Data processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a data processing method and device, electronic equipment and a storage medium, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of receiving a preset program running instruction, and obtaining a to-be-monitored function set in a preset program to monitor call information of each to-be-monitored function in the function set; in response to the condition that the calling information is triggered, monitoring stack information and memory access information called corresponding to the to-be-monitored functions, so as to extract a data access address from the stack information, and generating data access distribution information of each to-be-monitored function in combination with the memory access information; memory structure information of the preset program is obtained, and the running state of the preset program is calculated according to the memory structure information and the data access distribution information; and sending the running state of the preset program and the data access distribution information. According to the implementation mode, the problems that when the abnormal crash is recorded and reproduced by using ebpf, the overall operation monitoring of the application program cannot be solved, and the user requirements cannot be met can be solved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data processing method, device, electronic equipment and storage medium. Background Art

[0002] As more and more business applications are used, application operation monitoring and exception handling have become important issues, especially the handling of application abnormal crashes. In the Linux environment, in related technologies, ebpf can be used to record and reproduce abnormal crashes to solve the problem of application abnormal crashes. However, this method can only record after the application exception occurs, and cannot solve the overall operation monitoring of the application, and cannot meet user needs. Summary of the invention

[0003] In view of this, the embodiments of the present invention provide a data processing method, device, electronic device and storage medium, which can solve the problem that using eBPF to record and reproduce abnormal crashes cannot solve the overall operation monitoring of the application and cannot meet user needs.

[0004] To achieve the above objective, according to one aspect of an embodiment of the present invention, a method for data processing is provided.

[0005] A data processing method according to an embodiment of the present invention includes: receiving a preset program running instruction, calling each pre-mounted monitoring program, obtaining a set of functions to be monitored in the preset program, so as to monitor the calling information of each function to be monitored in the function set; in response to the calling information being triggered, monitoring the stack information and memory access information of the corresponding function to be monitored, so as to extract the data access address from the stack information, so as to generate the data access distribution information of each function to be monitored in combination with the memory access information; obtaining the memory structure information of the preset program, calling a preset analysis model, so as to calculate the running status of the preset program according to the memory structure information and the data access distribution information; and sending the running status of the preset program and the data access distribution information.

[0006] In one embodiment, data access addresses are extracted from the stack information to generate data access distribution information of each function to be monitored in combination with the memory access information, including: for each function to be monitored, data access addresses are extracted from the stack information, an address access array is generated according to an access order, and memory shard information to which the data access address belongs is obtained to generate a corresponding memory access array; the memory access array is matched with the memory access information to determine the data access distribution information according to the matching result.

[0007] In another embodiment, the data access address is extracted from the stack information to generate data access distribution information of each function to be monitored in combination with the memory access information, including: for each function to be monitored, the data access address is extracted from the stack information, and the memory shard information to which the data access address belongs is obtained to determine the memory shard range corresponding to the data access address; the memory shard range is matched with the memory access information to determine the data access distribution information according to the matching result.

[0008] In another embodiment, the running status of the preset program is calculated based on the memory structure information and the data access distribution information, including: obtaining memory allocation information in the memory structure information, calculating the abnormal address in the data access distribution information that does not belong to the memory allocation information, and determining the running status of the preset program based on the abnormal address.

[0009] In another embodiment, the abnormal addresses in the data access distribution information that do not belong to the memory allocation information are calculated, including: calculating the address boundary area in the data access distribution information according to a preset area size, and determining the target address information belonging to the address boundary area, and screening the abnormal addresses in the target address information that do not belong to the memory allocation information.

[0010] In another embodiment, calling each pre-loaded monitoring program to obtain a set of functions to be monitored in the preset program includes: obtaining a hardware stack monitoring program and a memory monitoring program mounted by the preset program; calling the hardware stack monitoring program and the memory monitoring program to obtain a set of functions to be monitored in the preset program.

[0011] In another embodiment, after calculating the running status of the preset program according to the memory structure information and the data access distribution information, it also includes: in response to the running status satisfying a preset condition, triggering a process crash monitoring program associated with the preset program to monitor the abnormal messages of the preset program, and recording the process crash information of the preset program when the abnormal information is triggered.

[0012] To achieve the above objective, according to another aspect of an embodiment of the present invention, a data processing device is provided.

