Process information display method and device, equipment and medium

Abstract

The invention relates to the technical field of system security, and discloses a process information display method and device, equipment and a medium, and the method comprises the steps: obtaining the total information of all processes on a host, which is regularly collected by an agent terminal; and obtaining increment information collected by the proxy terminal in real time. And when a process query command carrying the timestamp is received, determining target process information matched with the timestamp based on the total information and the increment information of all the processes. And converting the target process information into a process tree, and displaying the process tree through a web interface. The proxy terminal can ensure the integrity of the process information by regularly collecting the full-amount information of all the processes. On the basis, increment information is collected in real time, and the change condition of the process between two times of full-amount information can be obtained. Through the combination of the total information and the increment information, the process information corresponding to any time can be obtained, so that the change between the processes can be traced, the root process of the fault can be positioned, and the fault repair effect is improved.

Description

Technical Field

[0001] The present invention relates to the field of system security technology, and in particular to a method, device, equipment and medium for displaying process information. Background Art

[0002] The process information of the operating system kernel (Linux) plays an important role and is often used in system monitoring, troubleshooting, process management, security analysis, etc. The system command (pstree) to view process information is a commonly used Linux command that is used to display the relationship between processes in a tree structure. When the process tree is needed, the pstree command is generally used to obtain it.

[0003] Since the amount of process information data generated at each time point is huge, and the system's storage and processing capabilities are limited, the system cannot record the process information at each time point in real time. Therefore, the pstree command can only view the current process tree, but not the historical process tree, which often makes it impossible to find the root process that causes the fault, and thus unable to perform targeted repairs.

[0004] It can be seen that how to locate the root process of the fault and improve the effect of fault repair is a problem that technical personnel in this field need to solve. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide a method, device, equipment and medium for displaying process information, which can solve the problem that the root process causing the fault cannot be found and the repair cannot be carried out in a targeted manner.

[0006] In order to solve the above technical problems, an embodiment of the present invention provides a method for displaying process information, which is applicable to a management center. The method includes:

[0007] Get the full information of all processes on the host collected regularly by the proxy terminal;

[0008] Acquire the incremental information collected by the proxy terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the proxy terminal after acquiring the full information of all processes each time; the incremental information of the process determined according to the creation information and end information of the process;

[0009] When receiving a process query command carrying a timestamp, determining target process information matching the timestamp based on the full information of all processes and the incremental information;

[0010] The target process information is converted into a process tree, and the process tree is displayed through a web interface.

[0011] On the one hand, the full amount of information of all processes on the host collected regularly by the proxy terminal includes:

[0012] Receiving user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes process information of all processes on the host that the proxy terminal periodically obtains through a system command to view process information according to a set periodic time;

[0013] Parsing the user space data according to a set full data format to obtain full information of all processes on the host; wherein the full data format includes at least one of a user ID, a process ID, a parent process ID, a process name, and a collection time;

[0014] The full amount information is stored in the first process tree table.

[0015] On the one hand, obtaining the incremental information collected by the agent terminal in real time includes:

[0016] Receiving user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes incremental information obtained by the proxy terminal in real time;

[0017] Parsing the user space data according to a set incremental data format to obtain the incremental information; wherein the incremental data format includes at least one of a user identifier, a process identifier, a parent process identifier, a process name, a change time, and a process type;

[0018] The incremental information is stored in the second process tree change table.

[0019] On the one hand, when a process query command carrying a timestamp is received, based on the full information of all processes and the incremental information, determining the target process information matching the timestamp includes:

[0020] When receiving a process query command carrying a timestamp, querying the first process tree table for a collection time whose value is less than the timestamp;

[0021] Selecting a first collection time with the largest value from the collection times that are smaller than the timestamp;

[0022] Querying the second process tree change table for incremental information between the first collection time and the timestamp;

[0023] Analyzing the process types of the incremental information between the first collection time and the timestamp one by one in chronological order;

[0024] When the process type of the target incremental information is a creation process, adding the target incremental information to the full information corresponding to the first collection time;

[0025] In the case where the process type of the target incremental information is an end process, searching the second process tree change table for a target process identifier of the target incremental information;

[0026] Delete the process information corresponding to the target process identifier from the full information corresponding to the first collection time; and search the first process tree table for the process information to be modified whose parent process identifier is the target process identifier, and modify the parent process identifier of the process information to be modified to the parent process identifier of the target process identifier.

