A method, device, equipment and medium for displaying process information

Abstract

The present invention relates to the field of system security technology, and discloses a method, apparatus, device and medium for displaying process information, which obtains the full information of all processes on a host computer collected periodically by an agent terminal; and obtains the incremental information collected in real time by the agent terminal. When a process query command carrying a timestamp is received, the target process information that matches the timestamp is determined based on the full information and incremental information of all processes. The target process information is converted into a process tree, and the process tree is displayed through a web interface. The agent terminal can ensure the integrity of the process information by regularly collecting the full information of all processes. On this basis, by collecting incremental information in real time, the changes in the process between two full information can be obtained. By combining the full information and incremental information, the process information corresponding to any time can be obtained, so that the changes between processes can be traced, the root process of the fault can be located, and the effect of fault repair can be improved.

Description

Technical Field

[0001] The present invention relates to the field of system security technology, and in particular to a method, device, equipment and medium for displaying process information. Background Art

[0002] Process information within the Linux operating system kernel plays an important role and is often used in system monitoring, troubleshooting, process management, and security analysis. The system command (pstree) for viewing process information is a common Linux command that displays process relationships in a tree-like structure. The pstree command is typically used to obtain the process tree.

[0003] Due to the massive amount of process information generated at each point in time and the limited storage and processing capabilities of the system, the system cannot record process information at each point in time in real time. Therefore, the pstree command can only view the current process tree, not the historical process tree. This often makes it difficult to find the root cause of the problem and thus unable to perform targeted repairs.

[0004] It can be seen that how to locate the root cause process of the fault and improve the effect of fault repair is a problem that technical personnel in this field need to solve. Summary of the Invention

[0005] The purpose of the embodiments of the present invention is to provide a method, apparatus, device and medium for displaying process information, which can solve the problem of being unable to find the root process causing the fault and unable to perform targeted repairs.

[0006] To solve the above technical problems, an embodiment of the present invention provides a method for displaying process information, which is applicable to a management center. The method includes:

[0007] Obtain the full information of all processes on the host collected periodically by the agent terminal;

[0008] Acquiring incremental information collected in real time by the agent terminal; wherein the incremental information is the creation information and termination information of the process captured in real time by the agent terminal after acquiring the full information of all processes each time; the incremental information of the process determined based on the creation information and termination information of the process;

[0009] When a process query command carrying a timestamp is received, target process information matching the timestamp is determined based on the full information of all processes and the incremental information;

[0010] The target process information is converted into a process tree, and the process tree is displayed through a web interface.

[0011] On the one hand, the full amount of information of all processes on the host collected by the agent terminal periodically includes:

[0012] Receiving user space data reported by the agent terminal through an application programming interface; wherein the user space data includes process information of all processes on the host that is regularly obtained by the agent terminal according to a set periodic time through a system command to view process information;

[0013] Parsing the user space data according to a set full data format to obtain full information of all processes on the host; wherein the full data format includes at least one of a user ID, a process ID, a parent process ID, a process name, and a collection time;

[0014] The full amount information is stored in the first process tree table.

[0015] On the one hand, obtaining the incremental information collected by the agent terminal in real time includes:

[0016] Receiving user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes incremental information obtained by the proxy terminal in real time;

[0017] Parsing the user space data according to a set incremental data format to obtain the incremental information; wherein the incremental data format includes at least one of a user identifier, a process identifier, a parent process identifier, a process name, a change time, and a process type;

[0018] The incremental information is stored in the second process tree change table.

[0019] On the one hand, when a process query command carrying a timestamp is received, based on the full information of all processes and the incremental information, determining the target process information that matches the timestamp includes:

[0020] When a process query command carrying a timestamp is received, querying the first process tree table for a collection time whose value is less than the timestamp;

[0021] Selecting a first collection time with the largest value from the collection times that are smaller than the timestamp;

[0022] querying the second process tree change table for incremental information between the first collection time and the timestamp;

[0023] Analyzing the process types of the incremental information between the first collection time and the timestamp one by one in chronological order;

[0024] When the process type of the target incremental information is a creation process, adding the target incremental information to the full information corresponding to the first collection time;

[0025] In a case where the process type of the target incremental information is an end process, searching the second process tree change table for a target process identifier of the target incremental information;

[0026] Delete the process information corresponding to the target process identifier from the full information corresponding to the first collection time; and search the first process tree table for the process information to be modified whose parent process identifier is the target process identifier, and modify the parent process identifier of the process information to be modified to the parent process identifier of the target process identifier.