[0013] A data processing device according to an embodiment of the present invention includes: a receiving unit, which is used to receive preset program running instructions, call pre-mounted monitoring programs, obtain a set of functions to be monitored in the preset program, and monitor the calling information of each function to be monitored in the function set; a generating unit, which is used to monitor the stack information and memory access information of the corresponding function to be monitored in response to the calling information being triggered, so as to extract the data access address from the stack information, and generate the data access distribution information of each function to be monitored in combination with the memory access information; a calculating unit, which is used to obtain the memory structure information of the preset program for each function to be monitored, and call a preset analysis model to calculate the running status of the preset program according to the memory structure information and the data access distribution information; and a sending unit, which is used to send the running status of the preset program and the data access distribution information.

[0014] In one embodiment, the generation unit is specifically used to: for each of the functions to be monitored, extract the data access address from the stack information, generate an address access array according to the access order, obtain the memory shard information to which the data access address belongs, so as to generate a corresponding memory access array; match the memory access array with the memory access information, so as to determine the data access distribution information according to the matching result.

[0015] In another embodiment, the generation unit is specifically used to: for each of the functions to be monitored, extract the data access address from the stack information, obtain the memory shard information to which the data access address belongs, so as to determine the memory shard range corresponding to the data access address; match the memory shard range with the memory access information, so as to determine the data access distribution information according to the matching result.

[0016] In another embodiment, the computing unit is specifically used to: obtain memory allocation information in the memory structure information, calculate abnormal addresses in the data access distribution information that do not belong to the memory allocation information, and determine the running status of the preset program according to the abnormal addresses.

[0017] In another embodiment, the calculation unit is specifically used to: calculate the address boundary area in the data access distribution information according to a preset area size, determine the target address information belonging to the address boundary area, and filter out abnormal addresses in the target address information that do not belong to the memory allocation information.

[0018] In another embodiment, the receiving unit is specifically used to: obtain a hardware stack monitoring program and a memory monitoring program mounted by the preset program; call the hardware stack monitoring program and the memory monitoring program to obtain a set of functions to be monitored in the preset program.

[0019] In another embodiment, the device also includes: a trigger unit, which is used to trigger a process crash monitoring program associated with the preset program in response to the running state satisfying a preset condition, so as to monitor the abnormal messages of the preset program, and record the process crash information of the preset program when the abnormal information is triggered.

[0020] To achieve the above objective, according to another aspect of an embodiment of the present invention, an electronic device is provided.

[0021] An electronic device according to an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the data processing method provided by the embodiment of the present invention.

[0022] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer readable medium is provided.

[0023] A computer-readable medium according to an embodiment of the present invention stores a computer program, and when the program is executed by a processor, the data processing method provided by the embodiment of the present invention is implemented.

[0024] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer program product is provided.

[0025] A computer program product according to an embodiment of the present invention includes a computer program, and when the program is executed by a processor, the data processing method provided by the embodiment of the present invention is implemented.

[0026] One embodiment of the above invention has the following advantages or beneficial effects: In the embodiment of the present invention, for the preset program that needs to be monitored, when the program is running, each monitoring function can be monitored by each pre-mounted monitoring program, so that the corresponding stack information and memory access information are monitored in real time after the call information is triggered, and the two are combined to determine the data access distribution information of the function to be monitored, and then it can be analyzed with the memory structure information of the preset program to determine the running state of the preset program. In the embodiment of the present invention, the running of the preset program can be monitored in real time, and the data access distribution information is generated by the stack information and memory access information in the function call process, so as to be combined with the memory structure information of the preset program, and the running state of the preset program is analyzed in real time, thereby realizing real-time monitoring of the application program and meeting the requirements of application operation and abnormal monitoring; at the same time, the monitoring of the application operation in the embodiment of the present invention does not only rely on the stack information, but also synchronously monitors the memory access information, so as to realize the monitoring of the application operation from the memory access dimension, thereby improving the accuracy of the application operation monitoring.

[0027] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention. Figure 1 is a schematic diagram of a system architecture of a data processing system according to an embodiment of the present invention; Figure 2 is a schematic diagram of a main flow of a data processing method according to an embodiment of the present invention; Figure 3 is a schematic diagram of another main flow of a data processing method according to an embodiment of the present invention; Figure 4 is a schematic diagram of another main flow of a data processing method according to an embodiment of the present invention; Figure 5 is a schematic diagram of main units of a data processing apparatus according to an embodiment of the present invention; Figure 6 is another exemplary system architecture diagram to which the embodiments of the present invention can be applied; Figure 7 It is a schematic diagram of the structure of a computer system suitable for implementing the embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0030] It should be pointed out that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict. The acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. In the embodiments of this application, some existing solutions in the industry such as certain software, components, and models may be mentioned, which should be considered as exemplary. Their purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0031] An embodiment of the present invention provides a data processing system, which can be used in a scenario where the running of an application is monitored, and specifically can be used in a scenario where the running of an application is monitored through ebpf.