[0027] On the one hand, displaying the process tree through a web interface includes:

[0028] Determining whether the depth of the process tree is greater than a set display level;

[0029] In the case that the depth of the process tree is greater than the set display level, a process tree matching the display level is intercepted from the process tree, and the process tree matching the display level is displayed through a web interface.

[0030] On the one hand, before displaying the process tree through the web interface, it also includes:

[0031] When there is process information with a process name longer than a set length threshold in the process tree, prompt information is added to the process information with a process name longer than the set length threshold, and the process name is displayed in the prompt information.

[0032] On the one hand, before displaying the process tree through the web interface, it also includes:

[0033] When a display command carrying the target process name is obtained, the node position where the target process name is located is queried from the process tree, and the node position is highlighted.

[0034] The embodiment of the present invention also provides a device for displaying process information, which is applicable to a management center, and the device includes a first acquisition unit, a second acquisition unit, a determination unit, a conversion unit, and a display unit;

[0035] The first acquisition unit is used to acquire the full amount of information of all processes on the host collected regularly by the proxy terminal;

[0036] The second acquisition unit is used to acquire the incremental information collected by the proxy terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the proxy terminal after acquiring the full information of all processes each time; the incremental information of the process determined according to the creation information and end information of the process;

[0037] The determining unit is configured to determine, upon receiving a process query command carrying a timestamp, target process information matching the timestamp based on the full information of all processes and the incremental information;

[0038] The conversion unit is used to convert the target process information into a process tree;

[0039] The display unit is used to display the process tree through a web interface.

[0040] An embodiment of the present invention further provides a process information display device, including:

[0041] Memory for storing computer programs;

[0042] A processor is used to execute the computer program to implement the steps of the above-mentioned process information display method.

[0043] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for displaying process information are implemented.

[0044] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned process information display method when executed by a processor.

[0045] It can be seen from the above technical solution that the management center obtains the full information of all processes on the host collected by the proxy terminal at regular intervals; obtains the incremental information collected by the proxy terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the proxy terminal after each acquisition of the full information of all processes; the incremental information of the process is determined based on the creation information and end information of the process. When a process query command carrying a timestamp is received, the target process information matching the timestamp can be determined based on the full information and incremental information of all processes. In order to facilitate users to understand the process information more intuitively, the target process information can be converted into a process tree, and the process tree can be displayed through the web interface.

[0046] The beneficial effect of the present invention is that the proxy terminal can ensure the integrity of the process information by regularly collecting the full information of all processes. Since the full information is collected regularly, it will not cause too much burden on the storage capacity of the system. On the basis of regularly collecting the full information, by collecting incremental information in real time, the changes in the process between two full information can be obtained. Compared with the traditional solution that can only view the current process tree, the present invention can obtain the process information corresponding to any time through the combination of full information and incremental information, so that the changes between processes can be traced, the root process of the fault can be located, and the effect of fault repair is improved. By displaying the process tree, it is convenient for users to locate faults more conveniently. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A flowchart of a method for displaying process information provided by an embodiment of the present invention;

[0049] Figure 2 A flowchart of a method for determining target process information provided by an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of the structure of a device for displaying process information provided by an embodiment of the present invention;

[0051] Figure 4 A structural diagram of a process information display device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] The terms "including" and "having" in the specification of the present invention and the above-mentioned drawings, as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may include steps or units that are not listed.

[0054] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0055] Next, a method for displaying process information provided by an embodiment of the present invention is described in detail. Figure 1 A flowchart of a method for displaying process information provided by an embodiment of the present invention is applicable to a management center. The method includes:

[0056] S101: Obtaining full information of all processes on the host collected periodically by the proxy terminal.

[0057] The full information includes complete information of the process. Since the data volume of the full information is large, if the full information is collected in real time, it will exceed the load capacity of the system. Therefore, in the embodiment of the present invention, the full information of all processes on the host can be collected regularly according to the set cycle time.

[0058] The value of the cycle time can be flexibly set according to actual needs, for example, it can be set to 1 hour.