[0027] On the one hand, displaying the process tree through a web interface includes:

[0028] Determining whether the depth of the process tree is greater than a set display level;

[0029] In the case that the depth of the process tree is greater than the set display level, a process tree matching the display level is intercepted from the process tree, and the process tree matching the display level is displayed through a web interface.

[0030] On the one hand, before displaying the process tree through the web interface, it also includes:

[0031] When process information having a process name longer than a set length threshold exists in the process tree, prompt information is added to the process information having a process name longer than the set length threshold, and the process name is displayed in the prompt information.

[0032] On the one hand, before displaying the process tree through the web interface, it also includes:

[0033] When a display command carrying the target process name is obtained, the node position where the target process name is located is queried from the process tree, and the node position is highlighted.

[0034] An embodiment of the present invention further provides a process information display device, which is applicable to a management center. The device includes a first acquisition unit, a second acquisition unit, a determination unit, a conversion unit, and a display unit.

[0035] The first acquisition unit is used to obtain the full amount of information of all processes on the host collected regularly by the agent terminal;

[0036] The second acquisition unit is configured to acquire incremental information collected in real time by the agent terminal; wherein the incremental information is the creation information and termination information of the process captured in real time by the agent terminal after acquiring the full information of all processes each time; and the incremental information of the process determined based on the creation information and termination information of the process;

[0037] The determining unit is configured to, upon receiving a process query command carrying a timestamp, determine target process information matching the timestamp based on the full information of all processes and the incremental information;

[0038] The conversion unit is configured to convert the target process information into a process tree;

[0039] The display unit is used to display the process tree through a web interface.

[0040] An embodiment of the present invention further provides a device for displaying process information, including:

[0041] memory for storing computer programs;

[0042] A processor is used to execute the computer program to implement the steps of the above-mentioned method for displaying process information.

[0043] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for displaying process information are implemented.

[0044] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned process information display method when executed by a processor.

[0045] As can be seen from the above technical solution, the management center obtains the full information of all processes on the host collected periodically by the agent terminal; obtains the incremental information collected in real time by the agent terminal; wherein the incremental information is the creation information and end information of the process captured in real time by the agent terminal each time the full information of all processes is obtained; and the incremental information of the process is determined based on the creation information and end information of the process. When a process query command carrying a timestamp is received, the target process information that matches the timestamp can be determined based on the full information and incremental information of all processes. In order to facilitate users to understand the process information more intuitively, the target process information can be converted into a process tree, and the process tree can be displayed through the web interface.

[0046] The beneficial effect of the present invention is that the agent terminal can ensure the integrity of the process information by regularly collecting full information of all processes. Since the full information is collected regularly, it will not cause too much burden on the storage capacity of the system. On the basis of regularly collecting full information, by collecting incremental information in real time, the changes in the process between two full information can be obtained. Compared with the traditional solution that can only view the current process tree, the present invention can obtain the process information corresponding to any time through the combination of full information and incremental information, so that the changes between processes can be traced, the root process of the fault can be located, and the effect of fault repair can be improved. By displaying the process tree, it is convenient for users to locate faults more conveniently. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0048] Figure 1 A flowchart of a method for displaying process information provided by an embodiment of the present invention;

[0049] Figure 2 A flowchart of a method for determining target process information provided by an embodiment of the present invention;

[0050] Figure 3 A schematic structural diagram of a device for displaying process information provided by an embodiment of the present invention;

[0051] Figure 4 This is a structural diagram of a process information display device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0053] The terms "including" and "having," as used in the present description and accompanying drawings, and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements and may include steps or elements that are not listed.

[0054] In order to enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0055] Next, a method for displaying process information provided by an embodiment of the present invention is described in detail. Figure 1 A flowchart of a method for displaying process information provided by an embodiment of the present invention is applicable to a management center. The method includes:

[0056] S101: Obtaining full information of all processes on the host collected periodically by the agent terminal.

[0057] The full information includes complete information about the process. Since the full information has a large amount of data, if the full information is collected in real time, it will exceed the system load capacity. Therefore, in this embodiment of the present invention, the full information of all processes on the host can be collected regularly according to a set periodic time.

[0058] The value of the cycle time can be flexibly set according to actual needs, for example, it can be set to 1 hour.

[0059] In actual applications, the proxy terminal can periodically obtain process information of all processes on the host using the system command ps, which is used to view process information, at a set periodic interval and record the process information as user space data in the user space. The ps command can be in the form of "ps -eo pid, ppid, lstart, comm".

