File action detection method and device, electronic equipment and storage medium

Abstract

The invention relates to a file action detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a file path, calling a file monitoring tool, and monitoring at least one data file under the file path; wherein the file monitoring tool returns a corresponding event under the condition that at least one data file acts; receiving the event returned by the file monitoring tool, and determining the action corresponding to the event; establishing a link with a data node in the distributed database, and sending an action query message to the data node; and receiving a response message returned by the data node in response to the action query message, and detecting the abnormality of the action according to the response message. Therefore, through the file monitoring tool, the abnormality of the data file action can be detected at the first time, so that the influence on the business is avoided.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a method, device, electronic device and storage medium for detecting file actions. Background Art

[0002] Currently, for data nodes in a distributed database, there will be files in the directory of the data nodes in the distributed database. The data nodes in the distributed database will change the files, but at the same time there is the possibility of artificially changing the files, which will not only affect the integrity and availability of the data, but also cause business interruption.

[0003] In the related technology, abnormal operations such as deletion, movement, renaming, modification of permissions and group ownership are usually performed on files of data nodes in a distributed database, which affects the business before such abnormal operations are discovered. In addition, the integrity and validity of the data after repair need to be repeatedly verified and confirmed. Summary of the invention

[0004] In order to solve the above-mentioned technical problem that such abnormal operations are usually performed on files of data nodes in distributed databases, such as deletion, movement, renaming, modification of permissions and groups, which affect the business and can only be discovered after such abnormal operations have occurred, and the integrity and validity of the repaired data need to be repeatedly verified and confirmed, this application provides a file action detection method, device, electronic device and storage medium. The specific technical solution is as follows:

[0005] In a first aspect, the present application provides a method for detecting a file action, the method comprising:

[0006] Obtain a file path, call a file monitoring tool, and monitor at least one data file under the file path;

[0007] Wherein, the file monitoring tool returns a corresponding event when an action occurs on at least one of the data files;

[0008] Receive the event returned by the file monitoring tool, and determine the action corresponding to the event;

[0009] Establishing a link with a data node in a distributed database and sending an action query message to the data node;

[0010] A response message returned by the data node in response to the action query message is received, and abnormality of the action is detected according to the response message.

[0011] In an optional implementation, the acquiring the file path, calling the file monitoring tool, and monitoring at least one data file under the file path includes:

[0012] Obtain a database file path, call a file monitoring tool, and monitor at least one database file under the database file path;

[0013] Wherein, the file monitoring tool returns a corresponding database event when a first action occurs to at least one of the database files;

[0014] The receiving the event returned by the file monitoring tool and determining the action corresponding to the event includes:

[0015] receiving the database event returned by the file monitoring tool, and determining the first action corresponding to the database event;

[0016] The step of establishing a link with a data node in a distributed database and sending an action query message to the data node includes:

[0017] Establishing a link with a data node in a distributed database, and sending a first action query message to the data node;

[0018] The receiving a response message returned by the data node in response to the action query message, and detecting abnormality of the action according to the response message, comprises:

[0019] A first response message is received from the data node in response to the first action query message, and abnormality of the first action is detected according to the first response message.

[0020] In an optional implementation, the acquiring the file path, calling the file monitoring tool, and monitoring at least one data file under the file path includes:

[0021] Obtain a database table file path, call a file monitoring tool, and monitor at least one database table file under the database table file path;

[0022] Wherein, the file monitoring tool returns a corresponding database table event when a second action occurs to at least one of the database table files;

[0023] The receiving the event returned by the file monitoring tool and determining the action corresponding to the event includes:

[0024] receiving the database table event returned by the file monitoring tool, and determining the second action corresponding to the database table event;

[0025] The step of establishing a link with a data node in a distributed database and sending an action query message to the data node includes:

[0026] Establishing a link with a data node in a distributed database, and sending a second action query message to the data node;

[0027] The receiving a response message returned by the data node in response to the action query message, and detecting abnormality of the action according to the response message, comprises:

[0028] Receive a second response message returned by the data node in response to the second action query message, and detect abnormality of the second action according to the second response message.