[0059] In actual applications, the proxy terminal can obtain the process information of all processes on the host regularly according to the set periodic time by viewing the system command of process information, that is, the ps command, and record the process information as user space data in the user space. Among them, the ps command can be in the form of "ps -eo pid, ppid, lstart, comm".

[0060] The user space program can report the recorded user space data to the management center through the Application Programming Interface (API).

[0061] After the management center receives the user space data reported by the agent terminal through the API interface, it can parse the user space data according to the set full data format to obtain the full information of all processes on the host; wherein, the full data format can include at least one of the user ID (id), process ID (pid), parent process ID (ppid), process name (pname) and collection time (time).

[0062] In order to facilitate subsequent query of the full information, after the full information is obtained, the full information may be stored in the first process tree table.

[0063] S102: Acquire incremental information collected by the proxy terminal in real time.

[0064] Since the full information is collected at a scheduled time, each collection can only obtain the full information of all processes at the current collection time, which will lead to the omission of process information between two scheduled collections. Therefore, in an embodiment of the present invention, the proxy terminal can collect incremental information in real time based on the scheduled collection of full information. The incremental information refers to the change information generated by the process.

[0065] In actual applications, after obtaining the full information of all processes each time, the proxy terminal can capture the creation information and end information of the process in real time; based on the creation information and end information of the process, the incremental information of the process can be determined.

[0066] The proxy terminal can hook tracepoints through the ebpf program to capture process creation and termination information. Tracepoints can include at least one of sched_process_exec, sched_process_fork, and sched_process_exit. sched_process_exec and sched_process_fork are triggered when the process executes a new program (such as through execve) and creates a new process (such as through fork or clone), respectively. The sched_process_exit tracepoint is triggered when the process exits (such as calling exit or exit_group).

[0067] sched_process_exec is used to trigger related events when executing the system call execve;

[0068] sched_process_fork is used to be triggered when a process is created. This trace point can be used to monitor and track the creation of the process through specific tools;

[0069] sched_process_exit is used to be triggered when the process exits. This tracepoint can be used to monitor and track the process exit activity through specific tools.

[0070] The proxy terminal can record the collected incremental information as user space data in the user space, and the user space program can report the recorded user space data to the management center through the API interface.

[0071] In the specific implementation, the proxy terminal can define an eBPF Map in the ebpf program to store process creation information. The eBPF Map is used for data exchange between the user space and the kernel space, so that the two spaces can easily share data. The eBPF Map supports multiple data structures, such as Array, Hash, etc., and you can choose the appropriate data structure to store data according to actual needs.

[0072] eBPF Map provides efficient query and update operations, which can quickly find the corresponding value by key. In the specific implementation, the BPF_MAP_TYPE_HASH structure can be used to define the key and value structure. The data in the Map can also be modified through update operations.

[0073] After receiving the user space data reported by the proxy terminal, the management center can parse the user space data according to the set incremental data format to obtain incremental information; wherein the incremental data format can include at least one of user ID, process ID, parent process ID, process name, change time and process type (type). The process type can include at least one of creating a process and ending a process.

[0074] In order to facilitate subsequent query of incremental information, after the incremental information is acquired, the incremental information may be stored in the second process tree change table.

[0075] S103: When a process query command carrying a timestamp is received, target process information matching the timestamp is determined based on full information and incremental information of all processes.

[0076] When the process information needs to be viewed, the administrator can enter a process query command with a timestamp through the user interface. The full information and incremental information contain the time corresponding to each process record, so the matching process information can be queried from the full information and incremental information of all processes based on the timestamp.

[0077] In the embodiment of the present invention, in order to distinguish it from other process information, the process information matching the timestamp may be referred to as target process information.

[0078] S104: Convert the target process information into a process tree, and display the process tree through a web interface.

[0079] In order to intuitively display the correlation between processes, the target process information can be converted into a process tree.

[0080] In actual application, the management center can use a web page drawing plug-in to convert the target process information into a process tree. The web page drawing plug-in can use a d3js component to perform svg drawing through the d3js component to obtain the process tree.

[0081] The d3js component calculates the node position and the size of the overall canvas through a deep traversal algorithm. During the traversal process, the position information of each node needs to be calculated. The maximum horizontal and vertical coordinates that appear during the calculation process are the size of the canvas.

