of the target process before the update and the second configuration file.

[0088] In the above technical solution, the second configuration file can be obtained, and the target process can be quickly matched based on the first configuration file to quickly determine whether the target process is a process specified for notification by the target object.

[0089] In a second aspect, an embodiment of the present application provides a process monitoring device, including:

[0090] A processing module, used to obtain the running information of the target process at the detection point of the process management function, and generate a process change event according to the running information, wherein at least one detection point is set in the process management function, and the process change event includes the identifier of the target process and the event type, and the event type includes a creation type, a destruction type and an update type;

[0091] The transceiver module is used to notify the target object of process change events.

[0092] The process monitoring device provided in the embodiment of the present application can execute the technical solution as described in any one of the first aspects, and its beneficial effects are similar, which will not be repeated here.

[0093] In a possible implementation, the process management function includes a process execution function, and the process execution function is provided with a first detection point and a second detection point; the processing module is specifically used for:

[0094] Acquire first running information of the target process at a first detection point of the process execution function, where the first detection point is used to collect running information of the process execution function in the early stage of execution, and the first running information includes a process identifier PID and startup information of the target process;

[0095] Generate a first process change event according to the first operation information;

[0096] Acquire second running information of the target process at a second detection point of the process execution function, where the second detection point is used to collect running information of the process execution function after execution, and the second running information includes a PID, a process name, and an execution result of the target process;

[0097] A second process change event is generated according to the second running information.

[0098] In a possible implementation, the processing module is further configured to:

[0099] The first operation information is stored in a first data table, and a first process change event is generated according to the event type indicated by the first detection point and the first operation information.

[0100] In a possible implementation, the processing module is further configured to:

[0101] Obtaining a first configuration file, the first configuration file including a whitelist, a blacklist, and preset parameters;

[0102] Determine whether the target process is a process specified for monitoring by the target object according to the first configuration file and the startup information of the target process in the first running information;

[0103] When it is determined that the target process is a process designated for monitoring by the target object, the first operation information is stored in the first data table.

[0104] In a possible implementation, the processing module is further configured to:

[0105] Determine whether the PID of the target process exists in the first data table;

[0106] In the case where the PID of the target process exists in the first data table, determining whether the execution result of the target process in the second operation information is successful;

[0107] If the execution result is execution failure, deleting the process information of the target process in the first data table, and generating a second process change event according to the event type indicated by the second detection point and the second operation information;

[0108] When the execution result is successful, a second process change event is generated according to the event type indicated by the second detection point and the second operation information.

[0109] In a possible implementation, the process management function includes a process update function, and the process update function is provided with a third detection point and a fourth detection point; the processing module is further specifically used for:

[0110] Obtaining third running information of the target process at a third detection point of the process update function, where the third detection point is used to collect running information of the process update function in the early stage of execution, and the third running information includes the PID of the target process and the current process name;

[0111] In the case of determining that the PID of the target process exists in the first data table, determining whether the target process is in a process name update state;

[0112] When the target process is in a process name update state, the current process name of the target process in the third operation information is determined as the process name of the target process before the update, and fourth operation information of the target process at a fourth detection point of the process update function is obtained, the fourth detection point is used to collect the operation information of the process update function after execution, and the fourth operation information includes the PID of the target process, the updated process name and the update result;

[0113] A third process change event is generated according to the process name of the target process before being updated and the fourth running information.

[0114] In a possible implementation, the processing module is further configured to:

[0115] Determine whether the PID of the target process exists in the first data table;

[0116] In the case where the PID of the target process exists in the first data table, determining whether the update result of the target process in the fourth operation information is a successful update;

[0117] When the update result is successful, the process name of the target process stored in the first data table is updated according to the updated process name of the target process in the fourth operation information, and a third process change event is generated according to the event type indicated by the fourth detection point, the process before the update of the target process and the fourth operation information.

[0118] In a possible implementation, the process management function includes a process exit function, and the process exit function is provided with a fifth detection point; the processing module is further specifically used for:

[0119] Acquire fifth running information of the target process at the fifth detection point of the process exit function, where the fifth detection point is used to collect running information of the process exit function when it is executed, and the fifth running information includes the PID and process name of the target process;

[0120] Determine whether the PID of the target process exists in the first data table;

[0121] If the PID of the target process exists in the first data table, deleting the process information of the target process in the first data table;

[0122] A fourth process change event is generated according to the event type indicated by the fifth detection point and the fifth operation information.

[0123] In a possible implementation, the transceiver module is specifically used for:

[0124] Generate corresponding notification messages based on process change events;

[0125] Sends a notification message to the target object.

[0126] In a possible implementation, the transceiver module is further configured to:

[0127] According to the process change event, determine whether the target process is the process specified for notification by the target object;

[0128] In the case where the target process is a process for which notification is specified by the target object, determining whether a PID of the target process exists in the second data table;

[0129] When it is determined that the PID of the target process exists in the second data table, a corresponding notification message is generated based on the process change event.

[0130] In a possible implementation, the creation type further includes a second creation type; and the transceiver module is further configured to:

[0131] Obtain a second configuration file, the second configuration file including a plurality of preset process names;

[0132] In the case where the event type in the process change event is the second creation type or the destruction type, judging whether the target process is a process specified for notification by the target object according to the process name of the target process in the process change event and the second configuration file;

[0133] When the event type in the process change event is an update type, it is determined whether the target process is a process designated for notification by the target object according to the process name of the target process in the process change event before the update and the second configuration file.

[0134] In a possible implementation, the creation type further includes a second creation type; and the transceiver module is further configured to:

[0135] When the event type in the process change event is the second creation type and the execution result of the target process is successful execution, a first notification message is generated, and the first notification message is used to indicate that the target process is successfully created;

[0136] When the event type in the process change event is the second creation type and the execution result of the target process is execution failure, deleting the process information of the target process in the second data table, and generating a second notification message, the second notification message is used to indicate that the creation of the target process has failed;

[0137] When the event type in the process change event is an update type, the process name of the target process stored in the second data table is updated according to the updated process name of the target process in the process change event, and a third notification message is generated, where the third notification message is used to indicate that the process name of the target process is updated successfully;

[0138] When the event type in the process change event is a destruction type, the process information of the target process is deleted in the second data table, and a fourth notification message is generated, where the fourth notification message is used to indicate that the target process is destroyed.

[0139] In a possible implementation manner, the creation type includes a first creation type; and the processing module is further configured to:

[0140] When the event type in the process change event is the first creation type, the first running information in the process change event is stored in the second data table.

[0141] In a third aspect, an embodiment of the present application provides a computing device, including: a processor and a memory; the processor and the memory are coupled;

[0142] The memory is used to store computer instructions;

[0143] The processor is used to execute computer instructions stored in the memory to perform the method as described in any one of the first aspects.

[0144] The computing device provided in the embodiment of the present application can execute the technical solution as described in any one of the first aspects, and its beneficial effects are similar, which will not be repeated here.

[0145] In a fourth aspect, an embodiment of the present application provides a chip, wherein the chip is used to implement the method as described in any one of the first aspects.

[0146] The chip provided in the embodiment of the present application can execute the technical solution as described in any one of the first aspects, and its beneficial effects are similar, which will not be repeated here.

[0147] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a computer, a method as described in any one of the first aspects is implemented.

[0148] The computer-readable storage medium provided in the embodiment of the present application can execute the technical solution as described in any one of the first aspects, and its beneficial effects are similar and will not be repeated here.

[0149] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the method described in any one of the first aspects.

