Link tracking method and device

Abstract

The invention provides a link tracking method and device, relates to the technical field of cloud, and is applied to a cloud server, and the cloud server comprises a Java proxy module and an eBPF module. Wherein the Java agent module determines an application call chain, and the eBPF module determines an infrastructure call chain. The association of the application call chain and the infrastructure call chain is realized through the trace identifier and the span identifier. And the association relationship between the message feature code and the trace identifier and the span identifier is reported to the eBPF module through the Java agent module, so that the analysis of the eBPF module on the encrypted message is realized. Therefore, according to the call chain tracking method provided by the embodiment of the invention, the distributed application call chain and the infrastructure call chain of the virtual network and the physical network can be associated, and full-link tracking can be realized.

Description

[0001] This application claims the priority of the Chinese patent application filed with the China Patent Office on July 7, 2023, with application number 202310834172.8 and application name “A full-link tracking method and device”, the entire contents of which are incorporated by reference in this application. Technical Field

[0002] The present application relates to the field of cloud technology, and more specifically, to a link tracking method and device. Background Art

[0003] With the continuous development of cloud-native applications, more and more applications are split into multiple microservices, and the paths of the infrastructure networks used to connect these microservices are becoming more and more complex.

[0004] Therefore, how to track the links of microservice calls is an urgent problem to be solved. Summary of the invention

[0005] The present application provides a link tracing method and device, which can track the link of microservice calls. In addition, the link tracing method provided by the present application associates the distributed application call chain with the infrastructure call chain of the virtual network and the physical network, and can achieve full-link tracing.

[0006] In a first aspect, a link tracing method is provided, which is applied to a cloud server, the cloud server comprising a Java proxy module and an extended Berkeley packet filter (eBPF) module, and multiple microservices are running in the cloud server, the method comprising: the Java proxy module intercepts a to-be-encrypted message generated by a current microservice, and injects a trace identifier, a parent span identifier, and a current span identifier into the to-be-encrypted message, wherein the to-be-encrypted message is used to call a child microservice after encryption, the current span identifier is an identifier of the current microservice calling the child microservice, the parent span identifier is an identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate calls between the multiple microservices; the Java proxy module intercepts a request message, the request message is an encrypted message of the to-be-encrypted message; the Java proxy module determines a message feature code according to the request message, so as to and the association relationship between the message feature code and the trace identifier, the parent span identifier and the current span identifier; the Java proxy module reports the association relationship to the eBPF module; the eBPF module determines the infrastructure call information in the process of the current microservice calling the child microservice according to the request message; the eBPF module determines the message feature code according to the request message; the eBPF module determines the trace identifier, the parent span identifier and the current span identifier according to the message feature code and the association relationship; the eBPF module determines the current link call information of the current microservice calling the child microservice, and the current link call information includes the trace identifier, the parent span identifier, the current span identifier and the infrastructure call information.

[0007] In the embodiment of the present application, the Java proxy module determines the application call chain, and the eBPF module determines the infrastructure call chain. Through the trace identifier and the span identifier, the association between the application call chain and the infrastructure call chain is realized. The association relationship between the message feature code and the trace identifier and the span identifier is reported to the eBPF module through the Java proxy module, so that the eBPF module can parse the encrypted request message. Therefore, the call chain tracing method provided in the embodiment of the present application can associate the distributed application call chain with the infrastructure call chain of the virtual network and the physical network, and can realize full-link tracing.

[0008] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the eBPF module reports the current link call information to an aggregation module in the cloud management platform, and the aggregation module is used to aggregate multiple link call information.

[0009] In the embodiment of the present application, by integrating the link call information of multiple microservices, the calls between the microservices can be fully tracked.

[0010] In combination with the first aspect, in some implementations of the first aspect, the Java agent module determines the message feature code according to the request message, including: the Java agent module processes the request message according to a hash algorithm to determine the message feature code.

[0011] In the embodiment of the present application, the request message is processed by a hash algorithm, which not only realizes the correspondence between the request message and the message feature code, but also makes the length of the message feature code controllable, thereby reducing the overhead of the link tracking device in the process of determining and reporting the message feature code.

[0012] In combination with the first aspect, in certain implementations of the first aspect, the eBPF module determines a message feature code based on the request message, including: the eBPF module processes the request message according to the hash algorithm to determine the message feature code.

[0013] In the embodiment of the present application, the eBPF side processes the request message through a hash algorithm, which not only realizes the correspondence between the request message and the message feature code, but also makes the length of the message feature code controllable, and reduces the overhead of the link tracking device in the process of determining and reporting the message feature code. In addition, the eBPF side adopts the same message feature code generation method as the Java proxy side, so that the eBPF side can obtain the same message feature code, and realizes the parsing of the encrypted request message by the eBPF module, so that the full-link call chain tracking can be performed.

[0014] In combination with the first aspect, in certain implementations of the first aspect, the Java agent module reports the association relationship to the eBPF module, including: the Java agent module reports the association relationship to the interface of the eBPF module; wherein the method also includes: the eBPF module caches the association relationship.

[0015] In an embodiment of the present application, the association relationship reported by the Java agent module can be cached by the eBPF module, so that when the eBPF module needs to match the association relationship, it can conveniently call the data in the cache area, thereby improving efficiency.