[0082] After determining the size of the overall canvas, the coordinate information of each node can be added to the json object to generate a process node graph. The process node graph can contain at least one of the node name, node position, and color. Using the this.nodes.filter property of the d3js component, the node can be replaced with a designed icon.

[0083] Connect all parent and child nodes of the process node graph. The shape of the line between nodes can be determined based on the returned data and the coordinates of the two points, and connected using a cubic Bezier curve. Bezier curve design control points: Generate control points based on the coordinate positions of the starting point and the end point respectively. A cubic Bezier curve requires two control points. When the starting point is x, y and the end point is a, b, the control point coordinates are x, y, x+15, y+15, a-15, b-15, a, b. Draw a line through path.bezierCurveTo (x, y, x+15, y+15, a-15, b-15, a, b) to get the process tree.

[0084] In order to realize the visualization of process information, the management center can display the process tree through the web interface. The present invention displays the process tree in a graphical way on the web interface, making the originally complex process information intuitive and easy to understand. By analyzing the dependency relationship between processes, users can find the root process that causes the fault and repair it in a targeted manner.

[0085] It can be seen from the above technical solution that the management center obtains the full information of all processes on the host collected by the proxy terminal at regular intervals; obtains the incremental information collected by the proxy terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the proxy terminal after obtaining the full information of all processes each time; the incremental information of the process determined according to the creation information and end information of the process. In the case of receiving a process query command carrying a timestamp, the target process information matching the timestamp can be determined based on the full information and incremental information of all processes. In order to facilitate users to understand the process information more intuitively, the target process information can be converted into a process tree, and the process tree can be displayed through a web interface. The beneficial effect of the present invention is that the proxy terminal can ensure the integrity of the process information by regularly collecting the full information of all processes. Since the full information belongs to regular collection, it will not cause too much burden on the storage capacity of the system. On the basis of regularly collecting the full information, by collecting the incremental information in real time, the changes in the process between two full information can be obtained. Compared with the traditional solution that can only view the current process tree, the present invention can obtain the process information corresponding to any time by combining the full information and incremental information, so as to trace the changes between processes and locate the root process of the fault, thus improving the effect of fault repair. By displaying the process tree, it is convenient for users to locate the fault more conveniently.

[0086] Figure 2 A flowchart of a method for determining target process information provided by an embodiment of the present invention, the method comprising:

[0087] S201: When a process query command carrying a timestamp is received, a collection time whose value is less than the timestamp is searched from a first process tree table.

[0088] The first process tree table records the full information of all processes, and each full information contains the corresponding collection time. When a process query command carrying a timestamp is received, in order to obtain the process information corresponding to the timestamp, it is necessary to first determine the full information before the timestamp, so the collection time with a value less than the timestamp can be queried from the first process tree table.

[0089] S202: Select a first collection time with the largest value from the collection times that are smaller than the timestamp.

[0090] Considering that there may be multiple collection times smaller than the timestamp, only the collection time closest to the timestamp is the basis for determining the process information corresponding to the timestamp. Therefore, the first collection time with the largest value can be selected from the collection times smaller than the timestamp.

[0091] Assuming that the full information is recorded every hour starting from 0:00, the first process tree table records the full information corresponding to each hour. If you want to query the process information corresponding to 10:30, the first collection time with the largest value among the collection times less than 10:30 is 10:00.

[0092] S203: Query the second process tree change table for incremental information between the first collection time and the timestamp.

[0093] Considering that there is often a time difference between the first collection time and the timestamp, if the incremental information corresponding to the time difference can be obtained, the target process information corresponding to the timestamp can be obtained by integrating the incremental information corresponding to the time difference with the full information corresponding to the first search time. Therefore, after selecting the first collection time, the incremental information between the first collection time and the timestamp can be queried from the second process tree change table.

[0094] In combination with the above example, assuming that the timestamp is 10:30 and the first collection time is 10:00, the incremental information between 10:00 and 10:30 can be queried from the second process tree change table.

[0095] S204: Analyze the process types of the incremental information between the first collection time and the timestamp one by one in chronological order.

[0096] The process type of the incremental information may include at least one of creating a process (creat) and ending a process (exit). For incremental information of different process types, the way of integrating it with the full information may be different. Therefore, when the process type of the incremental information is creating a process, the operation of S205 may be performed. When the process type of the target incremental information is ending a process, the operations of S206 and S207 may be performed.