[0029] In an optional implementation, the first action is a first deletion action;

[0030] The establishing a link with a data node in a distributed database and sending a first action query message to the data node includes:

[0031] Establishing a link with a data node in a distributed database, and sending a query message to the data node as to whether at least one database file exists;

[0032] The receiving a first response message returned by the data node in response to the first action query message, and detecting abnormality of the first action according to the first response message, includes:

[0033] Receiving a first response message returned by the data node in response to a query message about whether the at least one database file exists;

[0034] In a case where the first response message indicates that at least one of the database files exists, determining that the first deletion action is abnormal;

[0035] When the first response message indicates that at least one of the database files does not exist, it is determined that the first deletion action is normal.

[0036] In an optional embodiment, the first action is a first moving action;

[0037] The establishing a link with a data node in a distributed database and sending a first action query message to the data node includes:

[0038] Establishing a link with a data node in a distributed database, and sending a query message to the data node to determine whether a storage path of at least one of the database files has been modified;

[0039] The receiving a first response message returned by the data node in response to the first action query message, and detecting abnormality of the first action according to the first response message, includes:

[0040] Receiving a first response message returned by the data node in response to a query message as to whether a storage path of at least one of the database files has been modified;

[0041] If the first response message indicates that a storage path of at least one of the database files has been modified and the modification is in accordance with expectations, determining that the first moving action is normal;

[0042] When the first response message indicates that the storage path of at least one of the database files has not been modified, it is determined that the first moving action is abnormal.

[0043] In an optional implementation, the second action is a second deletion action;

[0044] The establishing a link with a data node in a distributed database and sending a second action query message to the data node includes:

[0045] Establishing a link with a data node in a distributed database, and sending a query message to the data node to check whether at least one database table file exists;

[0046] The receiving a second response message returned by the data node in response to the second action query message, and detecting abnormality of the second action according to the second response message, includes:

[0047] Receiving a second response message returned by the data node in response to a query message about whether the at least one database table file exists;

[0048] When the second response message indicates that at least one of the database table files does not exist, determining that the second deletion action is normal;

[0049] In a case where the second response message indicates that at least one of the database table files exists, detecting whether at least one of the database table files does not really exist;

[0050] When at least one of the database table files does not really exist, it is determined that the second deletion action is abnormal.

[0051] In an optional embodiment, the second action is a second moving action;

[0052] said establishing a link with a data node in a distributed database, and sending a second action query message to said data node;

[0053] Establishing a link with a data node in a distributed database, and sending a query message to the data node to determine whether a storage path of at least one of the database table files has been modified;

[0054] The receiving a second response message returned by the data node in response to the second action query message, and detecting abnormality of the second action according to the second response message, includes:

[0055] receiving a second response message returned by the data node in response to a query message as to whether a storage path of at least one of the database table files has been modified;

[0056] If the second response message indicates that a storage path of at least one of the database table files has been modified and the modification is in accordance with expectations, determining that the second movement action is normal;

[0057] When the second response message indicates that the storage path of at least one of the database table files has not been modified, it is determined that the second move action is abnormal.

[0058] In a second aspect, the present application provides a file action detection device, the device comprising:

[0059] A path acquisition module, used to acquire a file path, call a file monitoring tool, and monitor at least one data file under the file path;

[0060] Wherein, the file monitoring tool returns a corresponding event when an action occurs on at least one of the data files;

[0061] An action determination module, used for receiving the event returned by the file monitoring tool and determining the action corresponding to the event;

[0062] A message sending module, used to establish a link with a data node in a distributed database and send an action query message to the data node;

[0063] The action detection module is used to receive a response message returned by the data node in response to the action query message, and detect abnormality of the action according to the response message.

[0064] In a third aspect, an electronic device is provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0065] Memory, used to store computer programs;

[0066] The processor is used to implement the file action detection method described in any one of the first aspects above when executing the program stored in the memory.