[0016] In combination with the first aspect, in some implementations of the first aspect, the request message includes a hypertext transfer protocol secure (HTTPS) request message.

[0017] In combination with the first aspect, in some implementations of the first aspect, the multiple microservices are Java microservices.

[0018] In combination with the first aspect, in some implementations of the first aspect, the thread for encrypting the message to be encrypted in the multiple microservices is asynchronous with the thread for sending and receiving the request message.

[0019] Due to the different client frameworks or configurations used, the encryption thread and the network transceiver thread may be in different threads. In the case of thread asynchronous, the eBPF module cannot obtain the correspondence between the encrypted request message and the trace identifier and span identifier through the monitoring thread, so it is necessary to interact with other modules to obtain the correspondence. In the embodiment of the present application, through the interaction between the Java proxy module and the eBPF module, the eBPF module can parse the encrypted request message and obtain the correspondence between the message and the trace identifier and span identifier, thereby realizing the association between the application call chain and the infrastructure call chain.

[0020] In a second aspect, an embodiment of the present application provides a link tracking device, which includes a module for implementing the first aspect or any possible implementation method of the first aspect.

[0021] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the link tracking method of the first aspect or any possible implementation of the first aspect.

[0022] In a fourth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the link tracking method of the first aspect or any possible implementation of the first aspect.

[0023] In a fifth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the link tracking method of the first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a system diagram based on a cloud server system according to an embodiment of the present application.

[0025] Figure 2 It is a schematic block diagram of a link tracking device provided in an embodiment of the present application.

[0026] Figure 3 It is a schematic flowchart of a link tracking method provided in an embodiment of the present application.

[0027] Figure 4 It is a system module diagram of a message processing method 400 provided in an embodiment of the present application.

[0028] Figure 5 An architectural diagram of a computing device provided in an embodiment of the application.

[0029] Figure 6 It is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of the present application.

[0030] Figure 7 It is a schematic diagram of a connection between computing devices 500A and 500B via a network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0032] The present application will present various aspects, embodiments or features around a system that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used.

[0033] In addition, in the embodiments of the present application, words such as "exemplary" and "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way.

[0034] The business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0035] References to "one embodiment" or "some embodiments" etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. appearing in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0036] Figure 1 It is a system diagram based on a cloud server system according to an embodiment of the present application.

[0037] like Figure 1 As shown, the cloud management platform 110 is used to manage the infrastructure that provides multiple cloud services, the infrastructure includes multiple cloud data centers, each cloud data center includes multiple cloud servers, each cloud server includes cloud service resources, and provides corresponding cloud services for tenants. For example, multiple microservices can run in a cloud server.

[0038] The cloud management platform 110 provides an access interface (such as an interface or an application program interface (API)). The tenant can operate the client remote access access interface to register a cloud account and password on the cloud management platform and log in to the cloud management platform. After the cloud management platform successfully authenticates the cloud account and password, the tenant can further pay to select and purchase a virtual machine with specific specifications (processor, memory, disk) on the cloud management platform. After the payment is successful, the cloud management platform provides the remote login account and password of the purchased virtual machine. The client can remotely log in to the virtual machine and install and run the tenant's application in the virtual machine. The tenant of the cloud service can be an individual, enterprise, school, hospital, administrative agency, etc.

[0039] The functions of the cloud management platform 110 include, but are not limited to, user console, computing management service, network management service, storage management service, authentication service, and image management service. The user console provides an interface or API to interact with tenants, the computing management service is used to manage servers running virtual machines and containers and bare metal servers, the network management service is used to manage network services (such as gateways, firewalls, etc.), the storage management service is used to manage storage services (such as data bucket services), the authentication service is used to manage tenant accounts and passwords, and the image management service is used to manage virtual machine images. Tenants can use the client 130 to log in to the cloud management platform 110 through the Internet 120 to manage the rented cloud services.

[0040] With the continuous development of cloud-native applications, more and more applications are split into multiple microservices, and the paths of the infrastructure network used to connect these microservices are becoming more and more complex. For example, in a distributed service architecture, after a request message flows into the architecture from the gateway, multiple microservices may be called to process the request message. If one of the microservices fails or has low processing efficiency, it will affect the final request message. It should be noted that multiple microservices may run in the same cloud server or in different cloud servers, and this application does not limit this.

[0041] In some embodiments, a link tracing technology represented by a Java agent can be used to implement the tracing of the application call chain. For example, a trace identifier and a span identifier can be used to implement the tracing of the application call chain.

[0042] By writing the call information (such as time, interface, level, and result) between each microservice into the log, and then connecting these call information in series with span and trace identifiers, an application call chain can be formed. By performing statistical analysis on the application call chain according to different dimensions and identifying abnormal calls, the microservice with the abnormality can be quickly located and the abnormality can be resolved.

[0043] Specifically, in the entire application call chain, the request message generated by a certain request will carry the trace identifier and be transmitted to the downstream microservice. In this way, the trace identifier can connect the complete application call chain belonging to the request.

[0044] Each microservice will also generate a span identifier. The span identifier generated by the current microservice can be called the current span identifier. A microservice that is upstream of the current microservice and adjacent to the current microservice can be called a parent microservice. The span identifier passed by the parent microservice can be called a parent span identifier. As requests are passed in the form of request messages in various microservices, the current microservice continues to become a parent microservice, and the current span identifier continues to become a parent span identifier. In this way, the specific position of a call or process in the application call chain can be located through the parent span identifier and the current span identifier.