[0150] The computer program product provided in the embodiment of the present application can execute the technical solution as described in any one of the first aspects, and its beneficial effects are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0151] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0152] Figure 1 A schematic diagram of a process life cycle scenario provided in an embodiment of the present application;

[0153] Figure 2 One of the flow charts of a process monitoring method provided in an embodiment of the present application;

[0154] Figure 3 A schematic diagram of a process for obtaining the running information of a process management function at each detection point provided in an embodiment of the present application;

[0155] Figure 4 A second flowchart of a process monitoring method provided in an embodiment of the present application;

[0156] Figure 5 A third flow chart of a process monitoring method provided in an embodiment of the present application;

[0157] Figure 6 A fourth flowchart of a process monitoring method provided in an embodiment of the present application;

[0158] Figure 7 A fifth flow chart of a process monitoring method provided in an embodiment of the present application;

[0159] Figure 8 A schematic diagram of the structure of a process monitoring device provided in an embodiment of the present application;

[0160] Fig. 9 A schematic diagram of the hardware structure of a computing device provided in an embodiment of the present application.

[0161] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0162] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0163] First, combine Figure 1 , a scenario of a process life cycle provided in an embodiment of the present application is described.

[0164] Figure 1 A schematic diagram of a process life cycle scenario provided in an embodiment of the present application. Figure 1 At the first moment, n processes are created in the operating system, where n is an integer greater than 1. Each process may be marked with a corresponding process identifier (PID) so that each process can be quickly and accurately identified by the PID.

[0165] At the second moment, a new process X is created in the operating system; at the third moment, the process name of the process X is updated from "process X" to "process Y"; at the fourth moment, process Y is destroyed.

[0166] Computing devices can periodically query the process information of each process in the operating system through the ps or top command based on the query cycle. However, if the query cycle is set to a short period, it is necessary to frequently traverse and query all processes in the operating system. Although the real-time performance of process monitoring can be guaranteed, the system overhead is too large; if the query cycle is set to a long period, it may not be possible to perceive the process from creation to destruction of some processes in time, resulting in poor real-time performance of process monitoring. For example, in Figure 1 Between the second moment and the fourth moment shown, the operating system has a creation event of process X and a destruction event of process X, but because the query cycle is too long, the computing device does not perform a process query between the second moment and the fourth moment, making it impossible for the computing device to monitor the creation event of process X and the destruction event of process X in time, resulting in poor real-time performance of process monitoring.

[0167] The embodiment of the present application provides a process monitoring method, which can obtain the running information of the process management function at the detection point, generate a process change event according to the running information, and notify the target object of the process change event. At least one detection point is set in the process management function, and the process change event includes the identifier and event type of the target process, and the event type includes a creation type, a destruction type, and an update type. The method can collect the running information of the target process during the execution process through at least one detection point in the process management function, so that the computing device can quickly determine the process change event based on the running information and notify the target object of the process change event, so that the target object can timely perceive the process that has changed in the system and the change type of the process, which is conducive to improving the real-time performance of process monitoring. In addition, the method does not need to query all processes in the operating system every time, and the system overhead is low.

[0168] The process monitoring method provided in the embodiment of the present application can be applied to the process monitoring scenario of the operating system in the computing device, and can also be used in other scenarios. The embodiment of the present application does not limit the application scenario of the process monitoring method. The operating system may include but is not limited to the Linux operating system.

[0169] The technical solution of the present application is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0170] Figure 2 This is one of the flow charts of a process monitoring method provided in the embodiment of the present application. Figure 2 , the method specifically comprises:

[0171] S201. Obtain the running information of the target process at the detection point of the process management function, and generate a process change event according to the running information.

[0172] Process management functions may include the following types: process creation function, process execution function, process update function and process exit function. For example, the process creation function may include a copy (fork) function, the process execution function may include an execution file (execve) function, the process update function may include a process control (prctl) function, and the process exit function may include an exit (exit) function.

[0173] The process creation function can be used to create a process. By executing the process creation function, a child process B corresponding to the parent process A can be created. When the child process B is created, the operating system has allocated relevant system resources to the child process B, and the child process B has the correct PID, but the process name of the child process B has not been updated. The process name of the child process B is still the process name of the parent process A. For example, assuming that the parent process is a shell script, the child process corresponding to the shell script can be created by executing the fork function: the mysql process. After the mysql process is created, the PID of the mysql process has been generated, but the process name of the mysql process is still the process name of the shell script (sh).

[0174] The process execution function can be used to execute a process. When calling the execution function to execute a created process, the process name of the process can be updated. For example, when calling the execve function to execute the created mysql process, the process name of the mysql process is updated from "sh" to "mysql".

[0175] The process exit function can be used to destroy the process. In certain embodiments, "destroy the process" can also be referred to as "exit process".

[0176] The process exit conditions may include normal exit conditions and abnormal exit conditions. Both of these exit conditions will eventually execute the process exit function to complete the normal process resource release and exit.

[0177] The normal exit situation can be used to indicate the situation that the process exits after execution ends. In some embodiments, the process can exit normally after receiving a termination signal (Signal Terminate, SIGTERM).

[0178] The abnormal exit situation can be used to indicate that the process exits due to an abnormal signal during execution. The abnormal signal is used to indicate that the process encounters an abnormal situation during execution. Exemplarily, the abnormal signal may include: a process abort (signal abort, SIGABRT) signal, a bus error (signal bus error, SIGBUS) signal, and a segmentation fault (segmentation fault) signal.

[0179] At least one detection point can be set in a process management function, and the number of detection points set in different types of process management functions can be different. Figure 3 , detailed description of the detection points set in each type of process management function.

[0180] Figure 3 A schematic diagram of a process for obtaining the running information of a process management function at each detection point provided by an embodiment of the present application. Figure 3 ,The process management functions include process execution function, process update function and process exit function.

[0181] (1) Process execution function

[0182] Two detection points are set in the process execution function, namely the first detection point and the second detection point.

[0183] The first detection point can be used to collect the running information of the process execution function in the early stage of execution. In the subsequent description, the "running information of the process execution function in the early stage of execution" is referred to as the "first running information". The first running information may include the PID and startup information of the target process. The startup information may include but is not limited to: process file name (filename) and / or startup parameters (for example, argv parameters).

[0184] At the stage of collecting the first running information at the first detection point, the target process has just been created through the process creation function but has not yet been executed. In this stage, the target process has a PID and the process name does not meet the requirements. The process name of the target process is still the process name of the parent process corresponding to the target process, rather than the process name of the target process itself.

[0185] The PID may be used to identify the target process, for example, the PID may be "123456"; the process file name may be used to indicate path information of the process file of the target process; and the startup parameter may be a parameter required when the target process is started.

[0186] The second detection point can be used to collect the running information of the process execution function after execution. In the subsequent description, the "running information of the process execution function after execution" is referred to as "second running information". The second running information may include the PID, process name and execution result of each target process in the target process. The process name may be the name of the target process, for example, the process name may be "sh"; the execution result may be execution success or execution failure. It is understandable that if the execution result is execution success, it means that the target process has been created and executed normally; if the execution result is execution failure, it means that the target process has failed to be created.

[0187] In the stage of collecting the second operation information at the second detection point, the target process has a PID and the process name meets the requirements, and the process name of the target process has been updated from the parent process name of the target process to the process name of the target process itself.

[0188] In one implementation, the detection point may be registered in the process management function in the form of a hook function.

[0189] In some embodiments, the kernel probe (kprobe) and kernel return probe (kretprobe) in the extended Berkeley Packet Filter (eBPF) technology can be used to implement the registration process of the detection point in the process management function.

[0190] Optionally, kprobe may be used to register the first detection point (execve kprobe hook) in the form of a hook function in the process execution function (execve); kretprobe may be used to register the second detection point (execvekretprobe hook) in the form of a hook function in the process execution function (execve).

[0191] (2) Process update function

[0192] Two detection points are set in the process update function, namely the third detection point and the fourth detection point.

