A service end-to-end monitoring method and system based on eBPF

Abstract

The present invention belongs to the field of computer network monitoring technology, and specifically relates to an eBPF-based business end-to-end monitoring method and system. The system comprises a data acquisition module, a business topology snapshot generation module, a business template generation module, and a business indicator calculation module. The system collects call flow message data from multiple applications and K8S clusters through eBPFAgent, and transmits the collected data to the business topology snapshot generation module. The business topology snapshot generation module receives the data collected by eBPFAgent and obtains data from eSpan. The business call chain template marking module manually marks the nodes and paths of the panoramic topology snapshot generated by the business topology snapshot generation module. The business topology association and indicator calculation module obtains the panoramic topology snapshot generated by the business topology snapshot generation module, call chain data, and the business template generated by the business call chain template marking module. The present invention aims to provide an accurate, efficient, and comprehensive end-to-end monitoring solution for enterprise-level complex business systems.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network monitoring, and in particular relates to an eBPF-based service end-to-end monitoring method and system. Background Art

[0002] In today's information technology environment, effective monitoring of services and applications is crucial to ensuring normal system operation, optimizing performance, and quickly locating faults.

[0003] Currently, application monitoring primarily uses APM (Application Performance Management) technology for data collection. APM technology can capture various data during application execution and link this data into call chains. However, some monitoring scenarios based on eBPF technology have limitations. For example, due to the lack of trace_ids, eBPF technology must perform data correlation operations using multiple data types, such as TCP_seq, IP address, and port number. Application performance metrics must then be calculated based on this correlation data. This process increases the complexity and uncertainty of data processing.

[0004] Traditional end-to-end business monitoring methods typically rely on manual operations. Specifically, staff need to sort out the indicators of the business and its various links, draw a business topology based on this, and attach the indicator data to the corresponding nodes in the topology to display the end-to-end business relationship and node status.

[0005] Disadvantages of existing monitoring technology

[0006] 1. Separation of application and business monitoring: Existing monitoring methods such as APM and eBPF primarily focus on observing the call topology between applications, failing to effectively integrate this topology with actual business operations. Consequently, when problems arise in the call chain within the application topology, it's difficult to directly identify the specific business operations affected. Similarly, when business issues arise, it's difficult to quickly locate the associated call chain, significantly increasing the difficulty of troubleshooting and resolving issues.

[0007] 2. Labor costs and errors in end-to-end business monitoring. For large enterprises such as carriers and financial institutions, their business scale is vast, their applications are numerous, and their business topologies are complex. In this context, traditional methods of manually drawing business topologies have numerous drawbacks. First, manually analyzing business topologies consumes significant manpower and time. Second, due to the complexity of business, manual analysis is prone to omissions and errors, resulting in low business topology accuracy, which in turn affects the effectiveness and reliability of end-to-end business monitoring.

[0008] Existing application monitoring methods are limited to observing the call topology between applications and fail to closely integrate with actual business operations. When an anomaly occurs in the application call chain, it is difficult to determine the impact on specific business operations. Conversely, when business issues arise, it is impossible to quickly trace the relevant call chain. This severely restricts the ability of enterprises to quickly locate and resolve problems, affecting normal business operations and customer experience. An innovative monitoring method is urgently needed to overcome this dilemma. Summary of the Invention

[0009] In view of the shortcomings of the current relevant existing technologies, the present invention provides a business end-to-end monitoring method based on eBPF; the present invention is committed to utilizing the powerful kernel-state data collection and processing capabilities of eBPF, combined with innovative business topology construction and association mechanisms, to provide accurate, efficient and comprehensive end-to-end monitoring solutions for enterprise-level complex business systems, so as to ensure the smooth operation of business processes, optimization and improvement of performance, and rapid location and repair of faults, while ensuring business continuity and stability, helping enterprises reduce operating costs and improve user experience. It is mainly used in IT infrastructure and business system monitoring in industries such as telecommunications and finance that have extremely high requirements for business reliability and performance.

[0010] To achieve the above objectives, the present invention provides a first aspect of a method for end-to-end service monitoring based on eBPF, comprising at least the following steps:

[0011] S1 Data Collection Steps

[0012] eBPFAgent collects call flow message data from multiple applications and K8S clusters and passes the collected data to the service topology snapshot generation module;

[0013] Steps for generating an S2 business topology snapshot

[0014] The service topology snapshot generation module receives data collected by eBPFAgent and obtains data from eSpan. It processes the call flow message containing TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port, associates Span with TCP_Seq, IP, and Port to obtain the call relationship between services, and stores it in the eBPF call list.