[0032] As a lightweight virtual machine based on the kernel, eBPF (Extended Berkeley Packet Filter) can run custom programs in the kernel to achieve real-time monitoring and analysis of system events. In the embodiment of the present invention, the data processing system monitors the running application program through eBPF, such as Figure 1 The following is a schematic diagram of the data system architecture based on ebpf. Figure 1 The ebpf client can be set at the front end or client of the data processing system, and it can interact with the user to receive the instructions input by the user or display the information to be displayed; the ebpf client can configure the distribution program to distribute the configuration file to the kernel ebpf registration function module through the ebpf maps to mount it into the call table of the Linux system application; when the application is initialized, it can parse the function call relationship of the program to be monitored and record the call of the preset function in the ebpf maps, so that the kernel ebpf execution function module can be monitored and the corresponding stack information and memory access information can be obtained. This information can be transmitted to the client through the ebpf maps for analysis, storage and display.

[0033] The embodiment of the present invention provides a method for data processing, which can be Figure 1 The data processing system shown executes, as Figure 2 As shown, the method includes the following steps.

[0034] S201: receiving a preset program running instruction, calling each pre-mounted monitoring program, obtaining a function set to be monitored in the preset program, and monitoring calling information of each function to be monitored in the function set.

[0035] The preset program indicates a program to be monitored, which is usually pre-configured, and the running instruction may be a startup instruction, indicating that the preset program is started. The monitoring program may be implemented by ebpf, which is mounted in the preset program to be monitored during pre-configuration. When the preset program is running, each pre-mounted monitoring program may be called to monitor the running of the preset program.

[0036] Specifically, the functions to be monitored can be preconfigured in the monitoring program. For example, the function information to be monitored can be declared in a configuration file. Therefore, in this step, after calling the monitoring program, the set of functions to be monitored in the preset program can be obtained from the configuration file.

[0037] It should be noted that since the monitoring of the application does not require the monitoring of the entire running process of the application, the function to be monitored in the preset program, i.e., the function to be monitored, can be pre-configured. During the configuration process, the monitoring program is mounted into the call table of the preset program. If a hook is set in the call table, the monitoring of the function to be monitored can be automatically triggered when it is called, thereby realizing the monitoring of the function to be monitored.

[0038] S202: In response to the call information being triggered, monitor the stack information and memory access information of the function to be monitored, extract the data access address from the stack information, and generate data access distribution information of each function to be monitored in combination with the memory access information.

[0039] Among them, the call information of the function to be monitored is triggered, indicating that the function to be monitored is called, so the execution process of the function can be monitored to obtain stack information and memory access information. The stack information can record the function call sequence and can display the call path when the program runs to a certain point. When the function is called, the memory unit of the local variable in the function will be allocated to the stack. When the function is executed, the system automatically releases the allocated stack address unit, so the stack information can be used to explain the memory address of the data used in the function call process, that is, the memory address accessed during the function call process. Memory access information represents monitoring from the memory access dimension, which obtains memory access information during the function call, which may include the memory address accessed in the memory. This memory address is usually not a specific data storage address, but a larger range of addresses after the memory is divided. For example, the system memory is usually fragmented, so the memory access information in this step can be specifically the fragmentation information of memory access.

[0040] In an embodiment of the present invention, a data access address, such as an address identifier, can be extracted from the stack information. During data access, operations such as data reading can be performed based on the address identifier. The memory sharding information of data access during the function call process can be determined from the memory access information. Therefore, the combination of the two can determine the data access distribution information during the calling process of the monitored function.

[0041] Specifically, on the one hand, this step can be executed as follows: for each function to be monitored, extract the data access address from the stack information, generate an address access array according to the access order, obtain the memory shard information to which the data access address belongs, so as to generate a corresponding memory access array; match the memory access array with the memory access information to determine the data access distribution information based on the matching result.