[0097] S205: When the process type of the target incremental information is a creation process, the target incremental information is added to the full information corresponding to the first collection time.

[0098] When the process type of the target incremental information is a creation process, the target incremental information may be directly added to the full information corresponding to the first collection time, that is, a process record may be added.

[0099] S206: When the process type of the target incremental information is an end process, searching the second process tree change table for a target process identifier of the target incremental information.

[0100] In the case where the process type of the target incremental information is an end process, it indicates that the process information corresponding to the target incremental information does not need to be stored. In the embodiment of the present invention, different processes can be distinguished according to process identifiers. Therefore, in order to locate the position of the process information in the first process tree table, the target process identifier of the target incremental information can be first searched from the second process tree change table.

[0101] S207: Delete the process information corresponding to the target process identifier from the full information corresponding to the first collection time; and search the first process tree table for the process information to be modified whose parent process identifier is the target process identifier, and modify the parent process identifier of the process information to be modified to the parent process identifier of the target process identifier.

[0102] After determining the target process identifier, the process information corresponding to the target process identifier can be deleted from the full information corresponding to the first collection time. In order to ensure the continuity between the remaining processes in the first process tree table, it is necessary to search the first process tree table for the process information to be modified whose parent process identifier is the target process identifier, and modify the parent process identifier of the process information to be modified to the parent process identifier of the target process identifier.

[0103] For example, the data structure of the first process tree table is {id, pid, ppid, pname, time}, assuming that it contains data {1, 1, null, init, 2024 / 01 / 02-00:00:00} {2, 23, 1, cat, 2024 / 01 / 02-00:00:00} {3, 24, 23, ls, 2024 / 01 / 02-00:00:00}. The data structure of the second process tree change table is {id, pid, ppid, pname, time, type}, which contains data {1, 100, 24, nmap, 2024 / 01 / 02-00:00:05, creat} {1, 23, 1, ls, 2024 / 01 / 02-00:00:08, exit}. Then the system process tree at 2024 / 01 / 02-00:00:08 is to first add the process with pid 100, then delete the process with pid 23, and set the parent process of the process with ppid 23 to the parent process 1 of process 23. The final result is: {1, 1, null, init, 2024 / 01 / 02-00:00:00} {3, 24, 1, ls, 2024 / 01 / 02-00:00:00} {1, 100, 24, nmap, 2024 / 01 / 02-00:00:05}.

[0104] In an embodiment of the present invention, when a process query command carrying a timestamp is received, a collection time with a value less than the timestamp is queried from the first process tree table. The first collection time with the largest value is selected from the collection time less than the timestamp. The incremental information between the first collection time and the timestamp is queried from the second process tree change table. The process types of the incremental information between the first collection time and the timestamp are analyzed one by one in chronological order. When the process type of the target incremental information is a creation process, the target incremental information is added to the full information corresponding to the first collection time. When the process type of the target incremental information is an end process, the target process identifier of the target incremental information is searched from the second process tree change table; the process information corresponding to the target process identifier is deleted from the full information corresponding to the first collection time; and the process information to be modified whose parent process identifier is the target process identifier is searched from the first process tree table, and the parent process identifier of the process information to be modified is modified to the parent process identifier of the target process identifier. By comparing the collection time corresponding to the process information in the first process tree table with the timestamp, the full information corresponding to the first collection time that is less than the timestamp and has the largest value can be obtained. By obtaining the incremental information between the first collection time and the timestamp, the full information is updated based on the process type of the incremental information, so that the process information corresponding to the timestamp can be obtained. According to this implementation method, the process information corresponding to any timestamp can be obtained.

[0105] The process tree is presented in a hierarchical manner. When administrators need to query whether a fixed level contains a specific process, they usually only need to trace a limited number of levels through the root process.

[0106] Therefore, when displaying the process tree through the web interface, in order to control the displayed level, it can be determined whether the depth of the process tree is greater than the set display level. In the case where the depth of the process tree is greater than the set display level, the process tree matching the display level can be directly intercepted from the process tree, and the process tree matching the display level can be displayed through the web interface.