[0015] Regularly merge and filter the call relationships between services to generate a panoramic topology snapshot, and generate call chain data to pass to the business topology association and indicator calculation module;

[0016] S3 business template generation steps

[0017] The business call chain template marking module manually marks the nodes and paths of the panoramic topology snapshot generated by the business topology snapshot generation module;

[0018] Set a business name for the annotation result, save it as a business template and pass it to the business topology association and indicator calculation module;

[0019] S4 business indicator calculation steps

[0020] The business topology association and indicator calculation module obtains the panoramic topology snapshot generated by the business topology snapshot generation module, the call chain data, and the business template generated by the business call chain template marking module;

[0021] Match the data in the eBPF call list according to the service template and save the matched data to the service list;

[0022] Calculate the business call duration and call success rate business indicators based on the business links and start and end times.

[0023] Furthermore, in the S1 data collection step, the eBPFAgent has a data integrity verification function to ensure that the collected call flow message data is complete and correct; the call flow message data is collected from the application node through eBPFAgent, and the application node includes application NodeA, application NodeB, application NodeC and nodes in the K8S cluster. The collected call flow message contains TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port information.

[0024] Furthermore, in the step of generating a business topology snapshot, when obtaining the calling relationship between services by associating Span with TCP_Seq, IP, and Port, a fault-tolerant mechanism is provided to handle situations where data is missing or erroneous.

[0025] Furthermore, in the service template generation step, when the nodes and paths of the panoramic topology snapshot are manually annotated, the annotation operation can be traced, and the operator, time and modification content of each annotation are recorded.

[0026] Furthermore, in the business indicator calculation step, the business topology association and indicator calculation module may generate a business indicator trend report when calculating the business indicator, for analyzing the business performance change trend.

[0027] The second aspect of the present invention provides a service end-to-end monitoring system based on eBPF, including a data acquisition module, a service topology snapshot generation module, a service template generation module and a service indicator calculation module, wherein

[0028] The data collection module includes eBPFAgent, which is used to collect call flow message data from application NodeA, application NodeB, application NodeC and K8S cluster, and pass the data to the service topology snapshot generation module;

[0029] The service topology snapshot generation module is used to receive data collected by eBPFAgent and data obtained from eSpan, process the call flow message containing TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port, obtain the call relationship between services by correlating Span with TCP_Seq, IP, and Port, and store it in the eBPF call chain table, regularly merge and filter the call relationship between services to generate a panoramic topology snapshot and call chain data, and pass the call chain data to the service topology association and indicator calculation module;

[0030] The service template generation module includes a service call chain template marking module, which is used to manually mark the nodes and paths of the panoramic topology snapshot, set the service name and save it as a service template and pass it to the service topology association and indicator calculation module;

[0031] The business indicator calculation module is used to obtain panoramic topology snapshots, call chain data and business templates, match the data of the eBPF call list according to the business template, save the matched data to the business list, and calculate the business call duration and call success rate business indicators based on the business links and start and end times.

[0032] Furthermore, the service topology snapshot generation module also includes a data preprocessing submodule for cleaning and preprocessing the collected data to remove noise data.

[0033] Furthermore, the service template generation module also includes a template version management submodule for managing different versions of service templates to facilitate backtracking and comparison.

[0034] Furthermore, the business indicator calculation module also includes an indicator abnormality analysis submodule, which performs a detailed analysis of the abnormal situation when the calculated business indicator exceeds a preset threshold.

[0035] Furthermore, it also includes a visualization display module, which is used to display the data in the panoramic topology snapshot, business templates, business indicators and business chain lists to the user in an intuitive graphical interface, and supports user interactive operations; including zooming, filtering, and drilling functions. This module can obtain the panoramic topology snapshot from the business topology snapshot generation module, obtain the business template from the business template generation module, and obtain the business indicators and business chain list data from the business indicator calculation module.

[0036] The present invention adopts the above technical solution, which has at least the following beneficial effects:

[0037] 1. Accurate integration of business and application monitoring; the present invention successfully breaks down the barriers between application monitoring data and business monitoring, and deeply integrates the information of the two. Traditional monitoring methods can often only perform application monitoring or business monitoring in isolation. The present invention is based on the powerful data collection capabilities of eBPF to obtain rich network call flow information, and through a unique business topology construction combined with manual labeling, it closely associates the call relationship at the application level with the actual business process. For example, by processing call flow messages containing information such as TCP_Seq, Src_IP, Src_Port, Dest_IP, Dest_Port, etc., a panoramic topology snapshot and business template are generated, thereby achieving accurate mapping from the application call chain to the business chain. This enables enterprises to clearly understand the specific impact of application failures on the business during the monitoring process, as well as the application links involved behind the business problems, greatly improving the depth and breadth of monitoring, and providing enterprises with a more comprehensive and accurate insight into the business operation status.