[0193] The third detection point can be used to collect the running information of the process update function in the early stage of execution. In the subsequent description, the "running information of the process update function in the early stage of execution" is referred to as the "third running information", and the third running information may include the PID of the target process and the current process name.

[0194] The fourth detection point can be used to collect the running information of the process update function after execution. In the subsequent description, the "running information of the process update function after execution" will be referred to as the "fourth running information". The fourth running information may include the PID of the target process, the updated process name and the update result.

[0195] Optionally, kprobe may be used to register the third detection point (prctl kprobe hook) in the form of a hook function in the process update function (prctl); kretprobe may be used to register the fourth detection point (prctl kretprobehook) in the form of a hook function in the process update function (prctl).

[0196] (3) Process exit function

[0197] There is one detection point set in the process exit function, which is the fifth detection point.

[0198] The fifth detection point can be used to collect the running information when the process exits the function execution. In the subsequent description, the "running information when the process exits the function execution" is referred to as the "fifth running information", and the fifth running information can include the PID and process name of the target process.

[0199] Optionally, kprobe may be used to register the fifth detection point (exit kprobe hook) in the process exit function (exit) in the form of a hook function.

[0200] By inserting at least one detection point into each type of process management function through the eBPF technology, real-time monitoring and real-time perception of the process life cycle can be achieved, and there is no need to traverse all processes every time according to the preset update cycle, which is conducive to saving system overhead; in addition, when inserting at least one detection point into the process management function based on the eBPF technology, there is no need to carry out secondary development of the kernel code, so there is no need to involve kernel code modification, and it can be implemented by writing target code in a commonly used programming language. The target code is independent of the kernel code, which makes the subsequent code maintenance cost of the system low. For example, the insertion of detection points into the process management function can be realized based on C language code and Python scripts.

[0201] The process change event may include the identifier of the target process and the event type.

[0202] The identification of the target process may include a PID of the target process. In some examples, the identification of the target process may also include a process name of the target process.

[0203] Event types may include create type, destroy type, and update type.

[0204] The create type may be used to indicate that the event is an event for creating a process.

[0205] In some embodiments, the creation type may include a first creation type and a second creation type.

[0206] The first creation type may be used to indicate that the event is: an event in which a target process is just created and the target process is in the early stage of execution. Exemplarily, the first creation type may be represented as any of the following types: enter type, ENTER type, or execve enter type.

[0207] The second creation type may be used to indicate that the event is: an event after the target process is created and executed. Exemplarily, the second creation type may be represented as any of the following types: return type, RETURN type, or execvereturn type.

[0208] The destroy type can be used to indicate that the event is an event that destroys the process. For example, the destroy type can be expressed as an exit type or an EXIT type.

[0209] The update type can be used to indicate that the event is an event of process name update. Exemplarily, the update type can be expressed as NEWNAME type or new name type.

[0210] It is understandable that when the process management function is different, the operation information obtained by the detection point set in the process management function is different, and the process of generating the process change event according to the operation information is different.

[0211] It should be noted that the detailed process of generating process change events based on the running information will be described in Figures 4 to 6 The details are described in the examples.

[0212] S202: Notify the target object of the process change event.

[0213] The target object can be a user or a management device.

[0214] Different notification strategies can be selected to notify the target object of the process change event according to the different event types in the process change event. The computing device can pre-configure the notification strategy corresponding to the process change event of each event type based on the user's demand information, so that the user can customize the notification strategy corresponding to the process change event of each event type based on their own business needs, so as to improve the flexibility of the process change event notification.

[0215] For example, the computing device may generate a notification message for each process change event; display the notification message for each process change event to the user; or, the computing device may also send a notification message for each process change event to the management device.

[0216] In some embodiments, the process change event may be notified to the target object in the following manner: generating a corresponding notification message based on the process change event; and sending the notification message to the target object.

[0217] It should be noted that the detailed process of generating corresponding notification messages based on process change events will be described in Figures 4 to 6 The details are described in the examples.

[0218] The process monitoring method provided by the embodiment of the present application can collect the operation information of the process management function during its execution through at least one detection point in the process management function, so that the computing device can quickly determine the process change event based on the operation information and notify the target object of the process change event, so that the target object can timely perceive the process that has changed in the system and the type of change of the process, which is conducive to improving the real-time performance of process monitoring. In addition, the method does not need to traverse and query all processes in the operating system every time, and the system overhead is low.

[0219] Next, combine Figures 4 to 6 , the process of generating process change events and notifying the process change events in different situations is described in detail.

[0220] Combination Figure 4 , the process of generating a process change event in the following situation is described in detail: the process management function includes a process execution function, and the process execution function is provided with a first detection point and a second detection point.

[0221] Figure 4 The second flowchart of a process monitoring method provided in the embodiment of the present application. Figure 4 , the method specifically comprises:

[0222] S401. Obtain first running information of a target process at a first detection point of a process execution function.

[0223] The first detection point is used to collect the first running information of the process execution function in the early stage of execution. Figure 3 As shown, the first running information may include the PID and startup information of the target process.

[0224] Exemplarily, the startup information may include, but is not limited to, a process file name (filename) and / or startup parameters (eg, argv parameters).

[0225] In a possible implementation, after the first operation information is obtained, steps S402 and S403 as shown below may be performed to generate a first process change event according to the first operation information.

[0226] S402: Store the first operation information in a first data table, and generate a first process change event according to the event type indicated by the first detection point and the first operation information.

[0227] The event type indicated by the first detection point may be a first creation type. Exemplarily, the first creation type may be represented by any of the following types: an enter type, an ENTER type, or an execve enter type.

[0228] In some embodiments, the first data table may be a hash table, and the first running information (PID and startup information) of the target process may be stored in the hash table, so that the target process may be quickly queried or filtered based on the first data table during subsequent execution, exit, and update processes.

[0229] In some embodiments, the data storage structure of the hash table is a key-value pair structure (K, V), and the hash table can be used to store the process information of the target process, and the process information may include but is not limited to the PID and process data of the target process. The PID of the target process can be stored as a key (K), and the process data of the target process can be stored as a value (V), and the process data may include but is not limited to at least one of the following: process name and startup information (process file name and startup parameters).

[0230] In some embodiments, a generation template of a process change event may be determined, and a first process change event may be generated according to the generation template, a first creation type, and first running information of a target process.

[0231] In some embodiments, step S402 may include the following steps:

[0232] S4021. Obtain a first configuration file.

[0233] The first configuration file can be used to quickly filter the target process.

[0234] The first configuration file may include a whitelist, a blacklist, and preset parameters, wherein the whitelist may be used to indicate the process file names of multiple processes that the computing device allows to execute, and the blacklist may be used to indicate the process file names of multiple processes that the computing device refuses to execute. When the startup parameters of the target process are preset parameters, the target process may be retained; when the startup parameters of the target process are not preset parameters, the target process may be filtered.

[0235] In some embodiments, the computing device may include a configuration interface, which may be used by a user to configure a first configuration file, and the computing device may obtain the first configuration file configured by the user through the configuration interface, and store the first configuration file in a preset storage space. When the current computing device determines that the change type of the target process is the first creation type, the first configuration file may be read from the preset storage space.

[0236] The process file name (filename) and startup parameters (for example, argv parameters) may include a path string. When processing the target process, the computing device needs to segment and parse the path in the path string, resulting in performance overhead for the computing device.

[0237] S4022. Determine whether the target process is a process specified for monitoring by the target object according to the startup information of the target process in the first configuration file and the first operation information.

[0238] If the target process is a process designated to be monitored by the target object, step S403 is executed; if the target process is not a process designated to be monitored by the target object, the monitoring process for the target process may be terminated.

[0239] In order to reduce the performance overhead of the computing device, the whitelist, blacklist and preset parameters in the first configuration file can be used to quickly screen and process the target process to reduce the number of processes that the subsequent computing device needs to process, thereby reducing the performance overhead of the computing device when parsing the process file name and startup parameters of each process.