[0060] User space programs can report recorded user space data to the management center through the Application Programming Interface (API).

[0061] After the management center receives the user space data reported by the agent terminal through the API interface, it can parse the user space data according to the set full data format to obtain the full information of all processes on the host; among them, the full data format can include at least one of the user ID (id), process ID (pid), parent process ID (ppid), process name (pname) and collection time (time).

[0062] In order to facilitate subsequent query of the full information, after the full information is obtained, the full information may be stored in the first process tree table.

[0063] S102: Acquire incremental information collected by the agent terminal in real time.

[0064] Because full information is collected periodically, each collection only captures full information for all processes at the current collection time, which can result in missing process information between two scheduled collections. Therefore, in an embodiment of the present invention, the agent terminal can collect incremental information in real time, based on the scheduled full information collection. Incremental information refers to the changes generated by the process.

[0065] In actual applications, after obtaining the full information of all processes each time, the proxy terminal can capture the creation information and end information of the process in real time; based on the creation information and end information of the process, the incremental information of the process is determined.

[0066] The proxy terminal can hook tracepoints through the eBPF program to capture process creation and termination information. Tracepoints can include at least one of sched_process_exec, sched_process_fork, and sched_process_exit. sched_process_exec and sched_process_fork are triggered when a process executes a new program (e.g., via execve) or creates a new process (e.g., via fork or clone), respectively. The sched_process_exit tracepoint is triggered when a process exits (e.g., by calling exit or exit_group).

[0067] sched_process_exec is used to trigger related events when executing the system call execve;

[0068] sched_process_fork is used to be triggered when a process is created. This tracepoint can be used to monitor and track process creation activities through specific tools.

[0069] sched_process_exit is used to be triggered when the process exits. This tracepoint can be used to monitor and track the process exit activity through specific tools.

[0070] The agent terminal can record the collected incremental information as user space data in the user space, and the user space program can report the recorded user space data to the management center through the API interface.

[0071] In a specific implementation, the proxy terminal can define an eBPF map in the eBPF program to store process creation information. The eBPF map is used for data exchange between user space and kernel space, allowing the two spaces to easily share data. The eBPF map supports multiple data structures, such as arrays and hashes, and the appropriate data structure can be selected based on actual needs.

[0072] eBPF Map provides efficient query and update operations, which can quickly find the corresponding value by key. In the specific implementation, the BPF_MAP_TYPE_HASH structure can be used to define the key and value structure. The data in the Map can also be modified through update operations.

[0073] After receiving the user space data reported by the agent terminal, the management center can parse the user space data according to the set incremental data format to obtain incremental information; wherein the incremental data format can include at least one of a user ID, a process ID, a parent process ID, a process name, a change time, and a process type (type). The process type can include at least one of a creation process and an end process.

[0074] In order to facilitate subsequent query of incremental information, after the incremental information is obtained, the incremental information may be stored in the second process tree change table.

[0075] S103: When a process query command carrying a timestamp is received, target process information matching the timestamp is determined based on the full information and incremental information of all processes.

[0076] To view process information, administrators can enter a process query command with a timestamp through the user interface. Both the full and incremental information contain the time corresponding to each process record. This timestamp allows users to query matching process information from all full and incremental information for all processes.

[0077] In the embodiment of the present invention, in order to distinguish it from other process information, the process information matching the timestamp may be referred to as target process information.

[0078] S104: Convert the target process information into a process tree, and display the process tree through a web interface.

[0079] In order to intuitively display the correlation between processes, the target process information can be converted into a process tree.

[0080] In actual application, the management center can use a web page drawing plug-in to convert the target process information into a process tree. The web page drawing plug-in can use a d3js component to perform svg drawing to obtain the process tree.

[0081] The d3js component calculates the node position and the overall canvas size through a deep traversal algorithm. During the traversal process, the position information of each node needs to be calculated. The maximum horizontal and vertical coordinates that appear during the calculation process are the size of the canvas.

[0082] After determining the overall canvas size, you can add the coordinates of each node to a JSON object to generate a process node diagram. This diagram should contain at least one of the following: node name, node position, and color. Using the D3JS component's this.nodes.filter property, you can replace nodes with designed icons.