[0045] For example, suppose microservice A calls microservice B. When microservice A generates request message 1, if microservice A is not called by other microservices, in other words, microservice A has no parent microservice, then microservice A can inject the trace identifier and the current span identifier into request message 1. At this time, the current span identifier injected by microservice A is used to trace the call of microservice A to microservice B.

[0046] After microservice B receives request message 1, if microservice B needs to further call other microservices (such as microservice C), microservice B can generate a request message 2. Microservice B can inject a new span identifier into request message 2 as the current span identifier. At this time, the trace identifier and the span identifier injected by microservice A will still be retained, but the span identifier injected by microservice A is used as the parent span identifier. At this time, the current span identifier injected by microservice B is used to trace the call of microservice B to microservice C.

[0047] After microservice C receives request message 2, if microservice C needs to further call other microservices (such as microservice D), microservice C can generate a request message 3. Microservice C can inject another new span identifier into request message 3 as the current span identifier. At this time, the trace identifier and the span identifier injected by microservice B will still be retained, but the span identifier injected by microservice B is used as the parent span identifier. The span identifier injected by microservice A may not be retained. At this time, the current span identifier injected by microservice C is used to trace the call of microservice C to microservice D.

[0048] In this way, for scenarios where multiple microservices process request messages, the application call chain can be determined by combining trace identifiers, span identifiers, and logs. The trace identifier connects the complete application call chain of a request message in series, and the current span identifier and the parent span identifier can locate the specific position of a call or process in the application call chain. For the sake of simplicity, the call or process corresponding to a single span identifier is referred to as a single span.

[0049] Using trace and span identifiers can only obtain application call chains, but cannot trace infrastructure call chains. Application call chains are call chains at the application layer. Infrastructure call chains are not limited to the application layer, but can also involve infrastructure such as the network layer, transport layer, link layer, and physical layer. In other words, the Java agent cannot trace call chains involving infrastructure such as the network layer, transport layer, link layer, and physical layer.

[0050] This is partly because Java agents cannot trace at the kernel level.

[0051] For example, a Java agent running in one process cannot track how a single span progresses through the operating system stack of another process.

[0052] For another example, the Java agent cannot track which intermediate service network elements the call process corresponding to the span identifier passes through. For example, if microservice A is sent to microservice B through the intermediate service network element engine x (engine x, Nginx), the Java agent cannot track that the call process corresponding to the span identifier passes through Nginx. Among them, Nginx is a load balancer.

[0053] Kernel state is a concept relative to user state (user). Kernel state has higher permissions and can mobilize more resources. User state has lower permissions and can mobilize fewer resources. Kernel state programs run in kernel state space, and user state programs run in user state space.

[0054] In some embodiments, the extended Berkeley Packet Filter (eBPF) technology can be used to track the infrastructure call chain of a single span. The infrastructure call chain may include, for example, a call chain from an application to an operating system to an intermediate service network element.

[0055] Generally speaking, if you want to add new functions to the kernel, you need to modify the kernel source code to implement it. This invasive operation will cause great risks to the stability of the system. However, eBPF technology can increase the scalability of the kernel without modifying the kernel source code, making the kernel more flexible.

[0056] eBPF can intercept system calls, filter network packets and other low-level operations through kernel-mode programs to extract some data. Through user-mode programs, these data can be processed accordingly.

[0057] For example, by intercepting the request message through the kernel-mode program and parsing the trace identifier and span identifier in the request message, the infrastructure call chain obtained by eBPF and the application call chain obtained by the Java agent can be associated to achieve full-link tracing.

[0058] However, for encrypted request messages, eBPF technology cannot parse the trace identifier and span identifier, making it impossible to associate the infrastructure call chain with the application call chain.

[0059] Figure 2 2 is a schematic block diagram of a link tracking device 200 provided in an embodiment of the present application. The link tracking device 200 can be run in any cloud server, which is not limited in the present application. For example, it can be run in an elastic cloud server.

[0060] The link tracking device 200 may include a Java agent module 210 and an eBPF module 220. When a user registers (for example, through the cloud management platform 110) a new microservice application, the registration information may be pushed to the configuration center 230, and the configuration center 230 may start some configuration items of the Java agent module 210 and the eBPF module 220.

[0061] In some embodiments, the configuration center 230 may be located in the cloud management platform 110 .

[0062] The Java agent module 210 can be used to track the application call chain, and the eBPF module 220 can be used to track the infrastructure call chain. The Java agent module 210 can interact with the eBPF module 220. Through the mutual cooperation of these two modules, the application call chain and the infrastructure call chain can be associated, thereby realizing full-link tracking.

[0063] There can be multiple elastic cloud servers, and multiple microservices can be run in each elastic cloud server. In some embodiments, the number of Java agent modules 210 is the same as the number of microservices. In some embodiments, the number of eBPF modules 220 is the same as the number of elastic cloud servers.

[0064] The detailed description of the device embodiment is given below, which will not be repeated here. The method embodiment of the present application is described below.

[0065] Figure 3 It is a schematic flowchart of a link tracking method 300 provided in an embodiment of the present application.