[0240] In some embodiments, the following steps may be used to determine whether the target process is a process designated for monitoring by the target object.

[0241] (1) Determine a first matching result of the target process according to the process file name of the target process and the white list of the first configuration file.

[0242] If the first matching result is a matching failure, execute step (2);

[0243] If the first matching result is a successful match, execute step (5).

[0244] (2) Determine a second matching result of the target process according to the process file name of the target process and the blacklist of the first configuration file.

[0245] If the second matching result is a matching failure, execute step (3);

[0246] If the second matching result is a successful match, execute step (4).

[0247] (3) End the monitoring process of the target process by the first execution monitoring function.

[0248] (4) Determine a third matching result of the target process according to the startup parameters of the target process and the preset parameters of the first configuration file.

[0249] If the third matching result is a matching failure, execute step (3);

[0250] If the third matching result is a successful match, execute step (5).

[0251] (5) Determine that the target process is the process that the target object specifies to be monitored.

[0252] S4023. When it is determined that the target process is a process designated for monitoring by the target object, the first operation information is stored in a first data table.

[0253] The first running information of the process specified to be monitored by the target object can be stored in the first data table, which can avoid storing some useless data in the first data table, resulting in excessive data volume and low query efficiency when querying based on the first data table.

[0254] S403: When it is determined that the event type in the first process change event is the first creation type, store the first running information in the first process change event in a second data table.

[0255] In some embodiments, the second data table may store the first running information (PID and startup information) of the target process based on a preset data structure. Exemplarily, the preset data structure may be in a dictionary form, and the second data table may store the first running information of the target process in a dictionary form, so as to facilitate the subsequent quick search for the process data of the target process in the second data table based on the PID of the process.

[0256] It can be understood that if the change type of the target process is the first creation type, it can be determined that the target process is newly created and is in the early stage of execution. The PID and startup information of the target process need to be stored in the second data table to facilitate subsequent timely monitoring of the running information of the target process.

[0257] It should be noted that the first data table and the second data table are stored in different locations in the computing device. The system architecture of the computing device may include a kernel layer and an application layer, wherein the kernel layer is used to manage hardware resources in the computing device and provide system services of the operating system, and the application layer is used for the computing device to provide services to users.

[0258] The first data table can be stored in a storage area corresponding to the kernel layer, and the kernel layer can include a system call layer, which can call the first data table to quickly query the process information of each process. The system call layer can also generate various process change events and send the various process change events to the data processing layer.

[0259] The second data table may be stored in a storage area corresponding to the application layer. The application layer may include a data processing layer. The data processing layer may call the second data table to perform data processing on each process change event sent by the system call layer.

[0260] S404: Obtain second running information of the target process at a second detection point of the process execution function.

[0261] The second detection point is used to collect the second operation information of the process execution function after execution. Figure 3 As shown, the second running information may include the PID, process name and execution result of the target process.

[0262] The execution result can be execution success or execution failure. It is understandable that if the execution result is execution success, it means that the target process has been created and executed normally; if the execution result is execution failure, it means that the target process has failed to be created.

[0263] Exemplarily, the execution result may be an execve return value of the process execution function.

[0264] In a possible implementation, after the second operation information is obtained, steps S405 to S408 as shown below may be executed to generate a second process change event according to the second operation information.

[0265] S405: Determine whether the PID of the target process exists in the first data table.

[0266] The first data table may store multiple PIDs and process data of processes that have been filtered by the first configuration file. If the first data table includes the PID of the target process, it means that the computing device needs to monitor the running process of the target process; if the first data table does not include the PID of the target process, it means that the computing device does not need to monitor the running process of the target process. The PIDs of each process stored in the first data table can facilitate the computing device to quickly filter the target process.

[0267] When the PID of the target process exists in the first data table, step S407 may be executed.

[0268] S406: When the PID of the target process exists in the first data table, determine whether the execution result of the target process in the second operation information is successful.

[0269] S407: When the execution result is successful, generate a second process change event according to the event type indicated by the second detection point and the second operation information.

[0270] By deleting the process information of the target process in the first data table. When the target execution process fails to execute, the target execution process fails to be created and cannot be executed, so that the computing device does not need to continue to monitor the target execution process. In this case, the process information (including PID and process data) of the target execution process can be deleted from the first data table to reduce the amount of data for subsequent data query based on the first data table and improve query efficiency.

[0271] S408: When the execution result is execution failure, delete the process information of the target process in the first data table, and generate a second process change event according to the event type indicated by the second detection point and the second operation information.

[0272] It should be noted that the specific execution process of "generating a second process change event" in steps S407 and S408 can refer to the specific execution process of "generating a first process change event" in step S402, and will not be repeated here.

[0273] It can be understood that after the second process change event is generated, a notification message corresponding to the second process change event may be generated, and the notification message may be notified to the target object.

[0274] In some embodiments, the second process change event may be notified in the manner shown in steps S409 and S410.

[0275] S409: When the event type in the second process change event is the second creation type and the execution result of the target process is successful execution, generate a first notification message corresponding to the second process change event, and send the first notification message to the target object.

[0276] The first notification message may be used to indicate that the target process is successfully created, and the first notification message may include the PID, process name, and creation success flag of the target process.

[0277] In some embodiments, the first notification message can also be generated in the following manner: based on the process change event, determine whether the target process is the process specified for notification by the target object; if the target process is the process specified for notification by the target object, determine whether the PID of the target process exists in the second data table; if it is determined that the PID of the target process exists in the second data table and the execution result of the target process is successful, generate the first notification message based on the second process change event.

[0278] In some embodiments, a second configuration file may also be obtained; and based on the process name of the target process in the second process change event and the second configuration file, it is determined whether the target process is a process for which notification is specified by the target object.

[0279] The second configuration file may include multiple preset process names, and the second configuration file may be used to filter the target process.

[0280] It is understandable that among the multiple processes running in the operating system, the user may only need to monitor some of the multiple processes. The user can customize multiple preset process names and pre-configure the multiple preset process names in the computing device in the form of a second configuration file, so that the computing device can filter out processes with the multiple preset process names from the multiple processes running in the computing device according to the multiple preset process names.

[0281] In some embodiments, the computing device may include a configuration interface, which may be used for a user to configure a second configuration file. The computing device may obtain the second configuration file configured by the user through the configuration interface and store the second configuration file in a preset storage space.

[0282] The second data table may store the PIDs of multiple processes and corresponding process data. If the second data table includes the PID of the target process, it means that the computing device needs to monitor the running process of the target process; if the second data table does not include the PID of the target process, it means that the computing device does not need to monitor the running process of the target process. The PIDs of each process stored in the second data table can facilitate the computing device to quickly find the target process that the computing device needs to monitor among multiple processes.

[0283] It is understandable that if the target process is not the process specified by the target object for notification, or the PID of the target process does not exist in the second data table, the target process can be filtered and the monitoring process of the target process by the second detection point can be terminated.

[0284] S410. When the event type in the second process change event is the second creation type and the execution result of the target process is execution failure, delete the process information of the target process in the second data table, generate a second notification message corresponding to the second process change event, and send the second notification message to the target object.

[0285] In some embodiments, the second notification message can also be generated in the following manner: based on the second process change event, determine whether the target process is the process specified for notification by the target object; if the target process is the process specified for notification by the target object, determine whether the PID of the target process exists in the second data table; if it is determined that the PID of the target process exists in the second data table and the execution result of the target process is execution failure, generate a second notification message based on the second process change event.

[0286] The process information may include the PID and process data of the target process, and the process data may include but is not limited to the following data: process name, process file name, and startup parameters.