[0042] For each function to be monitored, the stack information and memory access information of the corresponding function to be monitored can be monitored, so the data access distribution information of each function to be monitored can be determined. Since the data in the stack is sequential, the access order of the data can be determined in this step, and then the address access array can be generated according to the access order, that is, the order of the data access addresses in the function call is represented by the order of the elements in the array. Since each data access address is divided into memory slices, the slice information to which each data access address belongs can be determined, and then the address access array can be converted into a memory access array, and then it can be matched with the memory access information. If the two match successfully, the memory access array can be determined as the data access distribution information; if the two match unsuccessfully, the unmatched data can be marked and annotated in the memory access array, and the marked memory access array can be determined as the data access distribution information.

[0043] On the other hand, this step can be executed as follows: for each function to be monitored, extract the data access address from the stack information, obtain the memory shard information to which the data access address belongs, so as to determine the memory shard range corresponding to the data access address; match the memory shard range with the memory access information to determine the data access distribution information based on the matching result.

[0044] After extracting the data access address in this step, the memory shard range corresponding to the data access address can be determined based on the shard information to which it belongs, and then matched with the memory access information to determine the data access distribution information based on the matching result. If the two are matched successfully, the memory shard range can be determined as the data access distribution information; if the two are not matched successfully, the unmatched data can be marked and annotated in the memory shard range, and the marked memory shard range can be determined as the data access distribution information.

[0045] It should be noted that in the embodiment of the present invention, the data access address during the function call is monitored from two dimensions: access order and access range, and the program execution can be analyzed from these two dimensions. Therefore, these two methods can be executed simultaneously or only one of them can be executed, which can be set based on needs.

[0046] It should be noted that, in order to facilitate the overhead of stack information and memory access information, corresponding kernel ebpf hardware stack monitoring and memory monitoring can be set in the embodiment of the present invention, such as Figure 1 As shown, it is used for real-time monitoring of the application.

[0047] S203: Obtain memory structure information of a preset program, and call a preset analysis model to calculate the running status of the preset program according to the memory structure information and the data access distribution information.

[0048] Among them, the memory structure information of the preset program is usually pre-allocated, and the corresponding memory will be allocated when each program is running, so the memory structure information of the preset program can be obtained, and the acquisition method may not be limited. The analysis model is a pre-selected setting, which can be set according to needs and scenarios, and the embodiment of the present invention may not be limited. In this step, the memory structure information and the data access distribution information are compared and analyzed to determine the running status of the preset program.

[0049] Specifically, the memory allocation information represents the memory access to each calling function, so the abnormal address that does not belong to the memory allocation information in the data access distribution information can be calculated, so as to determine whether the running state of the preset program is abnormal. Therefore, this step can be performed as follows: obtain the memory allocation information in the memory structure information, calculate the abnormal address that does not belong to the memory allocation information in the data access distribution information, and determine the running state of the preset program according to the abnormal address.

[0050] In an embodiment of the present invention, in order to simplify the calculation process, the address information belonging to the boundary area can be calculated based on the data access distribution information, wherein the boundary area is usually determined according to the specific range of the data access distribution information, so the size of the boundary area can be pre-set in this step, that is, the size of the preset area, and then the boundary of the memory access can be determined based on the data access distribution information, and the address boundary area in the data access distribution information is calculated in combination with the size of the preset area, and then the target address information belonging to this area can be determined. After the target address information is obtained, it can be compared with the memory allocation information to determine the abnormal address in the target address information that does not belong to the memory allocation information.

[0051] In the embodiment of the present invention, it can be set that if an abnormal address appears, it can be determined that the application program is running abnormally, that is, the running state of the preset program is abnormal, so after determining the abnormal address in this step, it can be determined that the running state of the preset program is abnormal. Or in this step, after determining the abnormal address, the frequency of occurrence of the abnormal address and / or the number of abnormal addresses can be determined first. If the frequency of occurrence of the abnormal address and / or the number of abnormal addresses exceeds a preset threshold, it can be determined whether the application program is running abnormally.

[0052] It should be noted that, in an embodiment of the present invention, the data access distribution information may include marked address information. In this case, after determining the target address information, it can be determined whether the marked address information belongs to the target address information. If it does, it can be said that there is an obvious abnormality in the address, and it can be directly determined that the running status of the preset program is abnormal; if it does not, the running status of the preset program can be further determined based on the target address.

[0053] S204: Sending the running status and data access distribution information of the preset program.