[0107] Loading a complete process tree on a web interface will bring about a large performance overhead. In an embodiment of the present invention, by controlling the display level of the process tree, the performance overhead generated by displaying the process tree on the web interface can be effectively reduced.

[0108] Considering that when displaying the process tree through the web interface, the process name contained in the process tree is often displayed in only one line, with a maximum of 10 characters, there is a problem that the process name is too long to be fully displayed. Therefore, when there is process information with a process name longer than the set length threshold in the process tree, a prompt message can be added to the process information with a process name longer than the set length threshold, and the process name can be displayed in the prompt message.

[0109] In the embodiment of the present invention, by adding prompt information, the length of the process name can be unlimited, and the floating display of the process name can be achieved.

[0110] In order to facilitate users to locate the desired process information more quickly, when a display command carrying the target process name is obtained, the node position where the target process name is located can be queried from the process tree and the node position can be highlighted.

[0111] In an embodiment of the present invention, in addition to querying the process information corresponding to the timestamp, the management center can also query all change information of a process within a period of time. In the second process tree change table, all process records are queried according to the process name, and the queried process records are sorted by time and passed to the web interface. The web interface can display the process creation and end information within the period of time on a timeline.

[0112] For different types of proxy terminals, the amount of process information data generated in the same time is different, so in the embodiment of the present invention, a correspondence between different proxy terminals and their corresponding cycle times can be established in advance. After determining the current proxy terminal, querying the correspondence can determine the cycle time that matches the current proxy terminal, so as to collect the full amount of information of all processes on the host according to the cycle time.

[0113] In an embodiment of the present invention, by considering the amount of data of process information generated by different proxy terminals, a corresponding cycle time can be set so that the value of the cycle time is more in line with the actual performance of the proxy terminal, avoiding the situation where the cycle time is set too long or too short, resulting in too much or too little data of the full amount of information collected.

[0114] Figure 3 A schematic diagram of the structure of a display device for process information provided by an embodiment of the present invention, which is applicable to a management center, includes a first acquisition unit 31, a second acquisition unit 32, a determination unit 33, a conversion unit 34 and a display unit 35;

[0115] The first acquisition unit 31 is used to acquire the full amount of information of all processes on the host collected regularly by the proxy terminal;

[0116] The second acquisition unit 32 is used to acquire the incremental information collected by the proxy terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the proxy terminal after acquiring the full information of all processes each time; the incremental information of the process determined according to the creation information and end information of the process;

[0117] The determination unit 33 is used to determine the target process information matching the timestamp based on the full information and incremental information of all processes when receiving the process query command carrying the timestamp;

[0118] A conversion unit 34, used to convert the target process information into a process tree;

[0119] The display unit 35 is used to display the process tree through a web interface.

[0120] In some embodiments, the first acquisition unit includes a first receiving subunit, a first parsing subunit, and a first storage subunit;

[0121] The first receiving subunit is used to receive user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes process information of all processes on the host that the proxy terminal obtains regularly through a ps command according to a set periodic time;

[0122] The first parsing subunit is used to parse the user space data according to the set full data format to obtain the full information of all processes on the host; wherein the full data format includes at least one of a user ID, a process ID, a parent process ID, a process name and a collection time;

[0123] The first storage subunit is used to store the full amount of information in the first process tree table.

[0124] In some embodiments, the second acquisition unit includes a second receiving subunit, a second parsing subunit, and a second storage subunit;

[0125] A second receiving subunit is used to receive user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes incremental information obtained by the proxy terminal in real time;

[0126] The second parsing subunit is used to parse the user space data according to the set incremental data format to obtain incremental information; wherein the incremental data format includes at least one of a user identifier, a process identifier, a parent process identifier, a process name, a change time and a process type;

[0127] The second storage subunit is used to store the incremental information in the second process tree change table.