[0083] Connect all parent and child nodes in the process node graph. The shape of the lines between nodes can be determined based on the returned data and the coordinates of the two points, using cubic Bezier curves. Bezier curve control points: Generate control points based on the coordinates of the start and end points. A cubic Bezier curve requires two control points. When the starting point is x, y and the end points are a, b, the control point coordinates are x, y, x+15, y+15, a-15, b-15, a, b. Use path.bezierCurveTo(x, y, x+15, y+15, a-15, b-15, a, b) to draw the lines, thus forming the process tree.

[0084] To visualize process information, the management center can display a process tree through a web interface. This presents a graphical representation of the process tree on the web interface, making the originally complex process information intuitive and easy to understand. By analyzing the dependencies between processes, users can find the root cause of the fault and perform targeted repairs.

[0085] It can be seen from the above technical solution that the management center obtains the full information of all processes on the host collected by the agent terminal at regular intervals; obtains the incremental information collected by the agent terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the agent terminal each time the full information of all processes is obtained; and the incremental information of the process is determined based on the creation information and end information of the process. When a process query command carrying a timestamp is received, the target process information matching the timestamp can be determined based on the full information and incremental information of all processes. In order to facilitate users to understand the process information more intuitively, the target process information can be converted into a process tree, and the process tree can be displayed through a web interface. The beneficial effect of the present invention is that the agent terminal can ensure the integrity of the process information by regularly collecting the full information of all processes. Since the full information is collected at regular intervals, it will not cause too much burden on the storage capacity of the system. On the basis of regularly collecting the full information, by collecting the incremental information in real time, the changes in the process between the two full information can be obtained. Compared to traditional solutions that only allow viewing the current process tree, this invention combines full and incremental information to obtain process information corresponding to any time. This allows tracing changes between processes and locating the root cause of the fault, improving the effectiveness of fault repair. By displaying the process tree, users can more easily locate faults.

[0086] Figure 2 A flowchart of a method for determining target process information provided by an embodiment of the present invention, the method comprising:

[0087] S201: When a process query command carrying a timestamp is received, a collection time whose value is less than the timestamp is searched from a first process tree table.

[0088] The first process tree table records the full information of all processes, each of which includes the corresponding collection time. When receiving a process query command with a timestamp, in order to obtain the process information corresponding to the timestamp, it is necessary to first determine the full information before the timestamp. Therefore, the first process tree table can be queried for collection times less than the timestamp.

[0089] S202: Select a first collection time with the largest value from the collection times that are smaller than the timestamp.

[0090] Considering that there may be multiple collection times smaller than the timestamp, only the collection time closest to the timestamp is the basis for determining the process information corresponding to the timestamp. Therefore, the first collection time with the largest value can be selected from the collection times smaller than the timestamp.

[0091] Assuming that full information is recorded every hour starting at midnight, the first process tree table records the full information corresponding to each hour. If you want to query the process information corresponding to 10:30, the first collection time with the largest value among the collection times less than 10:30 is 10:00.

[0092] S203: Query the second process tree change table for incremental information between the first collection time and the timestamp.

[0093] Considering that there is often a time difference between the first collection time and the timestamp, if the incremental information corresponding to this time difference can be obtained, the target process information corresponding to the timestamp can be obtained by fusing this incremental information with the full information corresponding to the first search time. Therefore, after selecting the first collection time, the incremental information between the first collection time and the timestamp can be queried from the second process tree change table.

[0094] In combination with the above example, assuming that the timestamp is 10:30 and the first collection time is 10:00, the incremental information between 10:00 and 10:30 can be queried from the second process tree change table.

[0095] S204: Analyze the process types of the incremental information between the first collection time and the timestamp one by one in chronological order.

[0096] The process type of the incremental information can include at least one of create process (creat) and exit process (exit). The method of integrating incremental information with the full information varies depending on the process type. Therefore, if the process type of the incremental information is create process, S205 can be performed. If the process type of the target incremental information is exit process, S206 and S207 can be performed.

[0097] S205: When the process type of the target incremental information is a creation process, the target incremental information is added to the full information corresponding to the first collection time.

[0098] When the process type of the target incremental information is a creation process, the target incremental information can be directly added to the full information corresponding to the first collection time, that is, a process record is added.

[0099] S206: When the process type of the target incremental information is an end process, the target process identifier of the target incremental information is searched from the second process tree change table.

[0100] If the process type of the target incremental information is an ended process, it indicates that the process information corresponding to the target incremental information does not need to be stored. In this embodiment of the present invention, different processes can be distinguished based on process identifiers. Therefore, in order to locate the position of the process information in the first process tree table, the target process identifier of the target incremental information can be first searched in the second process tree change table.