[0038] 2. Significantly reduce labor costs and improve accuracy; in terms of business topology construction, the present invention effectively overcomes the many drawbacks of traditional manual sorting of business topology. In the past, the method of manually sorting out business and indicators of each link and drawing topology, for enterprises with large business volume, multiple applications and complex topology (such as telecommunications and financial industries), not only consumed a lot of manpower and time costs, but also easily led to inaccurate topology structure, omissions or errors in business association relationships due to human negligence. The present invention adopts a combination of manual and automated methods, using eBPF to automatically collect data and generate basic topology snapshots, and then manually annotate the snapshots to generate business templates. This method greatly reduces the manual investment in the tedious data collection and collation work in the initial stage of topology construction. At the same time, with the accuracy of automated data processing, it effectively avoids the introduction of human errors, thereby significantly improving the accuracy and completeness of the business topology, enabling enterprises to obtain a more reliable business monitoring infrastructure at a lower labor cost.

[0039] 3. Efficient Fault Location and Business Optimization Decision Support: The end-to-end business monitoring system constructed based on this invention enables enterprises to quickly locate and accurately analyze faults. When a business anomaly occurs, the business topology association and indicator calculation module can quickly trace the root cause of the problem based on business templates and stored call chain data. Whether it is an application service failure or a logical error in the business process, it can be accurately identified in a short time. For example, when calculating business metrics (such as business call duration and call success rate), if the metric exceeds the preset threshold, the system can quickly locate the relevant business link and application call chain, providing a clear direction for troubleshooting. This significantly shortens fault repair time and reduces the impact of business interruptions on business operations. At the same time, the long-term accumulation of accurate business monitoring data and indicator trend reports provides strong data support for enterprises to make business optimization decisions. Based on this data, enterprises can deeply analyze business bottlenecks and potential risks, formulate targeted optimization strategies, and improve overall business performance and competitiveness.

[0040] 4. Powerful system adaptability and flexibility; the monitoring system of the present invention has good adaptability and flexibility. In the data collection link, eBPFAgent can collect data from various types of application nodes (such as application NodeA, application NodeB, application NodeC and nodes in the K8S cluster), and can adapt to enterprise IT environments of different architectures and scales. The fault-tolerant mechanism and data preprocessing submodule in the business topology snapshot generation module enable it to cope with complex and changeable data quality issues and network environment fluctuations, ensuring the stable operation of the system under various conditions. In addition, the rich interactive functions of the template version management submodule and the visualization display module of the business template generation module facilitate enterprises to flexibly adjust monitoring strategies and view display methods according to business development and demand changes, meet the personalized monitoring needs of different user roles and business scenarios, and enable the system to continuously optimize and expand with the evolution of the enterprise business, and always maintain the effectiveness and adaptability of end-to-end business monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0042] Figure 1 This is a flow chart of the eBPF-based service end-to-end monitoring method of the present invention;

[0043] Figure 2 This is the analysis flow chart of the eBPF-based business end-to-end monitoring system of the present invention. DETAILED DESCRIPTION

[0044] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent like or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0045] like Figure 1 and Figure 2 As shown, the first aspect of this embodiment provides a service end-to-end monitoring method based on eBPF, which includes at least the following steps:

[0046] S1 Data Collection Steps

[0047] eBPFAgent collects call flow packet data from multiple applications (application NodeA, application NodeB, application NodeC) and the Kubernetes cluster, and passes the collected data to the service topology snapshot generation module.

[0048] Steps for generating an S2 business topology snapshot

[0049] The service topology snapshot generation module receives data collected by eBPFAgent and obtains data from eSpan. It processes the call flow message containing TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port, associates Span with TCP_Seq, IP, and Port to obtain the call relationship between services, and stores it in the eBPF call list.