[0128] In some embodiments, the determination unit includes a first query subunit, a selection subunit, a second query subunit, an analysis subunit, an addition subunit, a search subunit, a deletion subunit, and a modification subunit;

[0129] A first query subunit is used to query the collection time whose value is less than the timestamp from the first process tree table when receiving a process query command carrying a timestamp;

[0130] A selection subunit, used to select a first collection time with the largest value from the collection times that are smaller than the timestamp;

[0131] A second query subunit is used to query the incremental information between the first collection time and the timestamp from the second process tree change table;

[0132] An analysis subunit, for analyzing the process type of the incremental information between the first collection time and the timestamp one by one in chronological order;

[0133] An adding subunit is used to add target incremental information to the full information corresponding to the first collection time when the process type of the target incremental information is a creation process;

[0134] A search subunit, configured to search the target process identifier of the target incremental information from the second process tree change table when the process type of the target incremental information is an end process;

[0135] A deletion subunit, used to delete the process information corresponding to the target process identifier from the full amount of information corresponding to the first collection time;

[0136] The modifying subunit is used to search the to-be-modified process information whose parent process identifier is the target process identifier from the first process tree table, and modify the parent process identifier of the to-be-modified process information to the parent process identifier of the target process identifier.

[0137] In some embodiments, the display unit includes a determination subunit and an interception subunit;

[0138] The judgment subunit is used to judge whether the depth of the process tree is greater than the set display level;

[0139] The interception subunit is used to intercept the process tree matching the display level from the process tree when the depth of the process tree is greater than the set display level, and display the process tree matching the display level through the web interface.

[0140] In some embodiments, further comprising an adding unit;

[0141] The adding unit is used to add prompt information to the process information whose process name is greater than the set length threshold when there is process information whose process name is greater than the set length threshold in the process tree, and display the process name in the prompt information.

[0142] In some embodiments, a highlight display unit is also included;

[0143] The highlight display unit is used to query the node position where the target process name is located from the process tree when a display command carrying the target process name is obtained, and highlight the node position.

[0144] Figure 3 The description of the features in the corresponding embodiments can be found in Figure 1 The relevant descriptions of the corresponding embodiments will not be repeated here one by one.

[0145] It can be seen from the above technical solution that the management center obtains the full information of all processes on the host collected by the proxy terminal at regular intervals; obtains the incremental information collected by the proxy terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the proxy terminal after obtaining the full information of all processes each time; the incremental information of the process determined according to the creation information and end information of the process. In the case of receiving a process query command carrying a timestamp, the target process information matching the timestamp can be determined based on the full information and incremental information of all processes. In order to facilitate users to understand the process information more intuitively, the target process information can be converted into a process tree, and the process tree can be displayed through a web interface. The beneficial effect of the present invention is that the proxy terminal can ensure the integrity of the process information by regularly collecting the full information of all processes. Since the full information belongs to regular collection, it will not cause too much burden on the storage capacity of the system. On the basis of regularly collecting the full information, by collecting the incremental information in real time, the changes in the process between two full information can be obtained. Compared with the traditional solution that can only view the current process tree, the present invention can obtain the process information corresponding to any time by combining the full information and incremental information, so as to trace the changes between processes and locate the root process of the fault, thus improving the effect of fault repair. By displaying the process tree, it is convenient for users to locate the fault more conveniently.

[0146] Figure 4 A structural diagram of a process information display device provided by an embodiment of the present invention, such as Figure 4 As shown, the display device of process information includes: a memory 40 for storing computer programs;

[0147] The processor 41 is used to implement the steps of the method for displaying process information in the above embodiment when executing a computer program.

[0148] The display device of the process information provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer or a desktop computer.

[0149] Among them, the processor 41 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 41 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 41 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 41 may be integrated with a graphics processing unit (GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 41 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0150] The memory 40 may include one or more computer-readable storage media, which may be non-transitory. The memory 40 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 40 is at least used to store the following computer program 401, wherein, after the computer program is loaded and executed by the processor 41, it can implement the relevant steps of the method for displaying process information disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 40 may also include an operating system 402 and data 403, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 402 may include Windows, Unix, Linux, etc. Data 403 may include but is not limited to full information, incremental information, etc.

[0151] In some embodiments, the display device for process information may also include a display screen 42 , an input / output interface 43 , a communication interface 44 , a power supply 45 , and a communication bus 46 .

[0152] Those skilled in the art will understand that Figure 4 The structure shown in the figure does not constitute a limitation on the display device of process information, and may include more or fewer components than those shown in the figure.

[0153] It is understandable that if the display method of process information in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the current technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk or optical disk and other media that can store program codes.

[0154] Based on this, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for displaying process information are implemented.

[0155] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned process information display method when executed by a processor.