[0287] The second notification message is used to indicate that the creation of the target process fails. The second notification message may include the PID of the target process, the current process name, and a creation failure flag.

[0288] When the creation of the target process fails, the target process will not be able to continue running, so the computing device will no longer need to monitor the target process. In this case, the process information (PID and process data) of the target process can be deleted in the second data table to reduce the amount of data for subsequent data queries and improve query efficiency.

[0289] The process monitoring method provided in the embodiment of the present application can obtain the running information of the process execution function at the detection point and generate the first process change event or the second process change event, so that the target object can timely perceive the process change event of the target process during the process execution. The method can further filter the target process according to the second configuration file and the second data table, and after the filtering is passed, generate different notification messages according to the different execution results of the target process, so that the computing device can timely and accurately perceive the creation process and creation result of the target process.

[0290] Next, combine Figure 5 , the process of generating a process change event in the following situation is described in detail: the process management function includes a process update function, the process update function is provided with a third detection point and a fourth detection point, and the fourth detection point is executed after the third detection point.

[0291] Figure 5 The third flowchart of a process monitoring method provided in the embodiment of the present application. Figure 5 , the method specifically comprises:

[0292] S501. Obtain third running information of a target process at a third detection point of a process update function.

[0293] The third detection point can be used to collect the third operation information of the process update function in the early stage of execution, such as Figure 3As shown, the third running information may include the PID of the target process and the current process name.

[0294] S502: When it is determined that the PID of the target process exists in the first data table, determine whether the target process is in a process name update state.

[0295] The target process can be quickly screened through the first data table. If the PID of the target process does not exist in the first data table, the monitoring process of the target process can be stopped. If the PID of the target process exists in the first data table, it indicates that the target process is a process designated for monitoring by the computing device, and the computing device needs to monitor the process name update process of the target process.

[0296] In some embodiments, the update status of the target process may include a process name update status or other update status, and the update status identifier of the target process may be obtained to determine whether the target process is in a process name update status by the update status identifier. For example, the process name update status identifier may be "PR_SET-NAME".

[0297] S503. When the target process is in a process name update state, determine the current process name of the target process in the third operation information as the process name of the target process before the update, and obtain fourth operation information of the target process at a fourth detection point of the process update function.

[0298] In some embodiments, when it is determined that the target update process is in other update states, the monitoring process of the target update process by the third detection point may be terminated.

[0299] The fourth detection point can be used to collect fourth operation information of the process update function after execution, such as Figure 3 As shown, the fourth operation information may include the PID of the target process, the updated process name and the update result.

[0300] When it is determined that the target process is in a process name update state, the current process name of the target process is determined as the process name of the target process before the update, so that the subsequent computing device can search and update the corresponding data of the target process after the process name of the target process is updated.

[0301] S504: Generate a third process change event according to the process name of the target process before the update and the fourth running information.

[0302] In some embodiments, a third process change event may be generated in the following manner: determine whether the PID of the target process exists in the first data table; if the PID of the target process exists in the first data table, determine whether the update result of the target process in the fourth operation information is a successful update; if the update result is a successful update, update the process name of the target process stored in the first data table according to the updated process name of the target process in the fourth operation information, and generate a third process change event according to the event type indicated by the fourth detection point, the process of the target process before the update, and the fourth operation information.

[0303] The event type indicated by the fourth detection point may be an update type.

[0304] The target process can be quickly screened through the first data table to determine whether the target process is a process designated to be monitored by the computing device.

[0305] It is understandable that, during the process of updating the process name of the target process, the process name of the target process stored in the first data table is the process name before the update. When the process name of the target process is successfully updated, the process name of the target process stored in the first data table needs to be updated to ensure that the target process can be accurately queried based on the first data table later. When the process name of the target process fails to be updated, there is no need to update the process name of the target process stored in the first data table, and the monitoring process of the target process at the fourth detection point is terminated.

[0306] It should be noted that the specific execution process of "generating a third process change event" in step S504 can refer to the specific execution process of "generating a first process change event" in step S402, and will not be repeated here.

[0307] S505. When the event type in the third process change event is an update type, the process name of the target process stored in the second data table is updated according to the updated process name of the target process in the third process change event, and a third notification message corresponding to the third process change event is generated, and the third notification message is notified to the target object.

[0308] The third notification message is used to indicate that the process name of the target process is updated successfully. The third notification message may include the PID of the target process, the process name before the update, and the process name after the update.

[0309] The process name of the target process stored in the second data table may be a process name before updating, and the process name before updating may be updated to the updated process name of the target process.

[0310] In some embodiments, the third notification message can be generated in the following manner: based on the third process change event, determine whether the target process is the process specified for notification by the target object; if the target process is the process specified for notification by the target object, determine whether the PID of the target process exists in the second data table; if it is determined that the PID of the target process exists in the second data table, generate a third notification message corresponding to the third process change event.

[0311] It should be noted that the process of "determining whether the target process is a process specified for notification by the target object" in this step can refer to the process of "determining whether the target process is a process specified for notification by the target object" in step S409, and will not be repeated here.

[0312] If the second configuration file contains the process name of the target process before the update, it can be determined that the target process is the process specified for monitoring by the target object; if the PID of the target process exists in the second data table, it can be determined that the target process is the process specified for notification by the target object. In this case, a third notification message corresponding to the third process change event can be generated.

[0313] If the process name of the target process before the update does not exist in the second configuration file, or the PID of the target process does not exist in the second data table, it can be determined that the target process is a process designated for monitoring and notification by a non-target object. In this case, the target process can be filtered and the monitoring process of the target process by the fourth detection point can be terminated.

[0314] The process monitoring method provided by the embodiment of the present application can obtain the running information of the process update function at the detection point and generate a third process change event, so that the target object can timely perceive the process change event of the target process during the process update process. When determining that the target process is in the state of updating the process name, the method can also determine the current process name of the target process as the process name before the target process is updated, so that the subsequent computing device can search and update the corresponding data of the target process after the process name of the target process is updated. When generating the third process change event, the method can further filter the third process change event corresponding to the target process according to the second configuration file and the second data table, and after the filtering is passed, according to the updated process name, update the process name of the target process stored in the second data table, and generate a third notification message, so that the computing device can timely and accurately perceive the update process of the process name of the target process.

[0315] Next, combine Figure 6 , the process of generating a process change event in the following situation is described in detail: the process management function includes a process exit function, and the fifth detection point is set in the process exit function.

[0316] Figure 6 This is a flowchart of a process monitoring method provided in an embodiment of the present application. Figure 6 , the method specifically comprises:

[0317] S601. Obtain fifth running information of a target process at a fifth detection point of a process exit function.

[0318] It should be noted that the specific execution process of step S601 can refer to the specific execution process of step S201, which will not be repeated here.

[0319] The fifth detection point can be used to collect the running information of the process exit function during execution, such as Figure 3 As shown, the fifth running information may include the PID and process name of the target process.

[0320] S602: Determine whether the PID of the target process exists in the first data table.

[0321] The target process can be quickly screened through the first data table to determine whether the target process is a process specified for monitoring by the target object.

[0322] S603: When the PID of the target process exists in the first data table, delete the process information of the target process in the first data table.

[0323] It is understandable that, when the PID of the target process does not exist in the first data table, the monitoring process of the target process can be terminated.

[0324] The process information includes the PID and process data of the target process. The process data may include but is not limited to the following data: process name, process file name and startup parameters.

[0325] The computing device does not need to continue monitoring the target process. In this case, the PID and process data of the target process can be deleted in the first data table to reduce the amount of data for subsequent data queries based on the first data table and improve query efficiency.

[0326] S604: Generate a fourth process change event according to the event type indicated by the fifth detection point and the fifth operation information.

[0327] The event type indicated by the fifth detection point may be a destruction type.