[0054] The running status and data access distribution information of the preset program can be sent to the client of the system for display and storage, so that the user can view it in time. In addition, when the running status is determined to be abnormal, the user can be reminded to handle it in time.

[0055] In an embodiment of the present invention, after the running status is determined, it can also be compared with the preset conditions. After the running status meets the preset conditions, the process crash monitoring program associated with the preset program is triggered in time to monitor the abnormal messages of the preset program, and when the abnormal information is triggered, the process crash information of the preset program is recorded for subsequent crash processing and restoration of the preset program.

[0056] It should be noted that, in the embodiment of the present invention, in order to facilitate the handling of exceptions and program crashes, an exception monitoring module may also be provided, such as Figure 1 As shown, the exceptions and process crashes of a preset program can be monitored, and when the exceptions and program crashes are monitored, stack information recording and memory access information recording are performed.

[0057] In an embodiment of the present invention, the operation of a preset program can be monitored in real time. By generating data access distribution information from the stack information and memory access information in the function call process and combining it with the memory structure information of the preset program, the running status of the preset program can be analyzed in real time, thereby realizing real-time monitoring of the application program and meeting the needs of application operation and exception monitoring. At the same time, in an embodiment of the present invention, the monitoring of the application operation does not only rely on the stack information, but also synchronously monitors the memory access information, thereby realizing the monitoring of the application operation from the memory access dimension, thereby improving the accuracy of the application operation monitoring.

[0058] Combine the following Figure 1 The system architecture shown in the figure specifically describes the data processing method in the embodiment of the present invention. Figure 3 As shown, the method includes the following steps.

[0059] S301: receiving a preset program running instruction, calling each pre-mounted monitoring program, obtaining a function set to be monitored in the preset program, and monitoring calling information of each function to be monitored in the function set.

[0060] S302: In response to the call information being triggered, for each function to be monitored, the data access address is extracted from the stack information, an address access array is generated according to the access order, and the memory shard information to which the data access address belongs is obtained to generate a corresponding memory access array; the memory access array is matched with the memory access information to determine the data access distribution information according to the matching result.

[0061] S303: In response to the call information being triggered, for each function to be monitored, the data access address is extracted from the stack information, and the memory shard information to which the data access address belongs is obtained to determine the memory shard range corresponding to the data access address; the memory shard range is matched with the memory access information to determine the data access distribution information according to the matching result.

[0062] S304: Obtain memory structure information of a preset program, and call a preset analysis model to calculate the running status of the preset program according to the memory structure information and the data access distribution information.

[0063] S305: Sending the running status and data access distribution information of the preset program.

[0064] S306: In response to the running state satisfying the preset condition, triggering a process crash monitoring program associated with the preset program to monitor abnormal messages of the preset program, and recording process crash information of the preset program when abnormal information is triggered.

[0065] It should be noted that the data processing principle in the embodiment of the present invention is the same as Figure 2 The corresponding data processing principles in the illustrated embodiments are the same and will not be described in detail here.

[0066] Combine the following Figure 1 The system architecture shown in the figure specifically describes the data processing method in the embodiment of the present invention. Figure 4 As shown, the method includes the following steps.

[0067] S401: receiving a preset program running instruction, obtaining a hardware stack monitoring program and a memory monitoring program mounted by the preset program; calling the hardware stack monitoring program and the memory monitoring program, and obtaining a function set to be monitored in the preset program.

[0068] S402: In response to the call information being triggered, monitor the stack information and memory access information of the function to be monitored, extract the data access address from the stack information, and generate data access distribution information of each function to be monitored in combination with the memory access information.

[0069] S403: Obtain memory structure information of a preset program, obtain memory allocation information in the memory structure information, calculate abnormal addresses in the data access distribution information that do not belong to the memory allocation information, and determine the running state of the preset program according to the abnormal addresses.

[0070] S404: Sending the running status and data access distribution information of the preset program.

[0071] It should be noted that the data processing principle in the embodiment of the present invention is the same as Figure 2 The corresponding data processing principles in the illustrated embodiments are the same and will not be described in detail here.

