Change monitoring method and device and cluster

Abstract

A change monitoring method, device and cluster can be applied to the technical field of data processing. The method comprises the steps that when or after a first node is changed, a first operation set executed by a process called by a changed first command is obtained, and the first operation set comprises at least one operation; obtaining a second operation set related to the running state of the first node from the first operation set based on a preset state related operation library; based on the second operation set, a change influence relation graph of the first command is constructed, and the change influence relation graph of the first command comprises the execution process, the operation type and the target object of the operation in the second operation set. The method can efficiently analyze the fault risk introduced by the change.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a change monitoring method, device and cluster. Background Art

[0002] With the development of information technology, more and more services are provided by computers. For example, in the fields of scientific computing, office business, finance and telecommunications, as well as power management, traffic control and public health, computers are used to provide users with corresponding services.

[0003] Services have the need to change, such as starting, upgrading, stopping, etc. Therefore, it is necessary to change the service on the computer. The change of the service is achieved by implementing a change operation on the computer. The change operation may involve modifying the computer, which may cause the computer to fail. Therefore, when changing the service, change monitoring is required to avoid the risk of failure introduced by the change operation, and to analyze the cause of the failure after the failure occurs. Summary of the invention

[0004] The embodiments of the present application provide a change monitoring method, device, and cluster, which can efficiently analyze the failure risks introduced by node changes.

[0005] In a first aspect, a change monitoring method is provided, which is applied to a first node, and the method includes: when or after a change occurs in the first node, obtaining a first operation set executed by a process called by a first command of the change, the first operation set including at least one operation; based on a preset state-related operation library, obtaining a second operation set related to the running state of the first node from the first operation set; based on the second operation set, constructing a change impact relationship graph of the first command, the change impact relationship graph of the first command including the execution process, operation type and target object of the operation in the second operation set.

[0006] This method can construct a change impact relationship diagram based on the operations related to the node running state called by the process related to the change command when or after the node is changed. In this way, the operations related to the node running state involved in this change can be displayed in the form of a relationship diagram, so that relevant personnel can intuitively see which operations involved in the change are related to the node running state, so that when an abnormality occurs in the node operation, the operation that may cause the abnormality can be quickly located.

[0007] In a possible implementation, the method also includes: obtaining a third operation set based on the second operation set; wherein the target objects of the operations in the second operation set correspond to the target objects of the operations in the third operation set; and constructing a change impact relationship graph of the first command based on the second operation set, including: constructing a change impact relationship graph of the first command based on the second operation set and the third operation set, the change impact relationship graph of the first command including the execution process, operation type and target object of the operations in the second operation set and the third operation set.

[0008] In this implementation, operations that are dependent on operations in the second operation set may also affect the operation of the first node. The constructed change impact relationship graph includes operations that are dependent on operations in the second operation set. In this way, the change impact relationship graph can more comprehensively display operations related to the change and to the node operating status. Therefore, when an abnormality occurs in the node operation, the operation that may cause the abnormality can be located based on the change impact relationship graph.

[0009] In a possible implementation, in the change impact relationship graph of the first command, the execution process of the operation is the first graph node, the target object of the operation is the second graph node, and the operation type of the operation is the connecting edge between the first graph node and the second graph node.

[0010] In a possible implementation, constructing a change impact relationship graph of the first command based on the second operation set includes: obtaining a context of the operation; and configuring the semantics of the execution process, operation type, and target object of the operation in the change impact relationship graph of the first command based on the context of the operation. Semantics refers to semantics that are understood or easily understood by humans.

[0011] In this implementation, based on the context of the operation, the semantics of the execution process, operation type and target object of the operation in the change impact diagram are given, so that relevant personnel can identify and understand the operations displayed in the change impact diagram.

[0012] In a possible implementation, the method further includes: configuring a risk value for each operation in the second operation set based on a preset risk matching rule; obtaining a risk value of the first command based on the risk value of each operation in the second operation set, wherein the risk value of the first command is used to indicate the risk of the first command causing the first node to run abnormally. The risk value may be a risk weight.

[0013] In this implementation, risk values ​​are assigned to the edges of the change impact graph through pre-set risk matching rules, and based on the risk values ​​of the edges, the risk value of the change command can be calculated. As a result, the change impact graph can reflect the risk of abnormal node operation caused by the change command, so that relevant personnel can focus on high-risk change commands.

[0014] In one possible implementation, the change also includes a second command, and the method also includes: obtaining a summary of the change based on a change impact relationship diagram of the first command and a change impact relationship diagram of the second command, the summary including the services and / or files in the first node affected by the change; the summary is used to analyze the cause of the failure of the first node.

[0015] In this implementation, services, files and other resources affected by the change can be presented in summary form, which is convenient for retrieval and for relevant personnel to view the resources affected by the change, thereby speeding up the analysis and location of the cause of the abnormality.

[0016] In a possible implementation, the system where the first node is located also includes a second node located in the cloud; the method also includes: sending the change impact relationship diagram of the first command to the second node, and the second node is used to display the change impact relationship diagram of the first command.

[0017] In this implementation, the first node is a node in the cloud system, such as an edge node in the cloud system. The first node can send the change impact relationship diagram to a node in the cloud, so that relevant personnel can use the change impact relationship diagram in the cloud to analyze the fault risk introduced by the change.