[0328] It should be noted that the specific execution process of "generating a fourth process change event" in step S604 can refer to the specific execution process of "generating a first process change event" in step S402, which will not be repeated here.

[0329] In some embodiments, the fourth process change event may be notified in the manner shown in steps S605 to S607.

[0330] S605: When the event type in the fourth process change event is a destruction type, delete the process information of the target process in the second data table, generate a fourth notification message, and notify the target object of the fourth notification message.

[0331] The fourth notification message is used to indicate that the target process is destroyed, and the fourth notification message may include the PID and process name of the target process.

[0332] In some embodiments, the fourth notification message can be generated in the following manner: based on the fourth process change event, determine whether the target process is the process specified for notification by the target object; if the target process is the process specified for notification by the target object, determine whether the PID of the target process exists in the second data table; if it is determined that the PID of the target process exists in the second data table, generate a fourth notification message corresponding to the fourth process change event.

[0333] It should be noted that the process of "determining whether the target process is a process specified for notification by the target object" in this step can refer to the process of "determining whether the target process is a process specified for notification by the target object" in step S409, and will not be repeated here.

[0334] If the event type of the target process is a destruction type, the computing device does not need to continue to monitor the target process. In this case, the PID and process data of the target process can be deleted in the second data table to reduce the amount of data for subsequent data queries based on the second data table and improve query efficiency.

[0335] In some embodiments, it can be determined whether the target process is a process for which notification is specified by the target object based on the second configuration file, the second data table, and the fourth process change event.

[0336] If the process name of the target process exists in the second configuration file, and the PID of the target process exists in the second data table, the target process is determined to be the process designated for monitoring and notification by the target object, and a fourth notification message of the fourth process change event can be generated.

[0337] If the process name of the target process does not exist in the second configuration file, or the PID of the target process does not exist in the second data table, it is determined that the target process is not the process specified for monitoring and notification by the target object. The target process can be filtered and the monitoring process of the target process by the fifth detection point can be ended.

[0338] The process monitoring method provided in the embodiment of the present application can obtain the running information of the process exit function at the fifth detection point and generate the fifth process change event, so that the target object can timely perceive the process change event of the target process during the process exit. The target process can also be further screened according to the second configuration file and the second data table, and after the target process is screened, the PID and process data of the target process are deleted in the second data table, and a fourth notification message is generated, so that the computing device can timely and accurately perceive the destruction process of the target process.

[0339] Figure 7 This is a flowchart of a process monitoring method provided in an embodiment of the present application. Figure 7 ,The process monitoring system can timely perceive and monitor various process change events of each process in the operating system based on the system call layer and the data processing layer. ,The system call layer can be located in the kernel layer, and the data processing layer can be located in the application layer.

[0340] The system call layer can obtain the operation information collected by each detection point in the process management function, and generate a process change event based on the operation information collected by each detection point. The system call layer can also send the process change event to the data processing layer, and the data processing layer can further process the process change event to determine whether to notify the process change event.

[0341] Below, in order to facilitate understanding of the real-time perception and real-time monitoring of the entire life cycle of each process by the process monitoring system, taking any process as an example, the execution process of the process monitoring system is described in detail.

[0342] Phase 1: The kernel system calls the process creation function (fork) to create the target process.

[0343] During this stage, the relevant resources of the target process have been allocated, and the target process has a PID, but the process name of the target process is still the process name of the parent process of the target process.

[0344] The second stage: when it is determined that the kernel system calls the process execution function (execve) to prepare to execute the target process, the first detection point (execve kprobe hook) is triggered, at which time, the first running information of the target process at the first detection point is obtained.

[0345] In this stage, since the target process has not yet been executed, the target process has a PID, but the process name is still the process name of the parent process. The first running information may include: the PID of the target process, the process file name (filename) and the startup parameters (argv).

[0346] During this stage, the first running information of the target process can be passed to the first execution monitoring module of the system call layer. The first execution monitoring module can filter the target process according to the first running information and the first configuration file, and after the screening passes, store the first running information of the target process in the first data table, and generate a first process change event for the target process.

[0347] The first process change event may include a first creation type and first running information.

[0348] The system call layer may send the first process change event to a corresponding data processing module in the data processing layer, and the data processing module may store the first running information of the target process in the second data table according to the first process change event.

[0349] Phase 3: After determining that the kernel system calls the process execution function (execve) to execute the target process, the second detection point (execve kretprobe hook) is triggered. At this time, the second running information of the target process at the second detection point is obtained.

[0350] In this stage, since the target process has been executed, the target process has a PID, and the process name is updated to the process name of the target process itself, the second operation information may include: the PID, process name and execution result of the target process.

[0351] During this stage, the second running information of the target process can be passed to the second execution monitoring module of the system call layer. The first execution monitoring module can filter the target process according to the second running information and the first data table, and generate a second process change event for the target process after the screening passes.

[0352] The second process change event includes: a second creation type, a PID of the target process, a process name, and an execution result.

[0353] The system call layer can send the second process change event to the corresponding data processing module in the data processing layer. The data processing module can filter the second process change event according to the second configuration file and the second data table, and after the screening is passed, generate a first notification message or a second notification message corresponding to the second process change event according to the execution result of the second process change event.

[0354] The fourth stage: when it is determined that the kernel system calls the process update function (prctl) to prepare to update the target process, the third detection point (prctl kprobe hook) is triggered, at which time, the third running information of the target process at the third detection point is obtained.

[0355] In this stage, the process name of the target process has not been updated, and the third running information may include: the PID and current process name of the target process.

[0356] During this stage, the third running information of the target process can be passed to the first update monitoring module of the system call layer. The first update monitoring module can filter the target process according to the third running information and the first data table, and determine whether the target process is in the state of updating the process name after the screening. When it is determined that the target process is in the state of updating the process name, the current process name of the target process is determined as the process name of the target process before the update.

[0357] Phase 5: When it is determined that the target process is in the process name updating state and the kernel system calls the process update function (prctl) to complete the process name update of the target process, the fourth detection point (prctl kretprobe hook) is triggered. At this time, the fourth running information of the target process at the fourth detection point is obtained.

[0358] In this stage, the process name of the target process is updated, and the fourth operation information may include: the PID of the target process, the updated process name and the update result.

[0359] During this stage, the fourth operation information of the target process can be passed to the second update monitoring module of the system call layer. The second update monitoring module can filter the target process according to the fourth operation information, the first data table and the update result, and generate a third process change event of the target process after the screening passes.

[0360] The third process change event may include an update type, a PID of the target process, a process name before the update, and a process name after the update.

[0361] The system call layer can send the third process change event to the corresponding data processing module in the data processing layer. The data processing module can filter the third process change event according to the second configuration file, the second data table and the process name of the target process before the update, and after the screening, update the process name of the target process stored in the second data table according to the updated process name of the target process, and generate a third notification message. The third notification message is used to indicate that the process name of the target process is updated successfully.

[0362] The sixth stage: when it is determined that the kernel system calls the process exit function (exit) to exit the target process, the fifth detection point (exit kprobe hook) is triggered. At this time, the fifth running information of the target process at the fifth detection point is obtained.

[0363] In this stage, the fifth operation information may include: the PID and process name of the target process.

[0364] During this stage, the fifth running information of the target process can be passed to the destruction monitoring module of the system call layer. The destruction monitoring module can filter the target process according to the fifth running information and the first data table, and after the screening passes, delete the PID and process data of the target process in the first data table, and generate the fourth process change event of the target process.

[0365] The fourth process change event may include a destruction type, a PID of the target process, and a process name.

[0366] The system call layer can send the fourth process change event to the corresponding data processing module in the data processing layer. The data processing module can filter the fourth process change event according to the second configuration file, the second data table and the process name of the target process, and after the screening passes, delete the PID and process data of the target process in the second data table, and generate a fourth notification message, which is used to indicate that the target process is destroyed.