[0067] In a fourth aspect, a storage medium is also provided, wherein instructions are stored in the storage medium, and when the storage medium is run on a computer, the computer executes the file action detection method described in any one of the first aspects above.

[0068] In a fifth aspect, a computer program product comprising instructions is also provided, which, when executed on a computer, enables the computer to execute any of the file action detection methods described above.

[0069] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the method provided by the embodiment of the present application obtains a file path, calls a file monitoring tool, and monitors at least one data file under the file path, wherein the file monitoring tool returns a corresponding event when an action occurs on at least one data file, receives the event returned by the file monitoring tool, determines the action corresponding to the event, establishes a link with the data node in the distributed database, sends an action query message to the data node, receives a response message returned by the data node in response to the action query message, and detects abnormality of the action based on the response message.

[0070] By calling the file monitoring tool, at least one data file under the file path is monitored. When at least one data file has an action, the file monitoring tool returns a corresponding event. The event returned by the file monitoring tool is received, and the action corresponding to the event is determined. A link is established with the data node in the distributed database, and an action query message is sent to the data node. A response message returned by the data node in response to the action query message is received. According to the response message, the abnormality of the action is detected. In this way, the abnormality of the data file action can be detected at the first time through the file monitoring tool to avoid affecting the business. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0072] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0073] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0074] Figure 1 A schematic diagram of an implementation flow of a file action detection method provided in an embodiment of the present application;

[0075] Figure 2 A schematic diagram of an implementation flow of another file action detection method provided in an embodiment of the present application;

[0076] Figure 3 A schematic diagram of an implementation flow of another file action detection method provided in an embodiment of the present application;

[0077] Figure 4 A schematic diagram of the structure of a file action detection device provided in an embodiment of the present application;

[0078] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0079] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0080] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0081] like Figure 1 FIG. 1 is a schematic diagram of an implementation flow of a file action detection method provided in an embodiment of the present application. The method is applied to an electronic device and may specifically include the following steps:

[0082] S101, obtaining a file path, calling a file monitoring tool, and monitoring at least one data file under the file path.

[0083] In an embodiment of the present application, a file path may be obtained, the file path including a database file path and / or a database table file path, and a file monitoring tool may be called to monitor at least one data file under the file path.

[0084] For the file monitoring tool, when at least one data file under the file path takes action, a corresponding event is returned to monitor at least one data file under the file path. The action may be a human action or a spontaneous action of a data node.

[0085] For file monitoring tools, for example, it can be fsnotify, which supports monitoring the following actions: CREATE, REMOVE, WRITE, RENAME, CHMOD, which means that when at least one data file under the file path undergoes the above actions, fsnotify will return corresponding events, that is, the returned events correspond to the actions that occur on the data files, and the embodiments of the present application do not limit this.

[0086] S102, receiving an event returned by a file monitoring tool, and determining an action corresponding to the event.

[0087] In an embodiment of the present application, for a file monitoring tool, corresponding events can be returned, so that the events returned by the file monitoring tool can be received and the actions corresponding to the events can be determined, so that what actions have occurred in at least one data file under the file path can be known, so as to facilitate detection of whether the actions are human behavior or spontaneous behavior of the data node.

[0088] S103, establishing a link with a data node in a distributed database, and sending an action query message to the data node.

[0089] S104, receiving a response message returned by the data node in response to the action query message, and detecting abnormality of the action according to the response message.

[0090] In an embodiment of the present application, a link can be established with a data node in a distributed database, and an action query message can be sent to the data node to query whether the action occurring in at least one data file under the file path is a spontaneous action of the data node.

[0091] For data nodes in a distributed database, they can respond to the above query messages and return corresponding response messages, so that they can receive response messages returned by the data nodes in response to the action query messages, and detect the abnormality of the action based on the response messages, that is, detect whether the action is a spontaneous behavior of the data node or a human behavior.

[0092] Through the above description of the technical solution provided in the embodiment of the present application, a file path is obtained, a file monitoring tool is called, and at least one data file under the file path is monitored, wherein the file monitoring tool returns a corresponding event when an action occurs on at least one data file, receives the event returned by the file monitoring tool, determines the action corresponding to the event, establishes a link with the data node in the distributed database, sends an action query message to the data node, receives a response message returned by the data node in response to the action query message, and detects abnormality of the action based on the response message.