[0050] Regularly merge and filter the call relationships between services to generate a panoramic topology snapshot, and generate call chain data to pass to the business topology association and indicator calculation module;

[0051] S3 business template generation steps

[0052] The business call chain template marking module manually marks the nodes and paths of the panoramic topology snapshot generated by the business topology snapshot generation module;

[0053] Set a business name for the annotation result, save it as a business template and pass it to the business topology association and indicator calculation module;

[0054] S4 business indicator calculation steps

[0055] The business topology association and indicator calculation module obtains the panoramic topology snapshot generated by the business topology snapshot generation module, the call chain data, and the business template generated by the business call chain template marking module;

[0056] Match the data in the eBPF call list according to the service template and save the matched data to the service list;

[0057] Calculate the business call duration and call success rate business indicators based on the business links and start and end times.

[0058] As a preferred implementation scheme, in this embodiment, in the S1 data collection step, the eBPFAgent has a data integrity verification function to ensure that the collected call flow message data is complete and correct; the call flow message data is collected from the application node through eBPFAgent, and the application node includes application NodeA, application NodeB, application NodeC and nodes in the K8S cluster. The collected call flow message contains TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port information.

[0059] As a preferred implementation scheme, in the business topology snapshot generation step in this embodiment, when obtaining the calling relationship between services by associating Span through TCP_Seq, IP, and Port, a fault-tolerant mechanism is provided to handle data missing or erroneous situations.

[0060] As a preferred implementation scheme, in the service template generation step of this embodiment, when manually marking the nodes and paths of the panoramic topology snapshot, the marking operation is traceable, and the operator, time and modification content of each marking are recorded.

[0061] As a preferred implementation scheme, in the business indicator calculation step of this embodiment, the business topology association and indicator calculation module can generate a business indicator trend report when calculating the business indicator, which is used to analyze the business performance change trend.

[0062] like Figure 2 As shown, the second aspect of this embodiment provides a service end-to-end monitoring system based on eBPF, including a data acquisition module, a service topology snapshot generation module, a service template generation module and a service indicator calculation module, wherein

[0063] The data collection module includes eBPFAgent, which is used to collect call flow message data from application NodeA, application NodeB, application NodeC and K8S cluster, and pass the data to the service topology snapshot generation module;

[0064] The service topology snapshot generation module is used to receive data collected by eBPFAgent and data obtained from eSpan, process the call flow message containing TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port, obtain the call relationship between services by correlating Span with TCP_Seq, IP, and Port, and store it in the eBPF call chain table, regularly merge and filter the call relationship between services to generate a panoramic topology snapshot and call chain data, and pass the call chain data to the service topology association and indicator calculation module;

[0065] The service template generation module includes a service call chain template marking module, which is used to manually mark the nodes and paths of the panoramic topology snapshot, set the service name and save it as a service template and pass it to the service topology association and indicator calculation module;

[0066] The business indicator calculation module is used to obtain panoramic topology snapshots, call chain data and business templates, match the data of the eBPF call list according to the business template, save the matched data to the business list, and calculate the business call duration and call success rate business indicators based on the business links and start and end times.

[0067] As a preferred implementation scheme, the service topology snapshot generation module in this embodiment further includes a data preprocessing submodule for cleaning and preprocessing the collected data to remove noise data.

[0068] As a preferred implementation scheme, the service template generation module in this embodiment further includes a template version management submodule for managing different versions of service templates to facilitate backtracking and comparison.

[0069] As a preferred implementation scheme, the business indicator calculation module in this embodiment further includes an indicator abnormality analysis submodule, which performs a detailed analysis of the abnormal situation when the calculated business indicator exceeds a preset threshold.

[0070] As a preferred implementation scheme, this embodiment also includes a visualization display module for displaying the panoramic topology snapshot, business templates, business indicators and data in the business chain list to the user in an intuitive graphical interface, and supports user interactive operations; including zooming, filtering, and drilling functions. This module can obtain the panoramic topology snapshot from the business topology snapshot generation module, obtain the business template from the business template generation module, and obtain the business indicators and business chain list data from the business indicator calculation module.

[0071] like Figure 2The figure shows the system architecture and data flow of an eBPF-based end-to-end business monitoring method. The entire system involves multiple modules and different types of data, and the modules collaborate with each other to implement business monitoring.

[0072] Application NodeA, Application NodeB, Application NodeC and K8S cluster;

[0073] These are application-level nodes. Application Nodes A, B, and C are associated with eSpan through eBPFAgent. eBPFAgent collects data from these application nodes and passes it to subsequent modules.

[0074] eSpan and business topology snapshot generation module;

[0075] eSpan is a source of data. The service topology snapshot generation module obtains eSpan from eBPFAgent and processes call flow messages containing information such as TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port within the module. This involves associating spans to obtain inter-service call relationships and storing them in the eBPF call list. It also periodically merges and filters inter-service call relationships to ultimately generate a panoramic topology snapshot.