[0156] The above is a detailed introduction to a method, device, equipment, computer-readable storage medium and computer program product for displaying process information provided by an embodiment of the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0157] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0158] The above is a detailed introduction to a method, device, equipment, computer-readable storage medium and computer program product for displaying process information provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A method for displaying process information, characterized in that: Applicable to a management center, the method includes: Get the full information of all processes on the host collected regularly by the proxy terminal; Acquire the incremental information collected by the proxy terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the proxy terminal after acquiring the full information of all processes each time; the incremental information of the process determined according to the creation information and end information of the process; When receiving a process query command carrying a timestamp, determining target process information matching the timestamp based on the full information of all processes and the incremental information; The target process information is converted into a process tree, and the process tree is displayed through a web interface.

2. The method for displaying process information according to claim 1, characterized in that: The full amount of information of all processes on the host collected by the proxy terminal periodically includes: Receiving user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes process information of all processes on the host that the proxy terminal periodically obtains through a system command to view process information according to a set periodic time; Parsing the user space data according to a set full data format to obtain full information of all processes on the host; wherein the full data format includes at least one of a user ID, a process ID, a parent process ID, a process name, and a collection time; The full amount information is stored in the first process tree table.

3. The method for displaying process information according to claim 2, characterized in that: Acquiring the incremental information collected by the proxy terminal in real time includes: Receiving user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes incremental information obtained by the proxy terminal in real time; Parsing the user space data according to a set incremental data format to obtain the incremental information; wherein the incremental data format includes at least one of a user identifier, a process identifier, a parent process identifier, a process name, a change time, and a process type; The incremental information is stored in the second process tree change table.

4. The method for displaying process information according to claim 3, characterized in that: In the case of receiving a process query command carrying a timestamp, determining target process information matching the timestamp based on the full information of all processes and the incremental information includes: When receiving a process query command carrying a timestamp, querying the first process tree table for a collection time whose value is less than the timestamp; Selecting a first collection time with the largest value from the collection times that are smaller than the timestamp; Querying the second process tree change table for incremental information between the first collection time and the timestamp; Analyzing the process types of the incremental information between the first collection time and the timestamp one by one in chronological order; When the process type of the target incremental information is a creation process, adding the target incremental information to the full information corresponding to the first collection time; In the case where the process type of the target incremental information is an end process, searching the second process tree change table for a target process identifier of the target incremental information; Delete the process information corresponding to the target process identifier from the full information corresponding to the first collection time; and search the first process tree table for the process information to be modified whose parent process identifier is the target process identifier, and modify the parent process identifier of the process information to be modified to the parent process identifier of the target process identifier.

5. The method for displaying process information according to any one of claims 1 to 4, characterized in that: Displaying the process tree through the web interface includes: Determining whether the depth of the process tree is greater than a set display level; In the case that the depth of the process tree is greater than the set display level, a process tree matching the display level is intercepted from the process tree, and the process tree matching the display level is displayed through a web interface.

6. The method for displaying process information according to claim 1, characterized in that: Before displaying the process tree through the web interface, it also includes: When there is process information with a process name longer than a set length threshold in the process tree, prompt information is added to the process information with a process name longer than the set length threshold, and the process name is displayed in the prompt information.

7. The method for displaying process information according to claim 1, characterized in that: Before displaying the process tree through the web interface, it also includes: When a display command carrying the target process name is obtained, the node position where the target process name is located is queried from the process tree, and the node position is highlighted.

8. A device for displaying process information, characterized in that: Applicable to a management center, the device comprises a first acquisition unit, a second acquisition unit, a determination unit, a conversion unit and a display unit; The first acquisition unit is used to acquire the full amount of information of all processes on the host collected regularly by the proxy terminal; The second acquisition unit is used to acquire the incremental information collected by the proxy terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the proxy terminal after acquiring the full information of all processes each time; the incremental information of the process determined according to the creation information and end information of the process; The determining unit is configured to determine, upon receiving a process query command carrying a timestamp, target process information matching the timestamp based on the full information of all processes and the incremental information; The conversion unit is used to convert the target process information into a process tree; The display unit is used to display the process tree through a web interface.

9. A device for displaying process information, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the method for displaying process information as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for displaying process information according to any one of claims 1 to 7 are implemented.

Images