[0066] The method 300 may be applied to a cloud server, which may include a link tracking device 200 , and the cloud server may run multiple microservices.

[0067] In some embodiments, the aforementioned multiple microservices are Java microservices. Java microservices are microservices written in Java language.

[0068] It should be noted that the present application does not limit the multiple microservices tracked by the link tracking device 200 to only running in the same cloud server. For example, the link tracking device 200 can also track multiple microservices running in different cloud servers.

[0069] S310, the Java proxy module 210 intercepts the message to be encrypted generated by the current microservice, and injects the trace identifier, the parent span identifier and the current span identifier into the message to be encrypted.

[0070] Among them, the message to be encrypted is used to call the child microservice after encryption, the current span identifier is the identifier of the current microservice calling the child microservice, the parent span identifier is the identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate the calls between the multiple microservices.

[0071] In some embodiments, the message to be encrypted includes a hypertext transfer protocol secure (HTTPS) message. However, it should be noted that the message to be encrypted in the embodiments of the present application is not limited to an HTTPS request message, and for example, it can also be compatible with a hypertext transfer protocol (HTTP) message.

[0072] In some embodiments, the Java agent module 210 may inject a trace identifier, a parent span identifier, and a current span identifier into the request header of the message to be encrypted.

[0073] The microservice where the message to be encrypted is currently located is called the current microservice. The parent microservice is the microservice upstream of the current microservice and adjacent to the current microservice. The child microservice is the microservice downstream of the current microservice and adjacent to the current microservice. The message to be encrypted is the message generated by the current microservice to call the child microservice.

[0074] The embodiments of the present application do not limit how the message to be encrypted is generated. For example, the message to be encrypted can be a decrypted message sent by the parent microservice, that is, the current microservice only performs a forwarding action. For another example, the current microservice can add some information to the message sent by the parent microservice to generate a message to be encrypted. For another example, the current microservice can reconstruct a message to be encrypted.

[0075] It can be understood that S310 injects the parent span identifier into the message to be encrypted, indicating that the current microservice still has a parent microservice. Obviously, the method 300 provided in the embodiment of the present application is not limited to tracing the current microservice that has a parent microservice. If the current microservice has no parent microservice, S310 can only inject the trace identifier and the current span identifier into the message to be encrypted.

[0076] In some embodiments, when the current microservice receives a request from the parent microservice as a server, the trace identifier and the parent span identifier are cached as a call chain context. For example, the trace identifier and the parent span identifier can be cached in the form of thread variables.

[0077] In this way, when the current microservice generates a message to be encrypted as a client, the Java proxy module 210 can intercept the message to be encrypted, obtain the trace identifier and the parent span identifier from the call chain context, and generate a new span identifier as the current span identifier to be injected into the intercepted message to be encrypted.

[0078] When the first microservice generates a message to be encrypted, there is no trace identifier and parent span identifier in the call chain context. In this case, the Java proxy module 210 can generate a trace identifier and a current span identifier and inject them into the request message. Obviously, the situation where the first microservice (i.e., the current microservice without a parent microservice) generates a message to be encrypted is also within the scope of the embodiments of the present application.

[0079] To facilitate understanding of the relationship between the Java proxy module 210, the eBPF module 220 and the microservice, Figure 3 and Figure 4 Provide explanation.

[0080] Figure 4 4 is a schematic diagram of a system module of a message processing method 400 provided in an embodiment of the present application. The execution subject of the message processing method 400 may be a microservice, and the Java proxy module 210 and the eBPF module 220 may monitor the process of the microservice executing the method 400 through the method 300.

[0081] S410: Generate a message to be encrypted.

[0082] S420: Encrypt the message to be encrypted to obtain a request message.

[0083] S430, calling a socket to send an application programming interface (API).

[0084] S440, calling a network transceiver system.

[0085] See also Figure 4 , S410, S420, and S430 are executed in the user state space, and S440 is executed in the kernel state space.

[0086] The Java agent module 210 and the microservice executing method 400 run in the same process. The Java agent module 210 and the eBPF module 220 run in different processes. The eBPF module 220 may include an eBPF user state program 221 and an eBPF kernel state program 222, wherein the eBPF user state program 221 runs in the user state space, and the eBPF kernel state program 222 runs in the kernel state space. The eBPF user state program 221 can be used to process request messages, and the eBPF kernel state program 222 can be used to intercept system calls, filter network data packets and other underlying operations, and extract information such as request messages.

[0087] See also Figure 4 , S310 can be executed in the user space by the Java agent module 210 when S410 is executed. For example, the configuration center 230 can deploy and start the application request interceptor in the Java agent module 210, and the application request interceptor can be used to monitor microservice application requests. When the microservice generates a message to be encrypted, the callback method is triggered, and the Java agent module 210 intercepts the message to be encrypted. For another example, the application request interceptor can intercept the method of the network (web) client to process the message to be encrypted. When this method is executed, it means that a microservice is generating a message to be encrypted, and the Java agent module 210 can intercept the message to be encrypted.

[0088] S320: The Java proxy module 210 intercepts the request message.

[0089] The request message is the encrypted message of the message to be encrypted.

[0090] In some embodiments, the request message includes a hypertext transfer protocol secure (HTTPS) message.