[0076] Business topology snapshot, call chain and business topology association and indicator calculation module;

[0077] The panoramic topology snapshot generated by the business topology snapshot generation module is passed to the business topology association and indicator calculation module. At the same time, the business topology snapshot generation module also generates call chain data and passes it to the business topology association and indicator calculation module.

[0078] Business topology association and indicator calculation module, business template and business call chain template marking module

[0079] The service topology association and metric calculation module obtains the panoramic topology snapshot and call chain data from the service topology snapshot generation module. This module also obtains service templates from the service call chain template labeling module. The service topology association and metric calculation module matches the eBPF call chain table data based on the service templates, saves the matched data to the service chain table, and calculates metrics such as service call duration and call success rate.

[0080] Business call chain template tagging module and manual snapshot tagging;

[0081] The service call chain template tagging module manually tags the nodes and paths in the topology snapshot, assigns a service name to the tagging result, and saves it as a service template. Manual snapshot tagging provides a manual operation link for the service call chain template tagging module.

[0082] Business topology association and indicator calculation module and business indicators;

[0083] The service topology association and indicator calculation module generates service indicators, which reflect the performance of the service.

[0084] Business chain and business data; the business topology association and indicator calculation module generates the business chain, which is associated with the business data. Business data is one of the core data that the entire monitoring system focuses on.

[0085] Data flow: Data originates from application nodes, collects eSpan data through the eBPFAgent, and passes it to the business topology snapshot generation module. This module generates a panoramic topology snapshot and call chain data, which are then passed to the business topology association and indicator calculation module. The business call chain template tagging module manually tags business templates and passes them to the business topology association and indicator calculation module. This module calculates business indicators and generates business chains, which are ultimately associated with the business data.

[0086] Integration of application monitoring and business monitoring: The system collects data from application nodes through eBPFAgent and combines it with manual tagging to form business templates, thereby connecting application monitoring data with business monitoring data. For example, the business topology snapshot generation module uses data collected by eBPFAgent to generate topology snapshots and call chains. The business call chain template tagging module generates business templates by manually tagging topology snapshots. The business topology association and indicator calculation module calculates business indicators based on business templates and collected data, thus achieving the integration of application and business monitoring.

[0087] Data processing and indicator generation: A comprehensive set of logic exists from data collection to indicator generation. First, the service topology snapshot generation module processes collected call flow messages to generate a topology snapshot and call chain. The service call chain template tagging module then manually tags the messages to generate service templates. Finally, the service topology association and indicator calculation module calculates service indicators, such as service call duration and call success rate, based on the service templates and related data.

[0088] This system architecture addresses the challenges of traditional monitoring methods. Traditional application monitoring cannot be integrated with business operations, and traditional end-to-end business monitoring relies on manual analysis, which is costly and inaccurate. This system, by combining eBPF data collection with manual tagging, achieves a deep integration of business and application monitoring, reducing labor costs and improving monitoring accuracy and efficiency. For example, the business topology snapshot generation module utilizes eBPF technology to collect data, avoiding reliance on manual analysis of the business architecture. The business call chain template tagging module ensures accurate integration of business and monitoring data through manual tagging.

[0089] Application scenario description:

[0090] In the core business systems of telecom operators, such as mobile network call services, data traffic services, and value-added service platforms, there are a large number of complex applications and business processes. The eBPF-based end-to-end business monitoring method and system of the present invention can play a key role.

[0091] Call services involve multiple application nodes, such as user authentication, call routing, billing, and applications related to base station communication. Deploying eBPFAgent on these application nodes and the Kubernetes cluster (if a cloud-native architecture is available) collects call flow packet data during the call establishment process. During data collection, eBPFAgent's data integrity verification ensures that every call-related network packet (such as the IP addresses and port numbers of both callers, as well as various protocol sequence information during call establishment) is captured completely and accurately. This data is then passed to the service topology snapshot generation module, where it is processed to clearly visualize the inter-service call relationships throughout the call service, from user initiation to call termination. This generates a comprehensive topology snapshot and call chain data. For example, analyzing call chain data can determine whether an anomaly in a call (such as the call quality optimization service) caused a call freeze or interruption. By linking this data to service templates, the specific impact of this anomaly on telecom services can be quickly identified, such as whether it impacts billing accuracy or user experience metrics such as call connection rate and call drop rate. The fault-tolerant mechanism in the service topology snapshot generation module ensures that a relatively complete and accurate call service topology structure can be constructed even when network fluctuations cause some data to be missing or erroneous.