[0018] In a second aspect, a change monitoring device is provided, which is configured at a first node and includes: an acquisition module, used to acquire a first operation set executed by a process called by a first command of the change when or after the first node is changed, the first operation set including at least one operation; an acquisition module, used to obtain a second operation set related to the running state of the first node from the first operation set based on a preset state-related operation library; a construction module, used to construct a change impact relationship graph of the first command based on the second operation set, the change impact relationship graph of the first command including the execution process, operation type and target object of the operations in the second operation set.

[0019] In a possible implementation, the obtaining module is also used to: obtain a third operation set based on the second operation set; wherein the target objects of the operations in the second operation set correspond to the target objects of the operations in the third operation set; the constructing module is also used to: construct a change impact relationship graph of the first command based on the second operation set and the third operation set, wherein the change impact relationship graph of the first command includes the execution process, operation type and target object of the operations in the second operation set and the third operation set.

[0020] In a possible implementation, in the change impact relationship graph of the first command, the execution process of the operation is the first graph node, the target object of the operation is the second graph node, and the operation type of the operation is the connecting edge between the first graph node and the second graph node.

[0021] In a possible implementation, the construction module is further used to: obtain the context of the operation; and based on the context of the operation, configure the execution process of the operation, the operation type, and the semantics of the target object in the change impact relationship diagram of the first command.

[0022] In one possible implementation, the device also includes a configuration module: the configuration module is used to: configure a risk value for each operation in the second operation set based on a preset risk matching rule; the obtaining module is used to: obtain the risk value of the first command based on the risk value of each operation in the second operation set, and the risk value of the first command is used to indicate the risk of the first command causing abnormal operation of the first node.

[0023] In one possible implementation, the change also includes a second command, and the obtaining module is also used to: obtain a summary of the change based on the change impact relationship diagram of the first command and the change impact relationship diagram of the second command, the summary including the services and / or files in the first node affected by the change; the summary is used to analyze the cause of the failure of the first node.

[0024] In a possible implementation, the system where the first node is located also includes a second node located in the cloud; the device also includes: a sending module, used to send the change impact relationship diagram of the first command to the second node, and the second node is used to display the change impact relationship diagram of the first command.

[0025] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster executes the method provided in the first aspect.

[0026] In a fourth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method provided in the first aspect.

[0027] In a fifth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computer device cluster, the computer device cluster executes the method provided in the first aspect.

[0028] The beneficial effects of the second to fifth aspects can be referred to the above introduction to the beneficial effects of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A schematic diagram of the structure of a node provided in an embodiment of the present application;

[0030] Figure 2 A flow chart of a change monitoring method provided in an embodiment of the present application;

[0031] Figure 3 A change impact relationship diagram provided for an embodiment of the present application;

[0032] Figure 4 A flow chart of a change monitoring method provided in an embodiment of the present application;

[0033] Figure 5 A schematic diagram of a change monitoring method provided in an embodiment of the present application;

[0034] Figure 6 A schematic diagram of the structure of a change monitoring device provided in an embodiment of the present application;

[0035] Figure 7 A schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0036] Figure 8 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0037] Fig. 9 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The scheme provided by the embodiment of the present application will be described below in conjunction with the accompanying drawings. In the embodiment of the present application, "multiple" means two or more, and "multiple" means two or more. "First", "second", etc. are only used to distinguish similar objects and are not necessarily used to describe a specific order or number of objects.

[0039] With the expansion of information technology application areas, the requirements for information service quality are getting higher and higher. For example, key areas such as power management, traffic control and public health have high requirements for information service quality. The traditional model of providing services by a single machine can no longer meet the growing demand for information services. Therefore, large-scale computing platforms such as cloud systems based on cloud technology are becoming the key computing infrastructure for hosting information services.

[0040] Cloud technology refers to a managed service that unifies a series of resources such as hardware, software, and networks within a wide area network or a local area network to achieve data computing, storage, processing, and sharing. Cloud systems are based on cloud technology, have multiple nodes, complex and diverse structures, and many components. Cloud systems are also highly dynamic, that is, they undergo frequent changes. These frequent changes will occur on each node of the cloud system. While they provide flexible support for the ever-changing information service needs, they also bring huge risks to the reliability and stable operation of the cloud system. Among them, the node in the cloud system is the unit in the cloud system responsible for undertaking independent tasks, generally a server.

[0041] Changes in the cloud system, including service startup, service configuration changes (such as service upgrades), and service shutdown, can all lead to failures in the cloud system. For example, a user may use incorrect configuration parameters when changing a service, causing the node to behave abnormally, which in turn causes node and cloud system failures.

[0042] There are dependencies between nodes in the cloud system. A failure in one node of the cloud system may spread between nodes, eventually causing a large-scale failure. In order to avoid the risks introduced by service changes to the cloud system as much as possible and to be able to perform root cause analysis after a failure occurs, it is necessary to monitor the change operations in the cloud system.

[0043] In one solution, when the operation and maintenance personnel execute the change command, the executed change command is recorded and used as change data, and then the change command data is processed to build various monitoring applications. Specifically, when it is necessary to change the services provided by the cloud system, the operation and maintenance personnel first submit a work order to the change management system. The work order includes the executor of the change, the target node of the change, the purpose of the change, the time of the change, and other information related to the change. After the work order is reviewed and approved, the operation and maintenance personnel will get a token. The operation and maintenance personnel use the obtained token to log in to the bastion host to execute the change command. The bastion host will forward the change command executed by the operation and maintenance personnel to the change target node for execution. The bastion host also sends the change command to the change management system. These change commands and change work orders together constitute a complete record of a change process, which is stored in the change management system.