[0101] S207: Delete the process information corresponding to the target process identifier from the full information corresponding to the first collection time; and search the first process tree table for the process information to be modified whose parent process identifier is the target process identifier, and modify the parent process identifier of the process information to be modified to the parent process identifier of the target process identifier.

[0102] After determining the target process identifier, the process information corresponding to the target process identifier can be deleted from the full information corresponding to the first collection time. In order to ensure the continuity between the remaining processes in the first process tree table, it is necessary to search the first process tree table for the process information to be modified whose parent process identifier is the target process identifier, and modify the parent process identifier of the process information to be modified to the parent process identifier of the target process identifier.

[0103] For example, the data structure of the first process tree table is {id, pid, ppid, pname, time}, assuming it contains the data {1, 1, null, init, 2024 / 01 / 02-00:00:00} {2, 23, 1, cat, 2024 / 01 / 02-00:00:00} {3, 24, 23, ls, 2024 / 01 / 02-00:00:00}. The data structure of the second process tree change table is {id, pid, ppid, pname, time, type}, which contains the data {1, 100, 24, nmap, 2024 / 01 / 02-00:00:05, creat} {1, 23, 1, ls, 2024 / 01 / 02-00:00:08, exit}. The system process tree at 2024 / 01 / 02-00:00:08 is as follows: first, process pid 100 is added, then process pid 23 is deleted, and the parent process of the process with ppid 23 is set to process 23's parent 1. The final result is: {1, 1, null, init, 2024 / 01 / 02-00:00:00} {3, 24, 1, ls, 2024 / 01 / 02-00:00:00} {1, 100, 24, nmap, 2024 / 01 / 02-00:00:05}.

[0104] In an embodiment of the present invention, upon receiving a process query command carrying a timestamp, the first process tree table is queried for collection times less than the timestamp. The first collection time with the largest value is selected from the collection times less than the timestamp. The second process tree change table is queried for incremental information between the first collection time and the timestamp. The incremental information between the first collection time and the timestamp is analyzed one by one in chronological order for the process type. If the process type of the target incremental information is a creation process, the target incremental information is added to the full information corresponding to the first collection time. If the process type of the target incremental information is a termination process, the second process tree change table is retrieved for the target process ID of the target incremental information; the process information corresponding to the target process ID is deleted from the full information corresponding to the first collection time; and the process information to be modified whose parent process ID is the target process ID is retrieved from the first process tree table. The parent process ID of the process information to be modified is modified to the parent process ID of the target process ID. By comparing the collection time corresponding to the process information in the first process tree table with the timestamp, the full information corresponding to the first collection time with the largest value less than the timestamp can be obtained. By obtaining the incremental information between the first collection time and the timestamp, and updating the full information based on the process type of the incremental information, the process information corresponding to the timestamp can be obtained. According to this implementation method, the process information corresponding to any timestamp can be obtained.

[0105] The process tree is presented in a hierarchical manner. When administrators need to query whether a fixed level contains a specific process, they often only need to trace a limited number of levels through the root process.

[0106] Therefore, when displaying the process tree through the web interface, in order to control the display level, it is possible to determine whether the depth of the process tree exceeds the set display level. If the depth of the process tree exceeds the set display level, the process tree that matches the display level can be directly intercepted from the process tree and displayed through the web interface.

[0107] Loading a complete process tree on a web interface will bring about a large performance overhead. In an embodiment of the present invention, by controlling the display level of the process tree, the performance overhead generated by displaying the process tree on the web interface can be effectively reduced.

[0108] Considering that when displaying the process tree through the web interface, the process name contained in the process tree is often only displayed on one line, with a maximum of 10 characters, there is a problem that the process name is too long to be fully displayed. Therefore, if there are process information in the process tree with a process name longer than the set length threshold, a prompt message can be added to the process information with a process name longer than the set length threshold, and the process name can be displayed in the prompt message.

[0109] In the embodiment of the present invention, by adding prompt information, the length of the process name can be unlimited, and the floating display of the process name can be achieved.

[0110] In order to help users locate the process information they want to know more quickly, when a display command carrying the target process name is obtained, the node position of the target process name can be queried from the process tree and the node position can be highlighted.

[0111] In an embodiment of the present invention, in addition to querying the process information corresponding to the timestamp, the management center can also query all change information of a process within a period of time. In the second process tree change table, all process records are queried according to the process name, and the queried process records are sorted by time and passed to the web interface. The web interface can display the process creation and end information within the period of time on a timeline.