[0092] In terms of value-added service platforms, such as SMS group services and mobile video services, there are many types of services and they are updated frequently. The service template generation module of the present invention can easily manage different versions of value-added service templates by manually marking topology snapshots and using the template version management submodule. When launching a new value-added service, the staff can modify and mark it based on the existing template to quickly generate a monitoring template for the new service, which greatly shortens the monitoring deployment time after the service goes online. For example, for the newly launched high-definition video call value-added service, the staff only needs to mark the newly added high-definition video encoding conversion service node and related paths on the basis of the original video service template to quickly establish a monitoring template for the service. At the same time, the visual display module can provide telecom operators with an intuitive service monitoring view. They can use functions such as zooming and filtering to view the operating status of a value-added service in detail, such as viewing the traffic usage of the mobile video service in a certain time period, the access success rate of users in different regions to the video service, etc., so as to adjust resource allocation and optimize service strategies in a timely manner. In addition, when faced with massive users concurrently accessing value-added services, the data acquisition module can stably collect data, and the service topology snapshot generation module can efficiently process data, ensuring that the real-time and accuracy of the monitoring system are not affected.

[0093] In the online banking systems, securities trading systems and payment settlement systems of financial institutions, extremely high requirements are placed on the reliability, security and performance of the services. The present invention also has significant advantages.

[0094] Taking an online banking system as an example, it involves multiple business processes, including user login verification, account inquiry, remittance transfers, and wealth management services. Each process is composed of multiple application services. When a user performs a remittance transfer, the eBPFAgent collects call flow data from the user's request to various bank backend services (such as risk assessment, funds transfer, and transaction record storage). The business topology snapshot generation module constructs the inter-service call topology for the remittance transfer business by associating spans. The resulting panoramic topology snapshot and call chain data clearly demonstrate the entire transfer process. If a failure occurs during the transfer process, the business topology association and indicator calculation module quickly locates the faulty process (such as the integration with a third-party payment channel) based on the business template. The indicator anomaly analysis submodule then conducts in-depth analysis of abnormal indicators (such as excessive transfer delays and increased transaction failure rates) to determine whether the problem is caused by network failure, application errors, or business rule restrictions. For example, if it is a network failure, it may be that the network connection with the third-party payment channel is unstable. The system can promptly switch to the backup channel or issue a network repair prompt; if it is an application error, the specific code segment can be quickly located for repair; if it is a business rule restriction, such as the transfer amount exceeds the daily limit, accurate prompt information can be promptly fed back to the user.

[0095] In securities trading systems, peak trading periods require high transaction processing volumes and high speeds. The data acquisition module of the present invention efficiently collects the massive amounts of call flow message data from the trading process. The data preprocessing submodule rapidly cleans and preprocesses this data, removing noise and ensuring that only valid data enters the subsequent business topology construction and indicator calculation stages. By providing a panoramic topology snapshot of trading operations and real-time monitoring of business indicators (such as transaction processing time and transaction success rate), financial institutions can promptly identify performance bottlenecks in trading systems. For example, a slow response from a market data push service could impact investor trading decisions. With the present invention, these issues can be quickly located and resolved, ensuring the stable operation of securities trading operations and avoiding significant economic losses and customer trust crises caused by trading failures. Furthermore, within the strict security and compliance requirements of the financial industry, the monitoring system of the present invention can focus on monitoring business processes involving sensitive data, such as user account information queries and fund operations, ensuring data security and compliance, and preventing data leaks and illegal operations.

[0096] In the solution provided by this embodiment, the rich network data collected by eBPF technology, combined with the unique TCP_Seq, IP, and Port association Span mechanism, can accurately construct the call relationship between services in a complex distributed system environment. Compared with traditional monitoring technology, it is no longer limited to the simple collection of application performance indicators, but goes deep into the call link analysis at the business level. For example, when processing massive network call flow messages, the association algorithm of the present invention can quickly and accurately integrate the scattered call information into a complete business call chain, and store it in the eBPF call chain table, providing a solid data foundation for subsequent business topology generation and indicator calculation. In the data association process, the use of efficient data matching technologies such as hash algorithms further improves the speed and accuracy of association. At the same time, for duplicate data or conflicting data that may appear in the association process, the system has an intelligent deduplication and conflict resolution mechanism to ensure data consistency and integrity.