[0044] In this solution, although the change commands saved in the change management system can completely describe all behaviors in a change process, the change commands are difficult to be automatically processed later, resulting in cumbersome use.

[0045] Specifically, if the change commands recorded by the scheme are used for risk prediction, the administrator of the cloud system attempts to assign a risk level to each change command executed by the operation and maintenance personnel, so as to focus on the change commands with higher risk levels. Since the changes experienced by the cloud system are very frequent, these changes involve a large number of change commands. If the operation of assigning a risk level to each change command is difficult to complete manually, it needs to be automated. There are many types of change commands with different functions, and each change command may contain different parameter combinations to achieve different functions. It is difficult for the administrator of the cloud system to implement a unified text processing program to handle highly heterogeneous change commands, and thus it is impossible to automatically assign risk levels to change commands.

[0046] If the change commands recorded in this solution are used to locate the root cause after a failure, the operation and maintenance personnel need to rely on their own expert knowledge to find the change commands that may cause the failure among the change commands executed a period of time before the failure. This process is quite time-consuming. However, even with high labor costs, the operation and maintenance personnel still face the following difficulties.

[0047] First, for simple change commands, the operation and maintenance personnel can intuitively understand their meaning; but for complex commands, due to the wide variety of parameters and complex command formats, it is difficult for the operation and maintenance personnel to intuitively understand their meaning. For example, some change commands that cause failures may be caused by syntax errors when the operation and maintenance personnel enter a very complex change command. Such errors are still difficult to find during manual verification.

[0048] Secondly, the change orders may be scripts written by the change personnel, and the meaning of these commands is unclear during manual audits. This means that the efficiency of the operation and maintenance personnel manually analyzing the change orders to locate the root cause of the failure is very low.

[0049] In another solution, the system calls executed by the change commands executed by the operation and maintenance personnel are recorded. When the operation and maintenance personnel log in to the bastion host to execute the change command, the change management system does not directly record the change command, but records the system calls called by the change command during the operation process, and uploads and stores the obtained system call data in the change management system for subsequent analysis of the change.

[0050] The kernel of the operating system used in the system call provides an interface for user-mode programs, which can reflect the impact of the change process on the running status of the node. However, for operation and maintenance personnel, the original system call is still difficult to understand. This is because there are many system calls, and some system calls have quite complex parameters. It will introduce a lot of unnecessary learning costs for operation and maintenance personnel to understand the meaning of each system call. In addition, a large number of system calls will be generated during the execution of the change command, and not every system call will have an impact on the running status of the node. However, this solution does not distinguish between system calls when recording system calls. In other words, the system call used by the change command cannot directly represent the impact of a change on the cloud system.

[0051] In view of this, an embodiment of the present application provides a change monitoring method, which can obtain the operations performed by the process called by the change command of the change when or after the node changes, and filter out the operations related to the node operation status from the operations, and then use the operations related to the node operation status to build a change impact relationship graph. The change impact relationship graph can show the operations related to the node operation status involved in the change. Therefore, using the change impact relationship graph, relevant personnel, such as operation and maintenance personnel or management personnel, can intuitively see which operations caused by the change will affect the node operation status, so that when the node fails after the change, the cause of the failure can be quickly analyzed.

[0052] Next, the change monitoring method provided in the embodiment of the present application is described.

[0053] Figure 1 A node 110 that can implement the method is shown. The node 110 can be any device, equipment, platform or cluster with data processing functions. For example, the node 110 can be a physical computing device, such as a server. For another example, the node 110 can be a virtual computing device, such as a virtual machine (VM) or a container.

[0054] like Figure 1 As shown, node 110 is deployed with an operating system, an application and a change monitoring module. Among them, the application can also be called a user state program, which is used to provide services or business. The operating system can support the operation of the application, for example, providing an interface (such as a programming interface) for the application, and the application can perform corresponding operations through the programming interface. The change monitoring module is used to execute the change monitoring method provided in the embodiment of the present application, which will be specifically introduced below and will not be repeated here.

[0055] In some embodiments, Figure 1As shown, node 110 may be a node in system 100. System 100 may be a cloud system. In particular, system 100 may further include node 120. Node 120 may be located in the cloud, and node 110 may be located at the edge or in the cloud. Node 110 may send the change impact relationship graph generated by its change monitoring module to node 120. Node 120 may display the change impact relationship graph for use by relevant personnel located in the cloud.

[0056] Next, the change monitoring method provided by the embodiment of the present application is introduced by taking the implementation in the node 110 as an example. The method may include: Figure 2 Steps shown.

[0057] Step 201 : when or after a change occurs to the node 110 , a first operation set executed by a process called by a first command of the change may be obtained, where the first operation set includes at least one operation.

[0058] The changed command may be called a change command or a change instruction, which is a command or instruction used to implement the change. For example, a command is text data entered by a user in a command line process (shell), and the shell process interprets and executes the command entered by the user to implement the corresponding function. Among them, the shell is a process used to expose the services of the operating system to human users or other programs.