[0072] In order to solve the problems existing in the prior art, an embodiment of the present invention provides a data processing device 500, such as Figure 5 As shown, the device 500 includes: a receiving unit 501, which is used to receive a preset program running instruction, call each pre-mounted monitoring program, obtain a set of functions to be monitored in the preset program, and monitor the calling information of each function to be monitored in the function set; a generating unit 502, which is used to monitor the stack information and memory access information of the corresponding function to be monitored in response to the calling information being triggered, so as to extract the data access address from the stack information, so as to generate the data access distribution information of each function to be monitored in combination with the memory access information; a calculating unit 503, which is used to obtain the memory structure information of the preset program for each function to be monitored, and call a preset analysis model to calculate the running status of the preset program according to the memory structure information and the data access distribution information; a sending unit 504, which is used to send the running status of the preset program and the data access distribution information.

[0073] It should be understood that the manner of implementing the embodiments of the present invention is different from the Figure 2 The method of the illustrated embodiment is the same and will not be repeated here.

[0074] In one embodiment, the generation unit 502 is specifically used to: for each of the functions to be monitored, extract the data access address from the stack information, generate an address access array according to the access order, obtain the memory shard information to which the data access address belongs, so as to generate a corresponding memory access array; match the memory access array with the memory access information, so as to determine the data access distribution information according to the matching result.

[0075] In another embodiment, the generation unit 502 is specifically used to: for each of the functions to be monitored, extract the data access address from the stack information, obtain the memory shard information to which the data access address belongs, so as to determine the memory shard range corresponding to the data access address; match the memory shard range with the memory access information, so as to determine the data access distribution information according to the matching result.

[0076] In another embodiment, the calculation unit 503 is specifically used to: obtain memory allocation information in the memory structure information, calculate abnormal addresses in the data access distribution information that do not belong to the memory allocation information, and determine the running status of the preset program according to the abnormal addresses.

[0077] In another embodiment, the calculation unit 503 is specifically used to: calculate the address boundary area in the data access distribution information according to a preset area size, determine the target address information belonging to the address boundary area, and filter out abnormal addresses in the target address information that do not belong to the memory allocation information.

[0078] In another embodiment, the receiving unit 501 is specifically used to: obtain a hardware stack monitoring program and a memory monitoring program mounted by the preset program; call the hardware stack monitoring program and the memory monitoring program to obtain a set of functions to be monitored in the preset program.

[0079] In another embodiment, the device 500 also includes: a trigger unit, which is used to trigger a process crash monitoring program associated with the preset program in response to the running state satisfying a preset condition, so as to monitor the abnormal messages of the preset program, and record the process crash information of the preset program when the abnormal information is triggered.

[0080] It should be understood that the manner of implementing the embodiments of the present invention is different from the Figure 2 , 3 , and the method of the embodiment shown in 4 is the same and will not be repeated here.

[0081] In an embodiment of the present invention, the operation of a preset program can be monitored in real time. By generating data access distribution information from the stack information and memory access information in the function call process and combining it with the memory structure information of the preset program, the running status of the preset program can be analyzed in real time, thereby realizing real-time monitoring of the application program and meeting the needs of application operation and exception monitoring. At the same time, in an embodiment of the present invention, the monitoring of the application operation does not only rely on the stack information, but also synchronously monitors the memory access information, thereby realizing the monitoring of the application operation from the memory access dimension, thereby improving the accuracy of the application operation monitoring.

[0082] According to an embodiment of the present invention, the embodiment of the present invention further provides an electronic device and a readable storage medium.

[0083] The electronic device of an embodiment of the present invention comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the data processing method provided by the embodiment of the present invention.

[0084] Figure 6 An exemplary system architecture 600 is shown to which the data processing method or data processing apparatus according to the embodiment of the present invention can be applied.

[0085] like Figure 6As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0086] The user can use the terminal devices 601, 602, 603 to interact with the server 605 through the network 604 to receive or send messages, etc. Various client applications can be installed on the terminal devices 601, 602, 603.

[0087] The terminal devices 601 , 602 , and 603 may be, but are not limited to, smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0088] The server 605 may be a server that provides various services. The server may analyze and process the received data such as the product information query request, and feed back the processing result (such as product information - just an example) to the terminal device.

[0089] It should be noted that the data processing method provided in the embodiment of the present invention is generally executed by the server 605 , and accordingly, the data processing device is generally set in the server 605 .

[0090] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0091] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 suitable for implementing an embodiment of the present invention. Figure 7 The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0092] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0093] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0094] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0095] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0096] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a unit, a program segment, or a part of a code, and the above-mentioned unit, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0097] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be arranged in a processor, for example, it may be described as: a processor includes a receiving unit, a generating unit, a calculating unit and a sending unit. The names of these units do not constitute a limitation on the units themselves in some cases, for example, the receiving unit may also be described as a "unit of receiving function".