[0093] By calling the file monitoring tool, at least one data file under the file path is monitored. When at least one data file has an action, the file monitoring tool returns a corresponding event. The event returned by the file monitoring tool is received, and the action corresponding to the event is determined. A link is established with the data node in the distributed database, and an action query message is sent to the data node. A response message returned by the data node in response to the action query message is received. According to the response message, the abnormality of the action is detected. In this way, the abnormality of the data file action can be detected at the first time through the file monitoring tool to avoid affecting the business.

[0094] In the embodiment of the present application, for the file path, one type of situation is the database file path. Based on this, if Figure 2 FIG. 1 is a schematic diagram of an implementation flow of another file action detection method provided in an embodiment of the present application. The method is applied to an electronic device and may specifically include the following steps:

[0095] S201, obtaining a database file path, calling a file monitoring tool, and monitoring at least one database file under the database file path.

[0096] In an embodiment of the present application, a database file path can be obtained, and a file monitoring tool can be called to monitor at least one database file under the database file path. Among them, the distributed database can be queried to see which databases the data node currently has, and the file paths where the database files of these databases are located can be obtained as the database file path.

[0097] In the case where the first action occurs to at least one database file under the database file path, the file monitoring tool returns a corresponding database event to monitor at least one database file under the database file path. The first action may be a human action or a spontaneous action of a data node.

[0098] For file monitoring tools, for example, it can be fsnotify, which supports monitoring the following first actions: CREATE, REMOVE, WRITE, RENAME, CHMOD, which means that when the above first action occurs in at least one database file under the database file path, fsnotify will return the corresponding database event, that is, the returned database event corresponds to the first action occurring in the database file, and the embodiments of the present application are not limited to this.

[0099] S202, receiving a database event returned by a file monitoring tool, and determining a first action corresponding to the database event.

[0100] In an embodiment of the present application, for a file monitoring tool, corresponding database events can be returned, so that the database events returned by the file monitoring tool can be received, and the first action corresponding to the database event can be determined, so that what action has occurred in at least one database file under the database file path can be known, so as to facilitate detection of whether the action is a human behavior or a spontaneous behavior of the data node.

[0101] S203, establishing a link with a data node in a distributed database, and sending a first action query message to the data node.

[0102] S204, receiving a first response message returned by the data node in response to the first action query message, and detecting abnormality of the first action according to the first response message.

[0103] In an embodiment of the present application, a link can be established with a data node in a distributed database, and a first action query message can be sent to the data node to query whether the first action occurring in at least one database file under the database file path is a spontaneous action of the data node.

[0104] For data nodes in a distributed database, a corresponding first response message can be returned in response to the above-mentioned first action query message, so that the first response message returned by the data node in response to the first action query message can be received, and the abnormality of the first action can be detected according to the first response message, that is, whether the first action is a spontaneous behavior of the data node.

[0105] Specifically, for the first action, it may be the first creation action, which means that a new database file is created under the database file path. At this time, the file monitoring tool will return the corresponding database creation event, thereby receiving the database creation event returned by the file monitoring tool and determining the first creation action corresponding to the database creation event. At this time, for the first creation action, the file monitoring tool can be called to monitor the new database file created under the database file path.

[0106] For the first action, it may be the first deletion action, which means that the database file is deleted under the database file path. At this time, the file monitoring tool will return the corresponding database deletion event, thereby receiving the database deletion event returned by the file monitoring tool, and determining the first deletion action corresponding to the database deletion event, establishing a link with the data node in the distributed database, sending a query message to the data node whether at least one database file under the database file path exists, receiving the first response message returned by the data node in response to the query message whether at least one database file under the database file path exists, and when the first response message indicates that at least one database file under the database file path exists, determining that the first deletion action is abnormal, that is, the first deletion action is an external behavior, such as a human behavior, and when the first response message indicates that at least one database file under the database file path does not exist, determining that the first deletion action is normal, which means that the first deletion action is a spontaneous behavior of the data node.