[0059] In some embodiments, the operation and maintenance personnel may use one or more change commands to change the node 110. For example, the operation and maintenance personnel may input one or more change commands of the change to the node 110, or send the one or more change commands to the node 110 through a bastion host, etc. The node 110 may run the one or more change commands, and the change may occur.

[0060] In some embodiments, node 110 may periodically or irregularly automatically execute one or more change commands to make changes.

[0061] During or after the node 110 executes the one or more change commands, the change monitoring module in the node 110 may execute step 201 .

[0062] The one or more change commands include a first command. In step 201, the change monitoring module can obtain and record operations occurring on the node 110 during the period when the node 110 runs the first command, and obtain an operation set A1. That is, the elements in the operation set A1 are operations occurring on the node 110 during the period when the node 110 runs the first command.

[0063] In step 201, the change monitoring module may also obtain the process called by the first command. The process called by the first command refers to the process called by the node 110 due to running the first command. A process is a running activity of a program in a computer on a certain data set.

[0064] In some embodiments, the change monitoring module can obtain the process called by the first command by tracking the processes created and deleted by the operating system of the node 110 due to running the first command. In one example, the change monitoring module can construct a change process tree based on the process called by the first command with the shell process of the operation and maintenance personnel logging into the node 110 as the root node. In other words, the process on the change process tree is the process called by the first command.

[0065] After obtaining the process called by the first command, the operations executed by the process called by the first command can be obtained from the operation set A1 to obtain the first operation set. That is, the first operation set is a subset of the operation set A1, and the operations in the first operation set are the operations executed by the process called by the first command. The first operation set includes at least one operation, that is, the process called by the first command executes at least one operation.

[0066] In some embodiments, the operations in the first operation set are system call operations. A system call refers to a process in which a process interacts with a kernel of an operating system through an interface provided by the operating system to perform an operation. In other words, a system call operation refers to an operation performed by a process through an interface provided by the operating system.

[0067] In some embodiments, the first operation set includes system call operations and may also include non-system call operations, wherein the non-system call operations refer to operations other than system call operations, for example, operations between user state processes.

[0068] In some embodiments, if the operation set A1 has other operations in addition to the operations in the first operation set, that is, operations executed by processes not called by the first command. For the convenience of description, the operations executed by processes not called by the first command in the operation set A1 can be referred to as operations in the operation set A2, that is, the operation set A2 is a subset of the operation set A1, the union of the operation set A2 and the first operation set is the operation set A1, and the operations in the operation set A2 are operations executed by processes not called by the first command.

[0069] Continue reading Figure 2, the node 110 may execute step 202, and obtain a second operation set related to the running state of the node 110 from the first operation set based on a preset state-related operation library. The elements in the second operation set are operations related to the running state of the node 110.

[0070] Operations related to the running status of a node refer to operations that will or may affect the running status of a node. For example, operations that modify the running parameters of a node (such as operating system startup parameters, etc.). If an error occurs in this operation, it will affect the running status of the node, such as causing node operation failures (unable to communicate normally, operation errors, etc.), causing the node to restart repeatedly, etc.

[0071] Based on experience or experiments, multiple operations related to the running state of the node can be obtained. The multiple operations constitute a state-related operation library. In step 202, the intersection of the first operation set and the state-related operation library can be used as the second operation set. In other words, the operations that appear in both the state-related operation library and the first operation set constitute the second operation set.

[0072] As described above, the operation set A1 also includes the operation set A2. After obtaining the second operation set, a third operation set related to the operating state of the node 110 can be obtained from the operation set A2 based on the second operation set. That is, the operations related to the operating state of the node 110 in the operation set A2 are identified, and the operations constituting the third operation set are identified. Among them, the target objects of the operations in the second operation set and the target objects of the operations in the operation set A2 can be obtained and compared. If the target object of an operation in the second operation set corresponds to the target object of an operation in the operation set A2, the operation in the operation set A2 is confirmed as an operation related to the operating state of the node 110. In other words, the target object of the operations in the third operation set corresponds to the target object of the operations in the second operation set.

[0073] The target object of an operation refers to the object of the operation. Taking the modification operation as an example, the target object of the modification operation refers to the object to be modified, and the modification operation is a modification operation of the object, that is, the modification operation is used to modify the object. Taking the send operation as an example, the target object of the send operation refers to the destination or destination node of the send, that is, the send operation is to send the corresponding data to the target object. The object of the operation can be a file, a network node, a process, etc.

[0074] The target objects of the operations in the third operation set correspond to the target objects of the operations in the second operation set, indicating that the operations in the third operation set have a read after write (RAW) dependency on the operations in the second operation set. The operations in the second operation set are related to the running state of the node 110, and the operations for which there is a RAW dependency are also related to the running state of the node 110, that is, the operations in the third operation set are also related to the running state of the node 110.

[0075] In some embodiments, two target objects correspondingly refer to the two target objects being the same, or the two target objects being the same target object. That is, the target object of at least one operation in the second operation set and the target object of at least one operation in the third operation set are the same target object.

[0076] Continue reading Figure 2 , node 110 can execute step 203 to construct a change impact relationship graph of the first command based on the second operation set, where the change impact relationship graph of the first command includes the execution process, operation type and target object of each operation in the second operation set.

[0077] In some embodiments, in step 203, a change impact relationship graph of the first command is constructed specifically based on the second operation set and the third operation set, and the change impact relationship graph of the first command includes the execution process, operation type and target object of each operation in the second operation set and the third operation set.