[0112] Different types of agent terminals generate different amounts of process information data within the same timeframe. Therefore, in embodiments of the present invention, a correspondence between different agent terminals and their corresponding cycle times can be pre-established. After determining the current agent terminal, this correspondence can be queried to determine the cycle time that matches the current agent terminal. This allows for the regular collection of full information for all processes on the host based on this cycle time.

[0113] In an embodiment of the present invention, by considering the amount of data of process information generated by different agent terminals, a corresponding cycle time can be set so that the value of the cycle time is more in line with the actual performance of the agent terminal, avoiding the situation where the cycle time is set too long or too short, resulting in too much or too little data of the full information collected.

[0114] Figure 3 A schematic diagram of the structure of a process information display device provided by an embodiment of the present invention, which is applicable to a management center, includes a first acquisition unit 31, a second acquisition unit 32, a determination unit 33, a conversion unit 34, and a display unit 35;

[0115] The first acquisition unit 31 is used to obtain the full amount of information of all processes on the host collected regularly by the agent terminal;

[0116] The second acquisition unit 32 is configured to acquire incremental information collected in real time by the proxy terminal; wherein the incremental information is the creation information and termination information of the process captured in real time by the proxy terminal after acquiring the full information of all processes each time; the incremental information of the process determined based on the creation information and termination information of the process;

[0117] The determining unit 33 is configured to, upon receiving a process query command carrying a timestamp, determine target process information that matches the timestamp based on the full information and incremental information of all processes;

[0118] A conversion unit 34, configured to convert target process information into a process tree;

[0119] The display unit 35 is used to display the process tree through a web interface.

[0120] In some embodiments, the first acquiring unit includes a first receiving subunit, a first parsing subunit, and a first storing subunit;

[0121] The first receiving subunit is configured to receive user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes process information of all processes on the host that is periodically obtained by the proxy terminal through a ps command according to a set periodic time;

[0122] A first parsing subunit is configured to parse the user space data according to a set full data format to obtain full information of all processes on the host; wherein the full data format includes at least one of a user ID, a process ID, a parent process ID, a process name, and a collection time;

[0123] The first storage subunit is used to store the full amount of information in the first process tree table.

[0124] In some embodiments, the second acquiring unit includes a second receiving subunit, a second parsing subunit, and a second storing subunit;

[0125] The second receiving subunit is configured to receive user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes incremental information obtained by the proxy terminal in real time;

[0126] A second parsing subunit is configured to parse the user space data according to a set incremental data format to obtain incremental information; wherein the incremental data format includes at least one of a user identifier, a process identifier, a parent process identifier, a process name, a change time, and a process type;

[0127] The second storage subunit is used to store the incremental information in the second process tree change table.

[0128] In some embodiments, the determining unit includes a first query subunit, a selection subunit, a second query subunit, an analysis subunit, an addition subunit, a search subunit, a deletion subunit, and a modification subunit;

[0129] The first query sub-unit is configured to query the first process tree table for a collection time whose value is less than the timestamp when receiving a process query command carrying a timestamp;

[0130] A selection subunit, configured to select a first collection time with the largest value from the collection times that are smaller than the timestamp;

[0131] A second query subunit is configured to query the second process tree change table for incremental information between the first collection time and the timestamp;

[0132] An analysis subunit, configured to analyze, in chronological order, the process type of the incremental information between the first collection time and the timestamp;

[0133] An adding subunit, configured to add target incremental information to the full information corresponding to the first collection time when the process type of the target incremental information is a creation process;

[0134] A search subunit, configured to search the target process identifier of the target incremental information from the second process tree change table when the process type of the target incremental information is an end process;

[0135] a deletion subunit, configured to delete the process information corresponding to the target process identifier from the full amount of information corresponding to the first collection time;

[0136] The modifying subunit is used to search the to-be-modified process information whose parent process identifier is the target process identifier from the first process tree table, and modify the parent process identifier of the to-be-modified process information to the parent process identifier of the target process identifier.

[0137] In some embodiments, the display unit includes a determination subunit and an interception subunit;

[0138] The judgment subunit is used to judge whether the depth of the process tree is greater than the set display level;

[0139] The interception subunit is used to intercept the process tree that matches the display level from the process tree when the depth of the process tree is greater than the set display level, and display the process tree that matches the display level through the web interface.

[0140] In some embodiments, further comprising an adding unit;

[0141] The adding unit is used to add prompt information to the process information whose process name is longer than the set length threshold when there is process information whose process name is longer than the set length threshold in the process tree, and display the process name in the prompt information.