[0091] See also Figure 4 , S320 can be executed by the Java agent module 210 in the user state space when S420 is executed.

[0092] S420 can be encrypted based on Java secure socket extension (JSSE). Accordingly, the Java proxy module 210 can intercept the request message by setting an interceptor.

[0093] For example, the configuration center 230 can deploy and start the JSSE encryption API interceptor in the Java agent module 210. The JSSE encryption API interceptor can monitor whether the system calls sun.security.ssl.OutputRecord.write(), and the JSSE encryption API interceptor can be used to monitor the secure socket layer (SSL) encryption class. When the encryption method is called, the callback method is triggered, and the Java agent module 210 intercepts the request message.

[0094] S330, the Java agent module 210 determines the message feature code and the association relationship between the message feature code and the trace identifier, the parent span identifier and the current span identifier according to the request message.

[0095] The message characteristic code can reflect the characteristics of the request message. One request message corresponds to one message characteristic code, and different request messages correspond to different message characteristic codes. In other words, there is a one-to-one correspondence between the request message and the message characteristic code.

[0096] The current span identifier is injected by the Java agent module 210 in S320, so the Java agent module 210 has the information of the current span identifier. Before encrypting the message, the Java agent module 210 can obtain the trace identifier and the parent span identifier of the message to be encrypted. In this way, the Java agent module 210 can associate the above information to obtain the association relationship.

[0097] In some embodiments, the Java agent module 210 determines the message feature code according to the request message, including: the Java agent module 210 processes the request message according to a hash algorithm to determine the message feature code.

[0098] The hash algorithm can map the request message to a message signature code of a certain length. The hash algorithm can meet the requirement of one-to-one correspondence between the request message and the message signature code, that is, the same request message corresponds to the same message signature code, and different request messages correspond to different message signature codes.

[0099] The embodiments of the present application are not limited to determining the message characteristic code only by the hash algorithm. For example, the request message itself can be used as the message characteristic code. However, the number of bytes of the request message itself is often large, which will make the message characteristic code longer. However, this does not affect the implementation of the embodiments of the present application. The embodiments of the present application can also determine the message characteristic code according to the request message by other algorithms, for example, the request message is encoded with variable byte (VarByte) to obtain the message characteristic code.

[0100] In the embodiment of the present application, the request message is processed by a hash algorithm, which not only realizes the correspondence between the request message and the message feature code, but also makes the length of the message feature code controllable, thereby reducing the overhead of the link tracking device 200 in the process of determining and reporting the message feature code.

[0101] S340, the Java agent module 210 reports the association relationship to the eBPF module 220.

[0102] In some embodiments, the thread for encrypting the message to be encrypted in the aforementioned multiple microservices is asynchronous with the thread for sending and receiving the request message.

[0103] Due to the different client frameworks or configurations used, the encryption thread and the network transceiver thread may be in different threads. In the case of thread asynchronous, the eBPF module 220 cannot obtain the correspondence between the encrypted message and the trace identifier and the span identifier through the monitoring thread, so it is necessary to interact with other modules to obtain the correspondence. In the embodiment of the present application, through the interaction between the Java agent module 210 and the eBPF module 220, the eBPF module 220 can parse the encrypted message and obtain the correspondence between the message and the trace identifier and the span identifier, thereby realizing the association between the application call chain and the infrastructure call chain.

[0104] For example, the eBPF user state program 221 may set a monitoring interface, so that the Java agent module 210 may report the association relationship to the monitoring interface of the eBPF module 220. When the monitoring interface monitors a reporting request, the association relationship may be received.

[0105] It can be understood that the association relationship is the association relationship between the message feature code, the trace identifier, the parent span identifier and the current span identifier.

[0106] In some embodiments, the Java agent module 210 reports the association relationship to the eBPF module 220, including: the Java agent module 210 reports the association relationship to the interface of the eBPF module 220; wherein, the method 300 also includes: the eBPF module 220 caches the association relationship.

[0107] For example, the eBPF user-mode program 221 may set a cache area in the user-mode space, where the cache area is used to cache the association relationship between the message feature code, the trace identifier, the parent span identifier, and the current span identifier.

[0108] In an embodiment of the present application, the association relationship reported by the Java agent module 210 can be cached by the eBPF module 220, so that when the eBPF module 220 needs to match the association relationship, it can conveniently call the data in the cache area, thereby improving efficiency.

[0109] S350, the eBPF module 220 determines the infrastructure calling information in the process of the current microservice calling the child microservice according to the request message.

[0110] See also Figure 4 , the eBPF kernel-state program 222 loaded in the kernel-state space can determine the infrastructure call information of the current microservice calling the child microservice.

[0111] The infrastructure call information in the process of the current microservice calling the child microservice according to the request message can be understood as the infrastructure call information of the current microservice calling the child microservice, and can also be understood as the infrastructure call information in the process of the current microservice sending a request message to the child microservice.

[0112] In some embodiments, the eBPF kernel state program 222 can determine the call chain from the application to the operating system, such as the call chain from the application to iptables. Among them, iptables is a network firewall in the Linux system that can be used to manage the processing and forwarding of network data packets. The present application does not limit the specific form of the operating system, for example, the operating system may also include a network card (eth).