[0078] In the following description, when the second operation set and the third operation set are not specifically distinguished, they may be referred to as an operation set. That is, in the following description, unless otherwise specified, the operation set may be the second operation set, the third operation set, or both.

[0079] The execution process, operation type and target object of each operation in the operation set can be obtained. Among them, the execution process of the operation refers to the process that executes the operation, and the execution process of the operation is the execution subject of the operation. The operation type of the operation indicates what kind of operation the operation is, such as create operation (create), exit operation (exit), read operation (read), write operation (write), send operation (send), receive operation (recv), copy operation (clone), open operation (open) or connect operation (connect). The target object of the operation refers to the object of the operation. Taking the operation of process B1 modifying file C1 as an example, the execution process of the operation is process B1, the operation type is modification operation, and the target object is file C1. Taking process B2 sending data to network node C2 as an example, the execution process of the operation is process B2, the operation type is send operation, and the target object is network node C2.

[0080] See also Figure 3 , a change impact relationship graph can be constructed with the execution process of an operation in the operation set as a graph node, the target object as another graph node, and the operation type as the connection edge between the two graph nodes. Among them, the connection edge can be a directed connection edge, wherein the direction of the connection edge points from the graph node of the execution process to the graph node of the target object. The above processing is performed on each operation in the operation set to construct a change impact relationship graph for the first command. In an example, the operation set can be set to include operation 1, operation 2, and operation 3. Among them, the execution process of operation 1 is process P1, and the target object is object O1. The execution process of operation 2 is process P2, and the target object is object O2. Object O1 is a process. The execution process of operation 3 can be object O1, and the target object of operation 3 is object O3. In this way, the following can be obtained: Figure 3 Change impact diagram shown.

[0081] In some embodiments, the execution process, operation type and target object of each operation in the operation set can be described in the form of a subject-predicate-object structure. Among them, the execution process is the subject, the operation type is the predicate, and the target object is the object. In this way, each operation in the operation set can be described in the form of a subject-predicate-object structure. When constructing a change impact relationship graph, the change impact relationship graph is constructed with the subject and object as nodes and the predicate as the connecting edge.

[0082] In some embodiments, generally speaking, the execution process, operation type and target object of the acquired operation are represented in the form of parameters (such as file descriptors in kernel mode, etc.). For example, the representation form of the execution process is process identification (PID). Although computers can understand the execution process, operation type and target object represented in the form of parameters, humans have difficulty understanding the execution process, operation type and target object represented in the form of parameters. In addition, the meaning of the parameter depends on the context. Out of context, the parameter may be ambiguous. Among them, the context refers to the data structure recorded in the operating system to record the relevant state of the process when it is running, including information such as process number, register value, file descriptor mapping table. In this embodiment, the operations in the operation set can be stream processed to eliminate the ambiguity that may be caused by the parameters being out of context, and to convert the parameters into a form that is easy for humans to understand. The details are as follows.

[0083] In step 203, the context of each operation in the operation set can be obtained; based on the context of the operation, the semantics of the execution process, operation type and target object of the operation in the change impact relationship graph of the first command are configured. Among them, semantics are semantics that are understandable or easy to understand by humans. Specifically, according to the context of the operation, the semantics of the execution process, operation type and target object of the operation can be obtained, for example, the semantics of the execution process is the name of the process, the semantics of the operation type is the description information of the operation, and the semantics of the target object can be the object name, storage path, etc. These semantics are semantics that are easy for humans to understand. When the semantics of the execution process of the operation is obtained, the semantics of the execution process can be associated with the graph node of the execution process. When the semantics of the operation type of the operation is obtained, the semantics of the operation type can be associated with the connection edge corresponding to the operation type. When the semantics of the target object of the operation is obtained, the semantics of the target object can be associated with the graph node of the target object. In this way, the semantics of the execution process, operation type and target object of the operation in the change impact relationship graph of the first command can be configured.

[0084] In some embodiments, Figure 2 The method shown also includes: configuring a risk value for each operation in the operation set based on a preset risk matching rule; obtaining a risk value of the first command based on the risk value of each operation in the operation set, wherein the risk value of the first command is used to indicate the risk of the first command causing abnormal operation of node 110.

[0085] The risk matching rules can be set based on experience or experiments. Different risk values ​​can be assigned to different operations. The risk value refers to the risk size of causing abnormal operation of node 110. Exemplarily, different risk values ​​can be assigned to operations with different target objects and / or operation types. In other words, the risk matching rules include an association between operations and risk values, wherein different operations are associated with different risk values, and different operations may refer to operations with different target objects and / or operation types. Based on the risk matching rules, the risk value of each operation in the operation set can be obtained. Then, the risk values ​​of all operations in the operation set are added together to obtain the risk value of the first command.

[0086] The risk value of the first command may be associated with the change impact relationship diagram of the first command. Thus, when the change impact relationship diagram of the first command is displayed, the risk value of the first command may be displayed, so that the corresponding personnel can intuitively see the impact of the first command on the node operation status.