[0107] For the first action, it may be the first move action, which means that the database file is moved under the database file path. At this time, the file monitoring tool will return the corresponding database move event, thereby receiving the database move event returned by the file monitoring tool, and determining the first move operation corresponding to the database move event, establishing a link with the data node in the distributed database, sending a query message to the data node whether the storage path of at least one database file under the database file path has been modified, and receiving the first response message returned by the data node in response to the query message whether the storage path of at least one database file under the database file path has been modified. When the first response message indicates that the storage path of at least one database file under the database file path has been modified and the modification is in line with expectations (that is, the latest storage path of the database file is consistent with the storage path configured by the data node), it is determined that the first move action is normal, which means that the first move action is a spontaneous behavior of the data node. When the first response message indicates that the storage path of at least one database file under the database file path has not been modified, it is determined that the first move action is abnormal, that is, the first move action is an external behavior, such as a human behavior.

[0108] For the first action, it may be the first editing action, which means that the database file is edited under the database file path. At this time, the file monitoring tool will return the corresponding database editing event, thereby receiving the database editing event returned by the file monitoring tool and determining the first editing operation corresponding to the database editing event. For the first editing operation, it is currently considered not to be abnormal and is normal.

[0109] For the first action, it may be the first permission modification action or the first group modification operation, which means that the permission or group of the database file is modified under the database file path. At this time, the file monitoring tool will return the corresponding database permission modification event or database group modification event, thereby receiving the database permission modification event or database group modification event returned by the file monitoring tool, and determining the first permission modification action or the first group modification operation corresponding to the database permission modification event or the database group modification event. The first permission modification action or the first group modification operation is currently considered to be abnormal.

[0110] In addition, in the embodiment of the present application, when the first action is detected to be abnormal, for the data node, if it is a backup data node, an alarm can be issued, and if it is a primary data node, a primary-backup switch will be performed to automatically restore the service. Among them, the available backup data node of the shard where the primary data node is located can be queried, and this available backup data node is preferably in the same computer room as the primary data node, so that the playback is fastest, and then the primary-backup switch can be initiated.

[0111] In the embodiment of the present application, for the file path, another case is the database table file path. Based on this, Figure 3 FIG. 1 is a schematic diagram of an implementation flow of another file action detection method provided in an embodiment of the present application. The method is applied to an electronic device and may specifically include the following steps:

[0112] S301, obtaining a database table file path, calling a file monitoring tool, and monitoring at least one database table file under the database table file path.

[0113] In an embodiment of the present application, a database table file path can be obtained, and a file monitoring tool can be called to monitor at least one database table file under the database table file path. Among them, it is possible to query which databases the data node currently has in the distributed database, and the database table file path can be obtained by splicing according to the library names of these databases.

[0114] Wherein, for the file monitoring tool, when the second action occurs to at least one database table file under the database table file path, the corresponding database table event is returned to realize the monitoring of at least one database table file under the database table file path. Wherein, the second action may be a human action or a spontaneous action of the data node.

[0115] For the file monitoring tool, for example, it can be fsnotify, which supports monitoring the following second actions: CREATE, REMOVE, WRITE, RENAME, CHMOD, which means that when the above second action occurs in at least one database table file under the database table file path, fsnotify will return the corresponding database table event, that is, the returned database table event corresponds to the second action occurring in the database table file, and the embodiments of the present application are not limited to this.

[0116] S302, receiving a database table event returned by a file monitoring tool, and determining a second action corresponding to the database table event.

[0117] In an embodiment of the present application, for a file monitoring tool, a corresponding database table event can be returned, so that the database table event returned by the file monitoring tool can be received, and the second action corresponding to the database table event can be determined, so as to know what action has occurred in at least one database table file under the database table file path, so as to facilitate detection of whether the action is a human behavior or a spontaneous behavior of the data node.

[0118] S303, establishing a link with a data node in the distributed database, and sending a second action query message to the data node.