[0142] In some embodiments, a highlight display unit is further included;

[0143] The highlight display unit is used to query the node position of the target process name from the process tree when a display command carrying the target process name is obtained, and highlight the node position.

[0144] Figure 3 The description of the features in the corresponding embodiment can be found in Figure 1 The relevant descriptions of the corresponding embodiments will not be repeated here one by one.

[0145] It can be seen from the above technical solution that the management center obtains the full information of all processes on the host collected by the agent terminal at regular intervals; obtains the incremental information collected by the agent terminal in real time; wherein the incremental information is the creation information and end information of the process captured in real time by the agent terminal each time the full information of all processes is obtained; and the incremental information of the process is determined based on the creation information and end information of the process. When a process query command carrying a timestamp is received, the target process information matching the timestamp can be determined based on the full information and incremental information of all processes. In order to facilitate users to understand the process information more intuitively, the target process information can be converted into a process tree, and the process tree can be displayed through a web interface. The beneficial effect of the present invention is that the agent terminal can ensure the integrity of the process information by regularly collecting the full information of all processes. Since the full information is collected at regular intervals, it will not cause too much burden on the storage capacity of the system. On the basis of regularly collecting the full information, by collecting the incremental information in real time, the changes in the process between the two full information can be obtained. Compared to traditional solutions that only allow viewing the current process tree, this invention combines full and incremental information to obtain process information corresponding to any time. This allows tracing changes between processes and locating the root cause of the fault, improving the effectiveness of fault repair. By displaying the process tree, users can more easily locate faults.

[0146] Figure 4 A structural diagram of a process information display device provided by an embodiment of the present invention, such as Figure 4 As shown, the process information display device includes: a memory 40 for storing computer programs;

[0147] The processor 41 is configured to implement the steps of the method for displaying process information in the above embodiment when executing a computer program.

[0148] The display device of the process information provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer, or a desktop computer.

[0149] Processor 41 may include one or more processing cores, such as a quad-core processor or an octa-core processor. Processor 41 may be implemented using at least one of the following hardware forms: digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). Processor 41 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, processor 41 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing content required to be displayed on the display screen. In some embodiments, processor 41 may also include an artificial intelligence (AI) processor, which is responsible for processing computing operations related to machine learning.

[0150] The memory 40 may include one or more computer-readable storage media, which may be non-transitory. The memory 40 may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 40 is at least used to store the following computer program 401, wherein, after the computer program is loaded and executed by the processor 41, it can implement the relevant steps of the method for displaying process information disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 40 may also include an operating system 402 and data 403, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 402 may include Windows, Unix, Linux, etc. The data 403 may include but is not limited to full information, incremental information, etc.

[0151] In some embodiments, the process information display device may further include a display screen 42 , an input / output interface 43 , a communication interface 44 , a power supply 45 , and a communication bus 46 .

[0152] Those skilled in the art will understand that Figure 4 The structure shown in the figure does not constitute a limitation on the display device of process information, and may include more or fewer components than shown in the figure.

[0153] It is understood that if the process information display method in the above-mentioned embodiment is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the current technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and performs all or part of the steps of the various embodiments of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable ROM, a register, a hard drive, a removable disk, a CD-ROM, a magnetic disk, or an optical disk, and other media that can store program code.

[0154] Based on this, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for displaying process information are implemented.

[0155] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned process information display method when executed by a processor.

[0156] The above describes in detail the method, apparatus, device, computer-readable storage medium, and computer program product for displaying process information provided by the embodiments of the present invention. The various embodiments are described in a progressive manner throughout this specification, with each embodiment focusing on its differences from other embodiments. Reference can be made to the description of the common and similar parts between the various embodiments. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; for relevant details, refer to the description of the method.