[0087] In some embodiments, the change of node 110 further includes a second command, that is, one or more change commands for implementing the change further include the second command. The change relationship impact graph of the second command can be constructed by referring to the method for constructing the change relationship impact graph of the first command. Figure 2 The method shown also includes: based on the change impact relationship graph of the first command and the change impact relationship graph of the second command, obtaining a summary of the change, the summary including the services affected by the change of the node 110 and the files in the node 110 (e.g., which files are modified and / or deleted by the change). In this way, after the node 110 is changed, if the node 110 fails, it can be analyzed and determined based on the summary whether the failure is caused by the change, thereby determining whether the change causes the failure without manually traversing all the change commands.

[0088] In some embodiments, Figure 1 As shown, the system 100 where the node 110 is located also includes a node 120 located in the cloud. Figure 2 The method shown also includes: sending the change impact relationship diagram of the first command to the node 120. After receiving the change impact relationship diagram, the node 120 can display the change impact relationship diagram to facilitate cloud-related personnel to monitor and analyze the impact of the change on the node 110.

[0089] The change monitoring method provided in the embodiment of the present application can construct a change impact relationship diagram based on the operations related to the node operation status involved in the change when or after the node changes. In this way, the operations related to the node operation status involved in the change can be displayed in the form of a relationship diagram, so that relevant personnel can intuitively see which operations are related to the node operation status, so that when an abnormality occurs in the node operation, the operation that may cause the abnormality can be quickly located.

[0090] Next, in Figure 4 In the illustrated embodiment, the change monitoring method provided in the embodiment of the present application is further introduced.

[0091] like Figure 4 As shown, the method includes the following steps.

[0092] S1. Classify the original system calls according to the change process tree to obtain change-related system calls and change-irrelevant system calls.

[0093] S2. For the change-related system calls, filter out the system calls that have an impact on the system.

[0094] S3. For non-change related system calls, filter out system calls that depend on the change related system calls.

[0095] S4. Combine the results of S2 and S3 into a target system call set.

[0096] S5. Perform stream processing on the time series data generated in S4 to generate a unified representation of the impact of the change.

[0097] S6. Generate an impact surface diagram using the unified representation of the change impact.

[0098] S7. Assign risk weights to the edges in the impact surface diagram and calculate the risk value of a change to conduct risk assessment of the change.

[0099] S8. The impact surface diagram can be matched with pre-defined risk rules to monitor the occurrence of risky operations and trace them back.

[0100] The specific details of each step of the embodiment are as follows:

[0101] Step S1 constructs a change process tree by tracing the system calls related to process creation and deletion in the operating system, taking the shell process after the operation and maintenance personnel log in to the system as the root node. The system calls called by the processes on the change process tree are change-related system calls, otherwise they are change-irrelevant system calls.

[0102] Step S2 needs to traverse the entire set of change-related system calls, filter out the set of system calls that will affect the system state and the system calls that may affect the meaning of system call parameters (see step S5 for details), and then filter out the system calls belonging to the set from the change-related system calls.

[0103] In step S3, for a system call in the non-change related system call set, if its target object is the same as a system call in the change related system call set and the former has a RAW dependency on the latter, the former is added to the target system call set.

[0104] Step S4 combines the two system call sets obtained in S2 and S3 to obtain the complete set of target system call sets.

[0105] Step S5 further processes the time series data generated in S4. Since some parameters in the system call will be ambiguous if they are separated from the context of the operating system, in order to obtain a change command impact relationship diagram that can be separated from the process context when constructing a complete impact surface diagram (step S6), we use a part of the system calls collected in S2 to eliminate the context dependency of other system call parameters in S2. Specifically, when the meaning of a system call parameter that affects the system state depends on the process context, we need to obtain the context of the parameter based on other system calls that affect the system state before it and system calls that may affect the meaning of the system call parameters, and replace the parameter with a synonymous expression that is independent of the context and understandable to humans to eliminate the context dependency of the parameter. When all system calls that affect the system state are independent of the process context, for each system call that affects the system state, S5 will generate a subject-predicate-object record with the process object that calls the system call as the subject, the specific operation of the system call as the predicate, and the specific affected object as the object.

[0106] Step S6 uses the subject, predicate and object records generated in S5 that are independent of the process context to generate an influence surface relationship graph with objects as nodes and predicate verbs as edges.

[0107] Step S7 uses the impact surface relationship diagram generated in S6 to quantify the actual impact of the change. This process assigns a risk value to each edge on the impact surface relationship diagram according to the operation target and operation type according to the pre-written operation risk matching rules, and adds the risk values ​​of all change operations performed by a process node to obtain the risk value of the process, and the risk value corresponding to the process where the change instruction is located is the risk value of this change instruction.

[0108] Step S8 uses the data generated in S6 to directly generate a summary of the change, including which existing services are affected by the change, which files are modified / deleted, etc. In this way, when locating the root cause of the fault, the operation and maintenance personnel can directly view the change summary generated by the change impact surface diagram to determine whether the change may have caused the fault, thereby avoiding manually traversing all the change command data.

[0109] Next, in one embodiment, in combination Figure 5 , the change monitoring method provided in the embodiment of the present application is further introduced.

[0110] Assume that an operation and maintenance personnel logs in to the bastion host and uses the bash process on the bastion host to perform a change. This change includes two change commands:

[0111] In the vim editor, modify the config.json file, which is a service configuration file.

[0112] Use the apt process to download the apache process from the socket at address 1.2.3.4:80.

[0113] In step S1, by tracing the system call of the create operation, it is found that there are three system calls related to the change at this time: the bash process itself, the vim process, and the apt process, and the remaining processes are irrelevant processes.