[0119] S304: Receive a second response message returned by the data node in response to the second action query message, and detect abnormality of the second action according to the second response message.

[0120] In an embodiment of the present application, a link can be established with a data node in a distributed database, and a second action query message can be sent to the data node to query whether the second action occurring in at least one database table file under the database table file path is a spontaneous action of the data node.

[0121] For data nodes in a distributed database, a corresponding second response message can be returned in response to the above-mentioned second action query message, so that the second response message returned by the data node in response to the second action query message can be received, and the abnormality of the second action can be detected according to the second response message, that is, whether the second action is a spontaneous behavior of the data node.

[0122] Specifically, for the second action, it may be the second creation action, which means that a new database table file is created under the database table file path. At this time, the file monitoring tool will return the corresponding database table creation event, thereby receiving the database table creation event returned by the file monitoring tool and determining the second creation action corresponding to the database table creation event. At this time, the second creation action can be ignored.

[0123] For the second action, it may be a second deletion action, which means that the database table file is deleted under the database table file path. At this time, the file monitoring tool will return the corresponding database table deletion event, thereby receiving the database table deletion event returned by the file monitoring tool, and determining the second deletion action corresponding to the database table deletion event, establishing a link with the data node in the distributed database, sending a query message to the data node whether at least one database table file under the database table file path exists, receiving a second response message returned by the data node in response to the query message whether at least one database table file under the database table file path exists, and when the second response message indicates that at least one database table file under the database table file path does not exist, determining that the second deletion action is normal, which means that the second deletion action is a spontaneous behavior of the data node, and when the second response message indicates that at least one database table file under the database table file path exists, detecting whether at least one database table file (i.e., ibd file) under the database table file path really does not exist, and when at least one database table file under the database table file path really exists, determining that the second deletion action is abnormal, indicating that it is a human behavior.

[0124] It should be noted that, when the second response message indicates that at least one database table file under the database table file path exists, detecting whether at least one database table file under the database table file path does not actually exist is to exclude events triggered by a truncate operation, which is not limited in this embodiment of the present application.

[0125] For the second action, it may be a second move action, which means that the database table file is moved under the database table file path. At this time, the file monitoring tool will return a corresponding database table move event, thereby receiving the database table move event returned by the file monitoring tool, and determining the second move operation corresponding to the database table move event, establishing a link with the data node in the distributed database, sending a query message to the data node whether the storage path of at least one database table file under the database table file path has been modified, and receiving a second response message returned by the data node in response to the query message whether the storage path of at least one database table file under the database table file path has been modified. When the second response message indicates that the storage path of at least one database table file under the database table file path has been modified and the modification is in line with expectations (that is, the latest storage path of the database table file is consistent with the storage path configured by the data node), it is determined that the second move action is normal, which means that the second move action is a spontaneous behavior of the data node. When the second response message indicates that the storage path of at least one database table file under the database table file path has not been modified, it is determined that the second move action is abnormal, that is, the second move action is an external behavior, such as a human behavior.

[0126] For the second action, it may be the second editing action, which means that the database table file is edited under the database table file path. At this time, the file monitoring tool will return the corresponding database table editing event, thereby receiving the database table editing event returned by the file monitoring tool and determining the second editing operation corresponding to the database table editing event. For the second editing operation, it is currently considered not to be abnormal and is normal.

[0127] For the second action, it may be a second permission modification action or a second group modification operation, which means that the permission or group of the database table file is modified under the database table file path. At this time, the file monitoring tool will return the corresponding database table permission modification event or database table group modification event, thereby receiving the database table permission modification event or database table group modification event returned by the file monitoring tool, and determining the second permission modification action or second group modification operation corresponding to the database table permission modification event or database table group modification event. The second permission modification action or the second group modification operation is currently considered to be abnormal.

[0128] It should be noted that the above-mentioned database table files are generally ibd files, but may also be other files, such as redo files. At this time, it is detected whether the number of redo files is consistent with the number of redo files matched with the data node. If they are inconsistent, it is considered an abnormality.