[0097] The automated merging and filtering operations of the business topology snapshot generation module, as well as the intelligent data cleansing of the data preprocessing submodule, significantly reduce the burden of manual data processing. At the same time, the manual labeling process of the business template generation module fully leverages the advantages of human understanding of business logic. For example, when faced with complex financial business logic, humans can accurately label the nodes and paths in the topology snapshot in a business-specific manner, such as labeling a node as "Anti-Money Laundering Compliance Inspection Service." This automated and manual collaboration makes the monitoring system both efficient and accurate, avoiding the business misunderstanding bias that can result from purely automated monitoring, as well as the inefficiency and high error rate of purely manual monitoring. During the manual labeling process, multiple people are supported to collaborate online simultaneously, and the labeling operation traceability function records the operator, time, and modification content of each labeling in detail, facilitating subsequent review and version management.

[0098] The monitoring system of the present invention is well-suited for both traditional IT architectures and emerging cloud-native architectures (such as K8S clusters). The eBPFAgent of the data acquisition module can be flexibly deployed on various types of application nodes, and the system modules can adaptively adjust to different network environments and application loads. For example, in the business topology snapshot generation module, when the network load is light, more refined merging and filtering rules can be used to obtain more detailed topology information; when the network load is heavy, it automatically adjusts to a more efficient coarse-grained processing method, ensuring that the overall performance of the system is not affected and that effective business monitoring is always maintained. In addition, the system also has good scalability. When enterprises add new business applications or upgrade existing applications, the monitoring system can easily expand modules or adjust configurations to quickly adapt to business changes.

[0099] In the telecommunications and financial industries, business interruptions may lead to huge economic losses and customer churn. The present invention can locate and warn of failures as soon as they occur by real-time monitoring of various aspects of the business. For example, when a core routing application in a telecommunications network fails, the business topology association and indicator calculation module can quickly discover the impact of the failure on related businesses (such as call services and data services in multiple regions), and promptly notify the operation and maintenance personnel to repair it, greatly shortening the business interruption time and ensuring business continuity. In the long run, stable business operations help to enhance customer trust and loyalty to the company. In the financial industry, for key business systems such as payment and settlement systems, the high-reliability monitoring of the present invention can ensure the accurate processing of each transaction, and even in the event of a local system failure, it can ensure the uninterrupted operation of the business through a rapid fault switching and recovery mechanism, effectively maintaining the stable order of the financial market.

[0100] Based on the business indicator trend reports generated by the business indicator calculation module, enterprises can deeply analyze business performance trends, identify bottlenecks in business processes, and optimize them. For example, by analyzing transaction indicator trends, financial institutions may discover that the processing time of transaction instructions is too long during a certain period, which may be due to insufficient middleware resources. Based on this analysis, enterprises can rationally allocate resources, such as increasing server memory or optimizing database configuration, to improve business performance while avoiding resource waste and achieving efficient resource utilization. In the telecommunications industry, by analyzing business traffic and performance indicators in different regions and time periods, network resource allocation can be dynamically adjusted. For example, during peak traffic periods, more bandwidth resources can be allocated to areas with high data service demand, improving overall network resource utilization and user experience.

[0101] On the one hand, the present invention reduces the workload of manually combing business topology and monitoring business, and reduces labor costs. For example, in the telecommunications industry, it used to take a large number of operation and maintenance personnel several weeks to comb through business topology, but now with the help of the present invention, it can be completed in a shorter time and with higher accuracy. On the other hand, through accurate fault location and performance optimization, potential economic losses caused by business failures are avoided, and the operational risks of enterprises are reduced. For example, in financial transaction systems, quickly resolving transaction failures can prevent risks such as customer claims and regulatory penalties caused by transaction delays or failures. In addition, the intuitive business monitoring view provided by the visualization display module of the present invention helps enterprise management to quickly understand the business operation status, make more informed decisions, further improve the efficiency of enterprise operation management, and indirectly reduce operating costs.

[0102] The eBPF-based end-to-end business monitoring method and system of the present invention have broad and important application value in industries such as telecommunications and finance, bringing significant benefits to enterprises in many aspects, effectively solving many problems existing in existing monitoring technologies, and promoting the development and progress of enterprise business monitoring technologies.