[0098] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device executes the data processing method provided by the present invention.

[0099] As another aspect, the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the data processing method provided by an embodiment of the present invention.

[0100] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for data processing, characterized in that: include: Receive a preset program running instruction, call each pre-mounted monitoring program, obtain a function set to be monitored in the preset program, and monitor the call information of each function to be monitored in the function set; In response to the call information being triggered, monitoring the stack information and memory access information of the function to be monitored being called, so as to extract the data access address from the stack information, and to generate the data access distribution information of each function to be monitored in combination with the memory access information; Acquiring memory structure information of the preset program, and calling a preset analysis model to calculate the running state of the preset program according to the memory structure information and the data access distribution information; The running status of the preset program and the data access distribution information are sent.

2. The method according to claim 1, characterized in that Extracting data access addresses from the stack information to generate data access distribution information of each function to be monitored in combination with the memory access information, including: For each of the functions to be monitored, extract the data access address from the stack information, generate an address access array according to the access order, obtain the memory slice information to which the data access address belongs, so as to generate a corresponding memory access array; The memory access array is matched with the memory access information to determine data access distribution information according to the matching result.

3. The method according to claim 1, characterized in that Extracting data access addresses from the stack information to generate data access distribution information of each function to be monitored in combination with the memory access information, including: For each of the functions to be monitored, extract the data access address from the stack information, obtain the memory shard information to which the data access address belongs, so as to determine the memory shard range corresponding to the data access address; The memory shard range is matched with the memory access information to determine data access distribution information according to the matching result.

4. The method according to claim 1, characterized in that: Calculating the running state of the preset program according to the memory structure information and the data access distribution information includes: Memory allocation information in the memory structure information is obtained, and abnormal addresses in the data access distribution information that do not belong to the memory allocation information are calculated, so as to determine the running state of the preset program according to the abnormal addresses.

5. The method according to claim 4, characterized in that Calculating the abnormal address in the data access distribution information that does not belong to the memory allocation information includes: The address boundary area in the data access distribution information is calculated according to the preset area size, and the target address information belonging to the address boundary area is determined, and abnormal addresses in the target address information that do not belong to the memory allocation information are screened.

6. The method according to claim 1, characterized in that Calling each pre-mounted monitoring program to obtain a set of functions to be monitored in the preset program, including: Obtaining a hardware stack monitoring program and a memory monitoring program mounted by the preset program; The hardware stack monitoring program and the memory monitoring program are called to obtain a set of functions to be monitored in the preset program.

7. The method according to claim 1, characterized in that After calculating the running state of the preset program according to the memory structure information and the data access distribution information, the method further includes: In response to the running state satisfying a preset condition, a process crash monitoring program associated with the preset program is triggered to monitor abnormal messages of the preset program, and when the abnormal information is triggered, process crash information of the preset program is recorded.

8. A data processing device, characterized in that: include: A receiving unit, used to receive a preset program running instruction, call each pre-mounted monitoring program, obtain a function set to be monitored in the preset program, and monitor the call information of each function to be monitored in the function set; A generating unit, configured to monitor the stack information and memory access information of the function to be monitored when the calling information is triggered, so as to extract the data access address from the stack information, and to generate the data access distribution information of each function to be monitored in combination with the memory access information; A calculation unit, used for obtaining the memory structure information of the preset program for each of the functions to be monitored, and calling a preset analysis model to calculate the running state of the preset program according to the memory structure information and the data access distribution information; The sending unit is used to send the running status of the preset program and the data access distribution information.

9. The device according to claim 8, characterized in that The generating unit is specifically used for: For each of the functions to be monitored, extract the data access address from the stack information, generate an address access array according to the access order, obtain the memory slice information to which the data access address belongs, so as to generate a corresponding memory access array; The memory access array is matched with the memory access information to determine data access distribution information according to the matching result.

10. The device according to claim 8, characterized in that The generating unit is specifically used for: For each of the functions to be monitored, extract the data access address from the stack information, obtain the memory shard information to which the data access address belongs, so as to determine the memory shard range corresponding to the data access address; The memory shard range is matched with the memory access information to determine data access distribution information according to the matching result.

11. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

13. A computer program product, comprising a computer program, characterized in that When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images