[0114] At this time, the corresponding create operations (create), exit operations (exit), read operations (read), write operations (write), send operations (send), and receive operations (recv) in these three processes are regarded as system processes, files, network nodes (i.e. Figure 5 The socket shown in FIG. 1 is a system call that affects the meaning of the system call parameters, and the copy operation (clone), the open operation (open), the connection operation (connect), etc. are system calls that affect the meaning of the system call parameters. The corresponding parameters are tracked and obtained to complete step S2.

[0115] In step S2, it is found that the change writes the file config.json, so all processes that read the file (ie, config.json) will be added to the target system call set, thereby implementing steps S3 and S4. The service process's read operation on config.json is recorded according to this rule.

[0116] In step S5, by analyzing the system calls that may affect the operating system context, such as the open operation and the connect operation, the file name and the IP address are associated with the file descriptor in the kernel state, and the parameters in the read operation, the write operation, the send operation, and the receive operation are replaced with the file name and the IP address to obtain a subject-predicate-object structure.

[0117] In step S6, a change impact relationship diagram is generated.

[0118] The embodiment of the present application further provides a change monitoring device 600. The device 600 is configured at a first node. The first node may be the node 110 described above. Figure 6 As shown, the device 600 includes:

[0119] An acquisition module 610 is configured to acquire, when or after the first node is changed, a first operation set executed by a process called by a first command of the change, wherein the first operation set includes at least one operation;

[0120] An obtaining module 620 is configured to obtain, from the first operation set, a second operation set related to the running state of the first node based on a preset state-related operation library;

[0121] The construction module 630 is used to construct a change impact relationship diagram of the first command based on the second operation set, and the change impact relationship diagram of the first command includes the execution process, operation type and target object of the operations in the second operation set.

[0122] Among them, the acquisition module 610, the obtaining module 620 and the construction module 630 can all be implemented by software, or can be implemented by hardware. Exemplarily, the following takes the acquisition module 610 as an example to introduce the implementation of the acquisition module 610. Similarly, the implementation of the acquisition module 620 and the construction module 630 can refer to the implementation of the acquisition module 610.

[0123] As an example of a software functional unit, the acquisition module 610 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the acquisition module 610 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code can be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with close geographical locations. Among them, usually a region can include multiple AZs.

[0124] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0125] As an example of a hardware functional unit, the acquisition module 610 may include at least one computing device, such as a server, etc. Alternatively, the acquisition module 610 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0126] The multiple computing devices included in the acquisition module 610 can be distributed in the same region or in different regions. The multiple computing devices included in the acquisition module 610 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the acquisition module 610 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0127] It should be noted that, in other embodiments, the acquisition module 610 may be used to execute Figure 2 Any step in the method shown, the module 620 can be used to perform Figure 2 In any step of the method shown, the construction module 630 can be used to perform Figure 2 The steps implemented by the acquisition module 610, the obtaining module 620 and the construction module 630 can be specified as needed, and the steps implemented by the acquisition module 610, the obtaining module 620 and the construction module 630 can be specified as needed. Figure 2 The different steps in the method shown are used to implement the overall functions of the apparatus 600 .

[0128] The present application also provides a computing device 700. Figure 7 As shown, computing device 700 includes: bus 702, processor 704, memory 706 and communication interface 708. Processor 704, memory 706 and communication interface 708 communicate through bus 702. Computing device 700 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 700.

[0129] The bus 702 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 The bus 702 may include a path for transmitting information between various components of the computing device 700 (eg, the memory 706, the processor 704, and the communication interface 708).

[0130] The processor 704 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0131] The memory 706 may include a volatile memory, such as a random access memory (RAM). The memory 706 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0132] The memory 706 stores executable program codes, and the processor 704 executes the executable program codes to respectively implement the functions of the acquisition module 610, the obtaining module 620 and the construction module 630, thereby implementing Figure 2 That is, the memory 706 stores the method for executing Figure 2 Instructions for the method shown.

[0133] The communication interface 708 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 700 and other devices or communication networks.

[0134] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0135] like Figure 8 As shown, the computing device cluster includes at least one computing device 700. The memory 706 in one or more computing devices 700 in the computing device cluster may store the same Figure 2 Instructions for the method shown.

[0136] In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also store a memory for executing Figure 2In other words, the combination of one or more computing devices 700 can jointly execute instructions for executing Figure 2 Instructions for the method shown.

[0137] It should be noted that the memory 706 in different computing devices 700 in the computing device cluster may store different instructions, which are respectively used to execute part of the functions of the apparatus 600. That is, the instructions stored in the memory 706 in different computing devices 700 may implement the functions of one or more modules in the acquisition module 610, the obtaining module 620 and the construction module 630.

[0138] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig. 9 A possible implementation is shown. Fig. 9 As shown, two computing devices 700A and 700B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 706 in the computing device 700A stores instructions for executing the functions of the acquisition module 610. At the same time, the memory 706 in the computing device 700B stores instructions for executing the functions of the acquisition module 620 and the construction module 630.

[0139] It should be understood that Fig. 9 The functions of the computing device 700A shown in FIG. 7 may also be completed by multiple computing devices 700. Similarly, the functions of the computing device 700B may also be completed by multiple computing devices 700.