[0367] In some embodiments, different notification policies may be implemented for different types of notification messages. The computing device may pre-configure notification policies corresponding to different types of notification messages based on user demand information, so that users can customize notification policies corresponding to different types of notification messages based on their own business needs to improve the flexibility of notification message notifications.

[0368] For example, for a notification message indicating that a target process is successfully created or a process name is successfully updated, the corresponding notification policy may be: recording the notification message in the system operation log; for a notification message indicating that a target process fails to be created or a target process is destroyed, the corresponding notification policy may be: issuing an alarm for the notification message.

[0369] Compared with some embodiments, the scheduling process execution function (sched_process_exec) and the scheduling process exit function (sched_process_exit) are used as the process management function to be monitored, which makes it impossible to accurately obtain the startup parameters of each process when it is started and the execution result of the process. The process monitoring method provided in the embodiment of the present application can use system calls execve, prctl and kernel function do_exit as the process management function to be monitored, and combine kprobe and kretprobe dynamic tracking mechanisms to insert at least one detection point in these process management functions. Through this at least one detection point, the startup parameters and the execution result of the process when the target process is started are accurately obtained in real time, so as to realize dynamic tracking of various process change events of the target process, and realize real-time perception and real-time monitoring of the process change events of the whole life cycle of the target process; the method does not need to traverse all processes each time according to the preset update cycle, which is conducive to saving system overhead; there is no need to involve kernel code modification, and the target code can be implemented by writing the target code in a commonly used programming language. The target code is independent of the kernel code, so that the subsequent code maintenance cost of the system is low.

[0370] Figure 8 This is a schematic diagram of the structure of a process monitoring device provided in an embodiment of the present application. Figure 8 , the process monitoring device 10 may include:

[0371] The processing module 11 is used to obtain the running information of the target process at the detection point of the process management function, and generate a process change event according to the running information. At least one detection point is set in the process management function. The process change event includes the identifier and event type of the target process. The event type includes a creation type, a destruction type and an update type.

[0372] The transceiver module 12 is used to notify the target object of the process change event.

[0373] The process monitoring device provided in the embodiment of the present application can be used to implement the process monitoring method in the above embodiment, and its beneficial effects are similar and will not be described again here.

[0374] In a possible implementation, the process management function includes a process execution function, and the process execution function is provided with a first detection point and a second detection point; the processing module 11 is specifically used for:

[0375] Acquire first running information of the target process at a first detection point of the process execution function, where the first detection point is used to collect running information of the process execution function in the early stage of execution, and the first running information includes a process identifier PID and startup information of the target process;

[0376] Generate a first process change event according to the first operation information;

[0377] Acquire second running information of the target process at a second detection point of the process execution function, where the second detection point is used to collect running information of the process execution function after execution, and the second running information includes a PID, a process name, and an execution result of the target process;

[0378] A second process change event is generated according to the second running information.

[0379] In a possible implementation, the processing module 11 is further configured to:

[0380] The first operation information is stored in a first data table, and a first process change event is generated according to the event type indicated by the first detection point and the first operation information.

[0381] In a possible implementation, the processing module 11 is further configured to:

[0382] Obtaining a first configuration file, the first configuration file including a whitelist, a blacklist, and preset parameters;

[0383] Determine whether the target process is a process specified for monitoring by the target object according to the first configuration file and the startup information of the target process in the first running information;

[0384] When it is determined that the target process is a process designated for monitoring by the target object, the first operation information is stored in the first data table.

[0385] In a possible implementation, the processing module 11 is further configured to:

[0386] Determine whether the PID of the target process exists in the first data table;

[0387] In the case where the PID of the target process exists in the first data table, determining whether the execution result of the target process in the second operation information is successful;

[0388] If the execution result is execution failure, deleting the process information of the target process in the first data table, and generating a second process change event according to the event type indicated by the second detection point and the second operation information;

[0389] When the execution result is successful, a second process change event is generated according to the event type indicated by the second detection point and the second operation information.

[0390] In a possible implementation, the process management function includes a process update function, and the process update function is provided with a third detection point and a fourth detection point; the processing module 11 is further specifically used for:

[0391] Obtaining third running information of the target process at a third detection point of the process update function, where the third detection point is used to collect running information of the process update function in the early stage of execution, and the third running information includes the PID of the target process and the current process name;

[0392] In the case of determining that the PID of the target process exists in the first data table, determining whether the target process is in a process name update state;

[0393] When the target process is in a process name update state, the current process name of the target process in the third operation information is determined as the process name of the target process before the update, and fourth operation information of the target process at a fourth detection point of the process update function is obtained, the fourth detection point is used to collect the operation information of the process update function after execution, and the fourth operation information includes the PID of the target process, the updated process name and the update result;

[0394] A third process change event is generated according to the process name of the target process before being updated and the fourth running information.

[0395] In a possible implementation, the processing module 11 is further configured to:

[0396] Determine whether the PID of the target process exists in the first data table;

[0397] In the case where the PID of the target process exists in the first data table, determining whether the update result of the target process in the fourth operation information is a successful update;

[0398] When the update result is successful, the process name of the target process stored in the first data table is updated according to the updated process name of the target process in the fourth operation information, and a third process change event is generated according to the event type indicated by the fourth detection point, the process before the update of the target process and the fourth operation information.

[0399] In a possible implementation, the process management function includes a process exit function, and the process exit function is provided with a fifth detection point; the processing module 11 is further specifically used for:

[0400] Acquire fifth running information of the target process at the fifth detection point of the process exit function, where the fifth detection point is used to collect running information of the process exit function when it is executed, and the fifth running information includes the PID and process name of the target process;

[0401] Determine whether the PID of the target process exists in the first data table;

[0402] If the PID of the target process exists in the first data table, deleting the process information of the target process in the first data table;

[0403] A fourth process change event is generated according to the event type indicated by the fifth detection point and the fifth operation information.

[0404] In a possible implementation, the transceiver module 12 is specifically used for:

[0405] Generate corresponding notification messages based on process change events;

[0406] Sends a notification message to the target object.

[0407] In a possible implementation, the transceiver module 12 is further configured to:

[0408] According to the process change event, determine whether the target process is the process specified for notification by the target object;

[0409] In the case where the target process is a process for which notification is specified by the target object, determining whether a PID of the target process exists in the second data table;

[0410] When it is determined that the PID of the target process exists in the second data table, a corresponding notification message is generated based on the process change event.

[0411] In a possible implementation, the creation type further includes a second creation type; and the transceiver module 12 is further configured to:

[0412] Obtain a second configuration file, the second configuration file including a plurality of preset process names;

[0413] In the case where the event type in the process change event is the second creation type or the destruction type, judging whether the target process is a process specified for notification by the target object according to the process name of the target process in the process change event and the second configuration file;

[0414] When the event type in the process change event is an update type, it is determined whether the target process is a process designated for notification by the target object according to the process name of the target process in the process change event before the update and the second configuration file.

[0415] In a possible implementation, the creation type further includes a second creation type; and the transceiver module 12 is further configured to:

[0416] When the event type in the process change event is the second creation type and the execution result of the target process is successful execution, a first notification message is generated, and the first notification message is used to indicate that the target process is successfully created;

[0417] When the event type in the process change event is the second creation type and the execution result of the target process is execution failure, deleting the process information of the target process in the second data table, and generating a second notification message, the second notification message is used to indicate that the creation of the target process has failed;

[0418] When the event type in the process change event is an update type, the process name of the target process stored in the second data table is updated according to the updated process name of the target process in the process change event, and a third notification message is generated, where the third notification message is used to indicate that the process name of the target process is updated successfully;

[0419] When the event type in the process change event is a destruction type, the process information of the target process is deleted in the second data table, and a fourth notification message is generated, where the fourth notification message is used to indicate that the target process is destroyed.