[0113] In some embodiments, the eBPF kernel state program 222 can determine the call chain from the application to the intermediate service network element, for example, it can determine the call chain from the application to the messenger (envoy), where envoy is an open source cloud native agent. The present application does not limit the specific form of the intermediate service network element, for example, the intermediate service network element can also include Nginx.

[0114] S360, the eBPF module determines the message feature code according to the request message.

[0115] See also Figure 4 , S440 is executed in the kernel state space. The eBPF kernel state program 222 loaded in the kernel state space can determine the infrastructure call information of the request message. For example, the eBPF kernel state program 222 can load an eBPF probe (probe or tracepoint), which can be used to monitor whether the kernel state program calls the network transceiver system, that is, whether S440 is executed. For example, it can be monitored whether tcp_sendmsg() is called. When the eBPF probe monitors the execution of S440, the eBPF kernel state program 222 can obtain the request message to be sent and write the request message into the BPF storage (map).

[0116] In order to interact with the eBPF user state program 221, the eBPF kernel state program 222 can also use the perf_event_open() function to create a perf_event, which can be bound to the network transceiver system. Once a kernel event of a network transceiver system call occurs, the eBPF user state program 221 can be notified to obtain a new request message from the BPF map.

[0117] In this way, when the eBPF kernel-mode program 222 detects that S440 is executed, it can notify the eBPF user-mode program 221 to obtain the request message, and the eBPF user-mode program 221 determines the message feature code according to the request message.

[0118] In some embodiments, the eBPF module 220 determines the message feature code according to the request message, including: the eBPF module 220 processes the request message according to the hash algorithm to determine the message feature code.

[0119] The hash algorithm can map the request message to a message signature code of a certain length. The hash algorithm can meet the requirement of one-to-one correspondence between the request message and the message signature code, that is, the same request message corresponds to the same message signature code, and different request messages correspond to different message signature codes.

[0120] The embodiments of the present application are not limited to determining the message characteristic code only by the hash algorithm. For example, the request message itself can be used as the message characteristic code. However, the number of bytes of the request message itself is often large, which will make the message characteristic code longer. However, this does not affect the implementation of the embodiments of the present application. The embodiments of the present application can also determine the message characteristic code according to the request message by other algorithms, for example, VarByte encoding the request message to obtain the message characteristic code.

[0121] In one embodiment, the way in which the eBPF module 220 determines the message signature code may be consistent with the way in which the Java proxy module 210 determines the message signature code. In another embodiment, the way in which the eBPF module 220 determines the message signature code may have a preset deviation from the way in which the Java proxy module 210 determines the message signature code, so that the eBPF module 220 uses a message signature code that is not completely consistent with the Java proxy module 2210 and can search for the correct association relationship.

[0122] In the embodiment of the present application, the eBPF side processes the request message through a hash algorithm, which not only realizes the correspondence between the request message and the message feature code, but also makes the length of the message feature code controllable, and reduces the overhead of the link tracking device 200 in the process of determining and reporting the message feature code. In addition, the eBPF side adopts the same message feature code generation method as the Java proxy side, so that the eBPF side can obtain the same message feature code, and realizes the parsing of the encrypted request message by the eBPF module 220, so that the full-link call chain tracking can be performed.

[0123] S370, the eBPF module 220 determines the trace identifier, the parent span identifier, and the current span identifier according to the message feature code and the association relationship.

[0124] For example, the eBPF module 220 may use the message feature code to perform matching in the association relationship to obtain a trace identifier, a parent span identifier, and a current span identifier that match the message feature code. The association relationship may be stored in a memory cache area of ​​the eBPF module 220.

[0125] S380, the eBPF module determines the current link call information of the current microservice calling the child microservice.

[0126] The current link calling information includes the trace identifier, the parent span identifier, the current span identifier and the infrastructure calling information.

[0127] The current link call information includes not only the application call chain information, but also the infrastructure call information. The application call chain information includes the trace identifier, the parent span identifier, and the current span identifier.

[0128] In the embodiment of the present application, the Java agent module 210 determines the application call chain, and the eBPF module 220 determines the infrastructure call chain. Through the trace identifier and the span identifier, the association between the application call chain and the infrastructure call chain is realized. The Java agent module 210 reports the association relationship between the message feature code and the trace identifier and the span identifier to the eBPF module 220, thereby realizing the parsing of the encrypted message by the eBPF module 220. Therefore, the call chain tracing method provided in the embodiment of the present application can associate the distributed application call chain with the infrastructure call chain of the virtual network and the physical network, and can realize full-link tracing.

[0129] The above method 300 tracks the current link call information of the current microservice. It is understandable that the method 300 can track each current microservice. When these current microservices become parent microservices, the method 300 also completes the tracking of the parent microservices. When these microservice calls are completed, the method 300 has also completed the tracking of all microservice calls. Therefore, the method 300 can obtain the integrated link call information of each request message, which includes application call information and infrastructure call information, and also includes multiple link call information.

[0130] In some embodiments, the cloud server includes a link tracking device 200, and the device 200 may also include an aggregation module. The method 300 also includes: the eBPF module 220 reports the current link call information to the aggregation module, and the aggregation module is used to aggregate multiple link call information.

[0131] It should be noted that the Java proxy module 210 and the eBPF module 220 can be run on the tenant's cloud server, and the tenant's cloud server runs various microservices of the tenant. The aggregation module can be run in the management and operation area, such as the cloud management platform 110.