[0140] The present application embodiment also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to that of Figure 8 and Fig. 9 The difference is that the memory 706 in one or more computing devices 700 in the computing device cluster may store the same memory for executing Figure 2 Instructions for the method shown.

[0141] In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also store a memory for executing Figure 2 In other words, the combination of one or more computing devices 700 can jointly execute instructions for executing Figure 2 Instructions for the method shown.

[0142] The present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes Figure 2 The method shown.

[0143] The present application also provides a computer-readable storage medium. The computer-readable storage medium may be any available medium that can be stored by a computing device or a host migration device such as a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute Figure 2 The method shown.

[0144] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A change monitoring method, characterized in that: The method is applied to a first node, and the method comprises: When or after the first node is changed, obtaining a first operation set executed by a process called by a first command of the change, wherein the first operation set includes at least one operation; Based on a preset state-related operation library, obtaining a second operation set related to the running state of the first node from the first operation set; Based on the second operation set, a change impact relationship graph of the first command is constructed, where the change impact relationship graph of the first command includes the execution process, operation type and target object of the operations in the second operation set.

2. The method according to claim 1, characterized in that The method further includes: obtaining a third operation set based on the second operation set; wherein the target objects of the operations in the second operation set correspond to the target objects of the operations in the third operation set; The constructing a change impact relationship graph of the first command based on the second operation set includes: Based on the second operation set and the third operation set, a change impact relationship graph of the first command is constructed, and the change impact relationship graph of the first command includes the execution process, operation type and target object of the operations in the second operation set and the third operation set.

3. The method according to claim 1 or 2, characterized in that: In the change impact relationship graph of the first command, the execution process of the operation is the first graph node, the target object of the operation is the second graph node, and the operation type of the operation is the connecting edge between the first graph node and the second graph node.

4. The method according to any one of claims 1 to 3, characterized in that The constructing a change impact relationship graph of the first command based on the second operation set includes: Obtaining a context for the operation; Based on the context of the operation, the execution process of the operation, the operation type, and the semantics of the target object in the change impact relationship graph of the first command are configured.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Based on a preset risk matching rule, configuring a risk value for each operation in the second operation set; A risk value of the first command is obtained based on the risk value of each operation in the second operation set, where the risk value of the first command is used to indicate the risk that the first command causes abnormal operation of the first node.

6. The method according to any one of claims 1 to 4, characterized in that The change further includes a second command, and the method further includes: Based on the change impact relationship graph of the first command and the change impact relationship graph of the second command, a summary of the change is obtained, the summary including the services affected by the change and / or the files in the first node; the summary is used to analyze the cause of the failure of the first node.

7. The method according to any one of claims 1 to 6, characterized in that The system where the first node is located also includes a second node located in the cloud; the method also includes: The change impact relationship graph of the first command is sent to the second node, and the second node is used to display the change impact relationship graph of the first command.

8. A change monitoring device, characterized in that: The device is configured at a first node, and includes: an acquisition module, configured to acquire, when or after the first node is changed, a first operation set executed by a process called by a first command of the change, wherein the first operation set includes at least one operation; An obtaining module, configured to obtain, from the first operation set, a second operation set related to the running state of the first node based on a preset state-related operation library; A construction module is used to construct a change impact relationship diagram of the first command based on the second operation set, and the change impact relationship diagram of the first command includes the execution process, operation type and target object of the operations in the second operation set.

9. The device according to claim 8, characterized in that The obtaining module is further used to: obtain a third operation set based on the second operation set; wherein the target objects of the operations in the second operation set correspond to the target objects of the operations in the third operation set; The construction module is also used to: construct a change impact relationship graph of the first command based on the second operation set and the third operation set, and the change impact relationship graph of the first command includes the execution process, operation type and target object of the operations in the second operation set and the third operation set.

10. The device according to claim 8 or 9, characterized in that In the change impact relationship graph of the first command, the execution process of the operation is the first graph node, the target object of the operation is the second graph node, and the operation type of the operation is the connecting edge between the first graph node and the second graph node.

11. The device according to any one of claims 8 to 10, characterized in that The building blocks are also used to: Obtaining a context for the operation; Based on the context of the operation, the execution process of the operation, the operation type, and the semantics of the target object in the change impact relationship graph of the first command are configured.

12. The device according to any one of claims 8 to 11, characterized in that The device also includes a configuration module: The configuration module is used to: configure a risk value for each operation in the second operation set based on a preset risk matching rule; The obtaining module is used to obtain the risk value of the first command based on the risk value of each operation in the second operation set, where the risk value of the first command is used to indicate the risk of the first command causing abnormal operation of the first node.

13. The device according to any one of claims 8 to 11, characterized in that The change further includes a second command, and the obtaining module is further used for: Based on the change impact relationship graph of the first command and the change impact relationship graph of the second command, obtaining a summary of the change, the summary including services affected by the change and / or files in the first node; The summary is used to analyze a cause of the failure of the first node.

14. The device according to any one of claims 8 to 13, characterized in that The system where the first node is located also includes a second node located in the cloud; the device also includes: A sending module is used to send the change impact relationship diagram of the first command to the second node, and the second node is used to display the change impact relationship diagram of the first command.

15. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method as claimed in any one of claims 1 to 7.

17. A computer program product comprising instructions, characterized in that When the instructions are executed by a computer device cluster, the computer device cluster executes the method according to any one of claims 1 to 7.

Images