[0420] In a possible implementation, the creation type includes a first creation type; and the processing module 11 is further configured to:

[0421] When the event type in the process change event is the first creation type, the first running information in the process change event is stored in the second data table.

[0422] Fig. 9 A hardware structure diagram of a computing device provided in an embodiment of the present application. Fig. 9 The computing device 20 may include a processor 21 and a memory 22, and the processor 21 and the memory 22 are coupled. The processor 21 and the memory 22 may communicate with each other; illustratively, the processor 21 and the memory 22 communicate with each other via a communication bus 23.

[0423] The memory 22 is used to store computer instructions;

[0424] The processor 21 is used to execute the computer instructions stored in the memory 22 to implement the technical solution shown in the above method embodiment.

[0425] Optionally, the computing device 20 may further include a communication interface, which may include a transmitter and / or a receiver.

[0426] Optionally, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0427] An embodiment of the present application provides a computer-readable storage medium, on which computer-executable instructions are stored; when the computer-executable instructions are executed by a processor, they are used to implement the process monitoring method described in the above embodiment.

[0428] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the computer executes the process monitoring method described in the above embodiment.

[0429] All or part of the steps of the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned memory (storage medium) includes: read-only memory (English: read-only memory, abbreviated: ROM), RAM, flash memory, hard disk, solid state drive, magnetic tape (English: magnetic tape), floppy disk (English: floppy disk), optical disc (English: optical disc) and any combination thereof.

[0430] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable terminal device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0431] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0432] These computer program instructions can also be loaded onto a computer or other programmable terminal device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0433] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application, rather than to limit them. Although the embodiments of the present application have been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A process monitoring method, characterized in that: The method comprises: Obtaining running information of a target process at a detection point of a process management function, and generating a process change event according to the running information, wherein at least one detection point is set in the process management function, and the process change event includes an identifier of the target process and an event type, wherein the event type includes a creation type, a destruction type, and an update type; The target object is notified of the process change event.

2. The method according to claim 1, characterized in that The process management function includes a process execution function, and the process execution function is provided with a first detection point and a second detection point; Obtaining the running information of the target process at the detection point of the process management function, and generating a process change event according to the running information, including: Acquire first running information of the target process at the first detection point of the process execution function, wherein the first running information includes a process identifier PID and startup information of the target process; Generate a first process change event according to the first operation information; Acquire second running information of the target process at the second detection point of the process execution function, the second running information including a PID, a process name, and an execution result of the target process; A second process change event is generated according to the second operation information.

3. The method according to claim 2, characterized in that Generating a first process change event according to the first operation information includes: The first operation information is stored in a first data table, and the first process change event is generated according to the event type indicated by the first detection point and the first operation information.

4. The method according to claim 3, characterized in that Storing the first operation information in a first data table includes: Obtaining a first configuration file, wherein the first configuration file includes a whitelist, a blacklist, and preset parameters; Determining, according to the first configuration file and the startup information of the target process in the first running information, whether the target process is a process designated for monitoring by the target object; When it is determined that the target process is a process designated for monitoring by the target object, the first operation information is stored in the first data table.

5. The method according to any one of claims 2 to 4, characterized in that: Generating a second process change event according to the second operation information includes: Determine whether the PID of the target process exists in the first data table; In the case where the PID of the target process exists in the first data table, determining whether the execution result of the target process in the second operation information is successful; In the case where the execution result is execution failure, deleting the process information of the target process in the first data table, and generating the second process change event according to the event type indicated by the second detection point and the second operation information; When the execution result is successful, the second process change event is generated according to the event type indicated by the second detection point and the second operation information.

6. The method according to claim 3, characterized in that The process management function includes a process update function, in which a third detection point and a fourth detection point are set; Obtaining the running information of the target process at the detection point of the process management function, and generating a process change event according to the running information, including: Acquire third running information of the target process at the third detection point of the process update function, wherein the third running information includes a PID and a current process name of the target process; In the case of determining that the PID of the target process exists in the first data table, determining whether the target process is in a process name update state; When the target process is in a process name update state, determine the current process name of the target process in the third operation information as the process name of the target process before the update, and obtain fourth operation information of the target process at the fourth detection point of the process update function, wherein the fourth operation information includes the PID of the target process, the updated process name, and the update result; A third process change event is generated according to the process name of the target process before being updated and the fourth running information.

7. The method according to claim 6, characterized in that Generating a third process change event according to the process name of the target process before the update and the fourth running information, including: Determine whether the PID of the target process exists in the first data table; In a case where the PID of the target process exists in the first data table, determining whether the update result of the target process in the fourth operation information is a successful update; When the update result is a successful update, the process name of the target process stored in the first data table is updated according to the updated process name of the target process in the fourth running information, and the third process change event is generated according to the event type indicated by the fourth detection point, the process of the target process before the update and the fourth running information.

8. The method according to claim 3, characterized in that The process management function includes a process exit function, and a fifth detection point is set in the process exit function; Obtaining the running information of the target process at the detection point of the process management function, and generating a process change event according to the running information, including: Acquire fifth running information of the target process at the fifth detection point of the process exit function, the fifth running information including the PID and process name of the target process; Determine whether the PID of the target process exists in the first data table; If the PID of the target process exists in the first data table, deleting the process information of the target process in the first data table; A fourth process change event is generated according to the event type indicated by the fifth detection point and the fifth operation information.

9. The method according to any one of claims 1 to 8, characterized in that: Notifying the target object of the process change event includes: Generate a corresponding notification message based on the process change event; The notification message is sent to the target object.

10. The method according to claim 9, characterized in that Generating a corresponding notification message based on the process change event includes: According to the process change event, determining whether the target process is a process designated for notification by the target object; In the case where the target process is a process specified for notification by the target object, determining whether a PID of the target process exists in the second data table; When it is determined that the PID of the target process exists in the second data table, a corresponding notification message is generated based on the process change event.

11. The method according to claim 10, characterized in that The creation type also includes a second creation type; judging whether the target process is a process specified for notification by the target object according to the process change event, including: Obtaining a second configuration file, wherein the second configuration file includes a plurality of preset process names; When the event type in the process change event is the second creation type or the destruction type, judging whether the target process is a process specified for notification by the target object according to the process name of the target process in the process change event and the second configuration file; When the event type in the process change event is the update type, it is determined whether the target process is a process specified for notification by the target object according to the process name of the target process before the update in the process change event and the second configuration file.

12. The method according to any one of claims 9 to 11, characterized in that: The creation type also includes a second creation type; generating a corresponding notification message based on the process change event, including: When the event type in the process change event is the second creation type and the execution result of the target process is successful execution, generating a first notification message, wherein the first notification message is used to indicate that the target process is successfully created; When the event type in the process change event is the second creation type and the execution result of the target process is execution failure, deleting the process information of the target process in the second data table, and generating a second notification message, wherein the second notification message is used to indicate that the creation of the target process has failed; In a case where the event type in the process change event is the update type, updating the process name of the target process stored in the second data table according to the updated process name of the target process in the process change event, and generating a third notification message, wherein the third notification message is used to indicate that the process name of the target process is updated successfully; In a case where the event type in the process change event is the destruction type, the process information of the target process is deleted from the second data table, and a fourth notification message is generated, where the fourth notification message is used to indicate that the target process is destroyed.

13. The method according to any one of claims 1 to 12, characterized in that: The creation type includes a first creation type; and the method further includes: When the event type in the process change event is the first creation type, the first running information in the process change event is stored in the second data table.

14. A computing device, characterized in that include: Processor and memory; The processor is coupled to the memory; The memory is used to store program instructions; The processor is used to execute the program instructions to implement the method according to any one of claims 1 to 13.

Images