[0132] The aggregation module can realize the aggregation of multiple link call information. In other words, the aggregation module can generate a full link tracking of a stream composed of multiple request messages based on the current link call information of multiple request messages. For example, multiple link call information can be aggregated by matching 5-tuples.

[0133] In the embodiment of the present application, by integrating the link call information of multiple microservices, the calls between the microservices can be fully tracked.

[0134] Furthermore, the aggregation module can persist the aggregated integrated link call information in the database, thereby facilitating subsequent query or display of these call chains.

[0135] The method embodiments of the present application are described in detail above. The device embodiments of the present application are described below. The device embodiments correspond to the method embodiments, so the parts not described in detail can refer to the previous method embodiments. The device can implement any possible implementation of the above method.

[0136] See also Figure 2 The link tracking device 200 includes: a Java module 210, which is used to intercept the to-be-encrypted message generated by the current microservice, and inject a trace identifier, a parent span identifier and a current span identifier into the to-be-encrypted message, wherein the to-be-encrypted message is used to call the child microservice after encryption, the current span identifier is the identifier of the current microservice calling the child microservice, the parent span identifier is the identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate the calls between the multiple microservices; intercept a request message, which is the encrypted message of the to-be-encrypted message; determine a message feature code according to the request message, and the message feature code and the trace feature code are related to the trace feature code; ce identifier, the association relationship between the parent span identifier and the current span identifier; report the association relationship to the eBPF module 220; the eBPF module 220 is used to determine the infrastructure call information in the process of the current microservice calling the child microservice according to the request message; determine the message feature code according to the request message; determine the trace identifier, the parent span identifier and the current span identifier according to the message feature code and the association relationship; determine the current link call information of the current microservice calling the child microservice, and the current link call information includes the trace identifier, the parent span identifier, the current span identifier and the infrastructure call information.

[0137] Among them, both the Java agent module 210 and the eBPF module 220 can be implemented by software or by hardware. Exemplarily, the implementation of the Java agent module 210 is introduced below by taking the Java agent module 210 as an example. Similarly, the implementation of the eBPF module 220 can refer to the implementation of the Java agent module 210.

[0138] As an example of a software functional unit, the Java agent module 210 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the Java agent module 210 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.

[0139] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0140] As an example of a hardware functional unit, the Java agent module 210 may include at least one computing device, such as a server, etc. Alternatively, the Java agent module 210 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0141] The multiple computing devices included in the Java agent module 210 can be distributed in the same region or in different regions. The multiple computing devices included in the Java agent module 210 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the Java agent module 210 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0142] It should be noted that, in other embodiments, the Java agent module 210 can be used to execute any step in the link tracking method, and the eBPF module 220 can be used to execute any step in the link tracking method. The steps that the Java agent module 210 and the eBPF module 220 are responsible for implementing can be specified as needed. The Java agent module 210 and the eBPF module 220 respectively implement different steps in the link tracking method to achieve all the functions of the link tracking device 200.

[0143] The present application also provides a computing device 500. Figure 5 As shown, computing device 500 includes: bus 502, processor 504, memory 506 and communication interface 508. Processor 504, memory 506 and communication interface 508 communicate through bus 502. Computing device 500 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 500.

[0144] The bus 502 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 The bus 502 may include a path for transmitting information between various components of the computing device 500 (eg, the memory 506, the processor 504, and the communication interface 508).

[0145] The processor 504 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0146] The memory 506 may include a volatile memory, such as a random access memory (RAM). The memory 506 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0147] The memory 506 stores executable program codes, and the processor 504 executes the executable program codes to respectively implement the functions of the aforementioned Java module 210 and the eBPF module 220, thereby implementing the link tracking method. That is, the memory 506 stores instructions for executing the link tracking method.

[0148] The communication interface 508 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 500 and other devices or a communication network.

[0149] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0150] like Figure 6 As shown, the computing device cluster includes at least one computing device 500. The memory 506 in one or more computing devices 500 in the computing device cluster may store the same instructions for executing the link tracking method.

[0151] In some embodiments, the memory 506 of one or more computing devices 500 in the computing device cluster may also store partial instructions for executing the link tracking method. In other words, the combination of one or more computing devices 500 may jointly execute instructions for executing the detection link tracking method.

[0152] It should be noted that the memory 506 in different computing devices 500 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the link tracking device 200. That is, the instructions stored in the memory 506 in different computing devices 500 can implement the functions of one or more modules in the Java agent module 210 and the eBPF module 220.

[0153] In some embodiments, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network.

[0154] Figure 7 A possible implementation method is proposed. Figure 7 As shown, two computing devices 500A and 500B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 506 in the computing device 500A stores instructions for executing the functions of the Java agent module 210. At the same time, the memory 506 in the computing device 500B stores instructions for the functions of the eBPF module 220.

[0155] Figure 7 The connection method between the computing device clusters shown may be based on the consideration that the link tracing method provided in the present application requires a large amount of application call chain tracing and infrastructure call chain tracing, and therefore it is considered that the functions implemented by the Java agent module 210 are handed over to the computing device 500B for execution.