[0103] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are exemplary and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A service end-to-end monitoring method based on eBPF, characterized by: At least the following steps are included: S1 data collection step: collect call flow message data from multiple applications and K8S clusters through eBPFAgent, and pass the collected data to the business topology snapshot generation module; S2: Business topology snapshot generation step. The business topology snapshot generation module receives data collected by eBPFAgent and obtains data from eSpan. It processes the call flow message containing TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port, associates Span with TCP_Seq, IP, and Port to obtain the call relationship between services, and stores it in the eBPF call list. Regularly merge and filter the call relationships between services to generate a panoramic topology snapshot, and generate call chain data to pass to the business topology association and indicator calculation module; S3 business template generation steps; The business call chain template marking module manually marks the nodes and paths of the panoramic topology snapshot generated by the business topology snapshot generation module; Set a business name for the annotation result, save it as a business template and pass it to the business topology association and indicator calculation module; S4 business indicator calculation step: The business topology association and indicator calculation module obtains the panoramic topology snapshot generated by the business topology snapshot generation module, the call chain data, and the business template generated by the business call chain template marking module; Match the data in the eBPF call list according to the service template and save the matched data to the service list; Calculate the business call duration and call success rate business indicators based on the business links and start and end times.

2. The eBPF-based end-to-end service monitoring method according to claim 1, characterized in that: In the S1 data collection step, the eBPFAgent has a data integrity verification function to ensure that the collected call flow message data is complete and correct; the call flow message data is collected from the application nodes through eBPFAgent, and the application nodes include application NodeA, application NodeB, application NodeC and nodes in the K8S cluster. The collected call flow messages contain TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port information.

3. The eBPF-based end-to-end service monitoring method according to claim 1, characterized in that: In the business topology snapshot generation step, when obtaining the calling relationship between services by associating Span with TCP_Seq, IP, and Port, a fault-tolerant mechanism is provided to handle situations where data is missing or erroneous.

4. The eBPF-based end-to-end service monitoring method according to claim 1, characterized in that: In the service template generation step, when manually marking the nodes and paths of the panoramic topology snapshot, the marking operation is traceable, and the operator, time and modification content of each marking are recorded.

5. The eBPF-based end-to-end service monitoring method according to claim 1, characterized in that: In the business indicator calculation step, the business topology association and indicator calculation module may generate a business indicator trend report when calculating the business indicator, for analyzing the business performance change trend.

6. An eBPF-based end-to-end service monitoring system, characterized by: It includes data acquisition module, business topology snapshot generation module, business template generation module and business indicator calculation module, among which The data collection module includes eBPFAgent, which is used to collect call flow message data from application NodeA, application NodeB, application NodeC and K8S cluster, and pass the data to the service topology snapshot generation module; The service topology snapshot generation module is used to receive data collected by eBPFAgent and data obtained from eSpan, process the call flow message containing TCP_Seq, Src_IP, Src_Port, Dest_IP, and Dest_Port, obtain the call relationship between services by correlating Span with TCP_Seq, IP, and Port, and store it in the eBPF call chain table, regularly merge and filter the call relationship between services to generate a panoramic topology snapshot and call chain data, and pass the call chain data to the service topology association and indicator calculation module; The service template generation module includes a service call chain template marking module, which is used to manually mark the nodes and paths of the panoramic topology snapshot, set the service name and save it as a service template and pass it to the service topology association and indicator calculation module; The business indicator calculation module is used to obtain panoramic topology snapshots, call chain data and business templates, match the data of the eBPF call list according to the business template, save the matched data to the business list, and calculate the business call duration and call success rate business indicators based on the business links and start and end times.

7. The eBPF-based end-to-end service monitoring system according to claim 6, characterized in that: The service topology snapshot generation module also includes a data preprocessing submodule for cleaning and preprocessing the collected data to remove noise data.

8. The eBPF-based end-to-end service monitoring system according to claim 6, characterized in that: The service template generation module further includes a template version management submodule for managing different versions of service templates to facilitate backtracking and comparison.

9. The eBPF-based end-to-end service monitoring system according to claim 6, characterized in that: The business indicator calculation module also includes an indicator abnormality analysis submodule, which performs a detailed analysis of the abnormal situation when the calculated business indicator exceeds a preset threshold.

10. The eBPF-based end-to-end service monitoring system according to any one of claims 6 to 9, characterized in that: It also includes a visualization display module, which is used to display the data in the panoramic topology snapshot, business templates, business indicators and business chain tables to users in an intuitive graphical interface and supports user interaction. Including zooming, filtering, and drilling functions, this module can obtain panoramic topology snapshots from the business topology snapshot generation module, obtain business templates from the business template generation module, and obtain business indicators and business chain table data from the business indicator calculation module.

Images