[0157] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0158] The above is a detailed introduction to the method, device, equipment, computer-readable storage medium and computer program product for displaying process information provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified in several ways, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A method for displaying process information, characterized in that: Applicable to a management center, the method includes: Obtain full information of all processes on the host collected periodically by the agent terminal; Acquiring incremental information collected in real time by the agent terminal; wherein the incremental information is the creation information and termination information of the process captured in real time by the agent terminal after acquiring the full information of all processes each time; the incremental information of the process determined based on the creation information and termination information of the process; When a process query command carrying a timestamp is received, target process information matching the timestamp is determined based on the full information of all processes and the incremental information; Convert the target process information into a process tree, and display the process tree through a web interface; Obtaining full information about all processes on the host collected periodically by the proxy terminal includes: Receiving user space data reported by the agent terminal through an application programming interface; wherein the user space data includes process information of all processes on the host that is regularly obtained by the agent terminal according to a set periodic time through a system command to view process information; Parsing the user space data according to a set full data format to obtain full information of all processes on the host; wherein the full data format includes at least one of a user ID, a process ID, a parent process ID, a process name, and a collection time; Storing the full amount of information in the first process tree table; Acquiring the incremental information collected in real time by the agent terminal includes: Receiving user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes incremental information obtained by the proxy terminal in real time; Parsing the user space data according to a set incremental data format to obtain the incremental information; wherein the incremental data format includes at least one of a user identifier, a process identifier, a parent process identifier, a process name, a change time, and a process type; The incremental information is stored in the second process tree change table.

2. The method for displaying process information according to claim 1, wherein: When a process query command carrying a timestamp is received, determining target process information matching the timestamp based on the full information of all processes and the incremental information includes: When a process query command carrying a timestamp is received, querying the first process tree table for a collection time whose value is less than the timestamp; Selecting a first collection time with the largest value from the collection times that are smaller than the timestamp; querying the second process tree change table for incremental information between the first collection time and the timestamp; Analyzing the process types of the incremental information between the first collection time and the timestamp one by one in chronological order; When the process type of the target incremental information is a creation process, adding the target incremental information to the full information corresponding to the first collection time; In a case where the process type of the target incremental information is an end process, searching the second process tree change table for a target process identifier of the target incremental information; Delete the process information corresponding to the target process identifier from the full information corresponding to the first collection time; and search the first process tree table for the process information to be modified whose parent process identifier is the target process identifier, and modify the parent process identifier of the process information to be modified to the parent process identifier of the target process identifier.

3. The method for displaying process information according to claim 1 or 2, characterized in that: Displaying the process tree through the web interface includes: Determining whether the depth of the process tree is greater than a set display level; In the case that the depth of the process tree is greater than the set display level, a process tree matching the display level is intercepted from the process tree, and the process tree matching the display level is displayed through a web interface.

4. The method for displaying process information according to claim 1, wherein: Before displaying the process tree through the web interface, the following steps are also included: When process information having a process name longer than a set length threshold exists in the process tree, prompt information is added to the process information having a process name longer than the set length threshold, and the process name is displayed in the prompt information.

5. The method for displaying process information according to claim 1, wherein: Before displaying the process tree through the web interface, the following steps are also included: When a display command carrying the target process name is obtained, the node position where the target process name is located is queried from the process tree, and the node position is highlighted.

6. A device for displaying process information, characterized in that: Applicable to a management center, the device includes a first acquisition unit, a second acquisition unit, a determination unit, a conversion unit, and a display unit; The first acquisition unit is used to obtain the full amount of information of all processes on the host collected regularly by the agent terminal; The second acquisition unit is configured to acquire incremental information collected in real time by the proxy terminal; wherein the incremental information is the creation information and termination information of the process captured in real time by the proxy terminal after acquiring the full information of all processes each time; and the incremental information of the process determined based on the creation information and termination information of the process; The determining unit is configured to, upon receiving a process query command carrying a timestamp, determine target process information matching the timestamp based on the full information of all processes and the incremental information; The conversion unit is configured to convert the target process information into a process tree; The display unit is used to display the process tree through a web interface; The first acquisition unit includes a first receiving subunit, a first parsing subunit and a first storage subunit; The first receiving subunit is configured to receive user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes process information of all processes on the host that is periodically obtained by the proxy terminal through a ps command according to a set periodic time; A first parsing subunit is configured to parse the user space data according to a set full data format to obtain full information of all processes on the host; wherein the full data format includes at least one of a user ID, a process ID, a parent process ID, a process name, and a collection time; A first storage subunit, configured to store the full amount of information in a first process tree table; The second acquiring unit includes a second receiving subunit, a second parsing subunit and a second storage subunit; The second receiving subunit is configured to receive user space data reported by the proxy terminal through an application programming interface; wherein the user space data includes incremental information obtained by the proxy terminal in real time; A second parsing subunit is configured to parse the user space data according to a set incremental data format to obtain incremental information; wherein the incremental data format includes at least one of a user identifier, a process identifier, a parent process identifier, a process name, a change time, and a process type; The second storage subunit is used to store the incremental information in the second process tree change table.

7. A device for displaying process information, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the method for displaying process information according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for displaying process information according to any one of claims 1 to 5.

Images