[0129] In addition, in the embodiment of the present application, when the second action is detected to be abnormal, for the data node, if it is a backup data node, an alarm can be issued, and if it is a primary data node, a primary-backup switch will be performed to automatically restore the service. Among them, the available backup data node of the shard where the primary data node is located can be queried, and this available backup data node is preferably in the same computer room as the primary data node, so that the playback is fastest, and then the primary-backup switch can be initiated.

[0130] Corresponding to the above method embodiment, the present application embodiment also provides a file action detection device, such as Figure 4 As shown, the device may include: a path acquisition module 410 , an action determination module 420 , a message sending module 430 , and an action detection module 440 .

[0131] A path acquisition module 410 is used to acquire a file path, call a file monitoring tool, and monitor at least one data file under the file path;

[0132] Wherein, the file monitoring tool returns a corresponding event when an action occurs on at least one of the data files;

[0133] An action determination module 420, configured to receive the event returned by the file monitoring tool and determine the action corresponding to the event;

[0134] A message sending module 430, used to establish a link with a data node in a distributed database and send an action query message to the data node;

[0135] The action detection module 440 is used to receive a response message returned by the data node in response to the action query message, and detect abnormality of the action according to the response message.

[0136] The present application also provides an electronic device, such as Figure 5 As shown, it includes a processor 51, a communication interface 52, a memory 53 and a communication bus 54, wherein the processor 51, the communication interface 52, and the memory 53 communicate with each other through the communication bus 54.

[0137] A memory 53, for storing computer programs;

[0138] The processor 51 is used to execute the program stored in the memory 53 to implement the following steps:

[0139] Obtain a file path, call a file monitoring tool, and monitor at least one data file under the file path; wherein the file monitoring tool returns a corresponding event when an action occurs on at least one of the data files; receive the event returned by the file monitoring tool, and determine the action corresponding to the event; establish a link with a data node in a distributed database, and send an action query message to the data node; receive a response message returned by the data node in response to the action query message, and detect abnormality of the action based on the response message.

[0140] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0141] The communication interface is used for communication between the above electronic device and other devices.

[0142] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0143] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0144] In another embodiment provided in the present application, a storage medium is also provided, in which instructions are stored. When the storage medium is run on a computer, the computer executes the file action detection method described in any of the above embodiments.

[0145] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the file action detection method described in any one of the above embodiments.

[0146] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a storage medium, or transmitted from one storage medium to another storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0147] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0148] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0149] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A method for detecting a file action, characterized in that: The method comprises: Obtain a file path, call a file monitoring tool, and monitor at least one data file under the file path; Wherein, the file monitoring tool returns a corresponding event when an action occurs on at least one of the data files; Receive the event returned by the file monitoring tool, and determine the action corresponding to the event; Establishing a link with a data node in a distributed database and sending an action query message to the data node; A response message returned by the data node in response to the action query message is received, and abnormality of the action is detected according to the response message.

2. The method according to claim 1, characterized in that: The obtaining of the file path, calling the file monitoring tool, and monitoring at least one data file under the file path includes: Obtain a database file path, call a file monitoring tool, and monitor at least one database file under the database file path; Wherein, the file monitoring tool returns a corresponding database event when a first action occurs to at least one of the database files; The receiving the event returned by the file monitoring tool and determining the action corresponding to the event includes: receiving the database event returned by the file monitoring tool, and determining the first action corresponding to the database event; The step of establishing a link with a data node in a distributed database and sending an action query message to the data node includes: Establishing a link with a data node in a distributed database, and sending a first action query message to the data node; The receiving a response message returned by the data node in response to the action query message, and detecting abnormality of the action according to the response message, comprises: A first response message is received from the data node in response to the first action query message, and abnormality of the first action is detected according to the first response message.