[0156] It should be understood that Figure 7 The functions of the computing device 500A shown in FIG. 5A may also be completed by multiple computing devices 500. Similarly, the functions of the computing device 500B may also be completed by multiple computing devices 500.

[0157] In some embodiments, the memory 506 of one or more computing devices 500 in the computing device cluster may also store partial instructions for executing the link tracking method. In other words, the combination of one or more computing devices 500 may jointly execute instructions for executing the link tracking method.

[0158] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the above-mentioned link tracking method.

[0159] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned link tracking method.

[0160] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0161] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0162] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0163] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0164] In addition, each functional module in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more modules may be integrated into one unit.

[0165] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0166] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A link tracking method, characterized in that: The method is applied to a cloud server, the cloud server includes a Java proxy module and an extended Berkeley packet filter eBPF module, and multiple microservices are running in the cloud server. The method includes: The Java proxy module intercepts the message to be encrypted generated by the current microservice, and injects a trace identifier, a parent span identifier and a current span identifier into the message to be encrypted, wherein the message to be encrypted is used to call the child microservice after encryption, the current span identifier is the identifier of the current microservice calling the child microservice, the parent span identifier is the identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate calls between the multiple microservices; The Java proxy module intercepts a request message, wherein the request message is an encrypted message of the message to be encrypted; The Java agent module determines the message feature code and the association relationship between the message feature code and the trace identifier, the parent span identifier and the current span identifier according to the request message; The Java agent module reports the association relationship to the eBPF module; The eBPF module determines the infrastructure calling information in the process in which the current microservice calls the child microservice according to the request message; The eBPF module determines the message feature code according to the request message; The eBPF module determines the trace identifier, the parent span identifier, and the current span identifier according to the message feature code and the association relationship; The eBPF module determines the current link call information of the current microservice calling the child microservice, where the current link call information includes the trace identifier, the parent span identifier, the current span identifier, and the infrastructure call information.

2. The method according to claim 1, characterized in that Also includes: The eBPF module reports the current link call information to an aggregation module in the cloud management platform, and the aggregation module is used to aggregate multiple link call information.

3. The method according to claim 1 or 2, characterized in that: The Java agent module determines the message feature code according to the request message, including: The Java proxy module processes the request message according to a hash algorithm to determine the message feature code.

4. The method according to claim 3, characterized in that The eBPF module determines the message feature code according to the request message, including: The eBPF module processes the request message according to the hash algorithm to determine the message feature code.

5. The method according to any one of claims 1 to 4, characterized in that: The Java agent module reports the association relationship to the eBPF module, including: The Java agent module reports the association relationship to the interface of the eBPF module; The method further comprises: The eBPF module caches the association relationship.

6. The method according to any one of claims 1 to 5, characterized in that The request message includes a Hypertext Transfer Protocol Security (HTTPS) request message.

7. The method according to any one of claims 1 to 6, characterized in that The multiple microservices are Java microservices.

8. The method according to any one of claims 1 to 7, characterized in that The threads for encrypting the to-be-encrypted messages in the multiple microservices are asynchronous with the threads for sending and receiving the request messages.

9. A link tracking device, characterized in that: The device is applied to a cloud server, in which a plurality of microservices are running, and the device comprises: A Java proxy module is used to intercept the message to be encrypted generated by the current microservice, and inject a trace identifier, a parent span identifier and a current span identifier into the message to be encrypted, wherein the message to be encrypted is used to call the child microservice after encryption, the current span identifier is the identifier of the current microservice calling the child microservice, the parent span identifier is the identifier of the parent microservice calling the current microservice, and the trace identifier is used to associate calls between multiple microservices; intercept a request message, the request message is the encrypted message of the message to be encrypted; determine a message feature code and an association relationship between the message feature code and the trace identifier, the parent span identifier and the current span identifier according to the request message; report the association relationship to the extended Berkeley packet filter eBPF module; The eBPF module is used to determine the infrastructure call information of the current microservice calling the child microservice according to the request message; determine the message feature code according to the request message; determine the trace identifier, the parent span identifier and the current span identifier according to the message feature code and the association relationship; determine the current link call information of the current microservice calling the child microservice, and the current link call information includes the trace identifier, the parent span identifier, the current span identifier and the infrastructure call information.

10. The device according to claim 9, characterized in that The eBPF module is also used to report the current link call information to the aggregation module in the cloud management platform; The aggregation module is used to aggregate multiple link call information.

11. The device according to any one of claims 8 to 10, characterized in that The Java agent module is specifically used for: The request message is processed according to a hash algorithm to determine the message feature code.

12. The device according to claim 11, characterized in that The eBPF module is specifically used for: The request message is processed according to the hash algorithm to determine the message feature code.

13. The device according to any one of claims 8 to 12, characterized in that The Java agent module is specifically used to report the association relationship to the interface of the eBPF module; The eBPF module is specifically used to cache the association relationship.

14. The device according to any one of claims 8 to 13, characterized in that The request message includes a Hypertext Transfer Protocol Security (HTTPS) request message.

15. The device according to any one of claims 8 to 14, characterized in that The multiple microservices are Java microservices.

16. The device according to any one of claims 8 to 15, characterized in that The threads for encrypting the to-be-encrypted messages in the multiple microservices are asynchronous with the threads for sending and receiving the request messages.

17. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 8.

18. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 8.

19. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 8.

Images