3. The method according to claim 1, characterized in that: The obtaining of the file path, calling the file monitoring tool, and monitoring at least one data file under the file path includes: Obtain a database table file path, call a file monitoring tool, and monitor at least one database table file under the database table file path; Wherein, the file monitoring tool returns a corresponding database table event when a second action occurs to at least one of the database table files; The receiving the event returned by the file monitoring tool and determining the action corresponding to the event includes: receiving the database table event returned by the file monitoring tool, and determining the second action corresponding to the database table event; The step of establishing a link with a data node in a distributed database and sending an action query message to the data node includes: Establishing a link with a data node in a distributed database, and sending a second action query message to the data node; The receiving a response message returned by the data node in response to the action query message, and detecting abnormality of the action according to the response message, comprises: Receive a second response message returned by the data node in response to the second action query message, and detect abnormality of the second action according to the second response message.

4. The method according to claim 2, characterized in that: The first action is a first deletion action; The establishing a link with a data node in a distributed database and sending a first action query message to the data node includes: Establishing a link with a data node in a distributed database, and sending a query message to the data node as to whether at least one database file exists; The receiving a first response message returned by the data node in response to the first action query message, and detecting abnormality of the first action according to the first response message, includes: Receiving a first response message returned by the data node in response to a query message about whether the at least one database file exists; In a case where the first response message indicates that at least one of the database files exists, determining that the first deletion action is abnormal; When the first response message indicates that at least one of the database files does not exist, it is determined that the first deletion action is normal.

5. The method according to claim 2, characterized in that: The first action is a first moving action; The establishing a link with a data node in a distributed database and sending a first action query message to the data node includes: Establishing a link with a data node in a distributed database, and sending a query message to the data node to determine whether a storage path of at least one of the database files has been modified; The receiving a first response message returned by the data node in response to the first action query message, and detecting abnormality of the first action according to the first response message, includes: Receiving a first response message returned by the data node in response to a query message as to whether a storage path of at least one of the database files has been modified; If the first response message indicates that a storage path of at least one of the database files has been modified and the modification is in accordance with expectations, determining that the first moving action is normal; When the first response message indicates that the storage path of at least one of the database files has not been modified, it is determined that the first moving action is abnormal.

6. The method according to claim 3, characterized in that The second action is a second deletion action; The establishing a link with a data node in a distributed database and sending a second action query message to the data node includes: Establishing a link with a data node in a distributed database, and sending a query message to the data node to check whether at least one database table file exists; The receiving a second response message returned by the data node in response to the second action query message, and detecting abnormality of the second action according to the second response message, includes: Receiving a second response message returned by the data node in response to a query message about whether the at least one database table file exists; When the second response message indicates that at least one of the database table files does not exist, determining that the second deletion action is normal; In a case where the second response message indicates that at least one of the database table files exists, detecting whether at least one of the database table files does not really exist; When at least one of the database table files does not really exist, it is determined that the second deletion action is abnormal.

7. The method according to claim 3, characterized in that The second action is a second moving action; said establishing a link with a data node in a distributed database, and sending a second action query message to said data node; Establishing a link with a data node in a distributed database, and sending a query message to the data node to determine whether a storage path of at least one of the database table files has been modified; The receiving a second response message returned by the data node in response to the second action query message, and detecting abnormality of the second action according to the second response message, includes: receiving a second response message returned by the data node in response to a query message as to whether a storage path of at least one of the database table files has been modified; If the second response message indicates that a storage path of at least one of the database table files has been modified and the modification is in accordance with expectations, determining that the second movement action is normal; When the second response message indicates that the storage path of at least one of the database table files has not been modified, it is determined that the second move action is abnormal.

8. A file action detection device, characterized in that: The device comprises: A path acquisition module, used to acquire a file path, call a file monitoring tool, and monitor at least one data file under the file path; Wherein, the file monitoring tool returns a corresponding event when an action occurs on at least one of the data files; An action determination module, used for receiving the event returned by the file monitoring tool and determining the action corresponding to the event; A message sending module, used to establish a link with a data node in a distributed database and send an action query message to the data node; The action detection module is used to receive a response message returned by the data node in response to the action query message, and detect abnormality of the action according to the response message.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-7 when executing a program stored in a memory.

10. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images