Watchdog circuit monitoring device and system

Abstract

The invention discloses a watchdog circuit monitoring device and system, relates to the technical field of circuit monitoring, is used for solving the problem of processing lag caused by lack of dynamic processing capability under the condition of high resource competition, and obtains application running time by calling historical data to obtain a statistical result and the application running time. The method comprises the following steps: judging each application in monitoring equipment, screening out high-risk applications in the monitoring equipment according to a judgment result, marking, monitoring and obtaining the real-time access quantity and the use load cumulant of each application, analyzing the real-time competitiveness of each application, and counting the quantity of high-resource competition applications; according to the high resource competition application number, a processing signal is selected to be formulated and sent to a watchdog or a tuning prompt is given to a monitoring device, monitoring time is set, tuning response and statistical update result judgment of the high resource competition application number are combined, an alarm mechanism is triggered, and the dynamic monitoring capability of the system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of circuit monitoring, and more specifically, to a watchdog circuit monitoring device and system. Background Art

[0002] With the wide application of cloud computing, microservices, and multi-process architectures, the number of applications and concurrent threads running in embedded systems and networked monitoring devices is increasing continuously. Due to the differences in the occupancy of system resources (such as CPU, memory, network connections, etc.) by different applications during operation, some high-concurrency or resource-intensive applications may cause abnormal problems such as a sharp increase in system load, thread blocking, connection interruption, and even system downtime in specific scenarios.

[0003] The prior art has the following deficiencies: Currently, watchdog circuits usually rely on time thresholds or heartbeat mechanisms and lack the ability to "dynamically handle high-resource competition situations", resulting in processing lags, high false alarm rates, or untimely responses, and it is difficult to meet the requirements of the current complex operating environment. Therefore, a watchdog circuit monitoring device and system are proposed.

[0004] The above information disclosed in the background art section is only used to enhance the understanding of the background of the present disclosure, and thus it may include information that does not constitute the prior art known to those of ordinary skill in the art. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a watchdog circuit monitoring device and system, which solve the problems raised in the above background art by using a multi-dimensional resource behavior monitoring modeling and dynamic competition analysis mechanism.

[0006] To achieve the above object, the present invention provides the following technical solution. A watchdog circuit monitoring system includes a data acquisition module, a high-risk screening module, a competition analysis module, and an alarm regulation module, and the modules are signal-connected to each other; The data acquisition module is used to count the number of application connection threads in the monitoring device, call historical data to obtain the application running time, and obtain the statistical result and the application running time; The high-risk screening module receives the statistical results of the number of application connection threads and the application running time of each application, judges each application in the monitoring device, and screens out high-risk applications in the monitoring device according to the judgment results; The competition analysis module marks the received high-risk applications, monitors them when the marked applications are enabled, obtains the real-time access quantity and the cumulative usage load of each application, analyzes the real-time competitiveness of each application, and obtains the number of high-resource competition applications with competitiveness statistics; The alarm control module selects and formulates a processing signal according to the number of high-resource competition applications, and sends it to the watchdog or optimizes the prompt to the monitoring device. It monitors the optimization response, sets the monitoring time, combines the optimization response and the statistical update result of the number of high-resource competition applications to judge whether to formulate a secondary processing signal and send it to the watchdog. After receiving the processing signal, the watchdog triggers the alarm mechanism.

[0007] In a preferred embodiment, the received waveform data of the network traffic monitoring sensor is applied to a low-pass filter to remove high-frequency noise; When an application starts and establishes a connection, the network traffic monitoring sensor monitors the connection request and marks it as a connection establishment event; By traversing all connection establishment events captured by the network traffic monitoring sensor within a set statistical period, according to the source process ID and the target port belonging to the application, the number of threads successfully established in the period is counted to obtain the number of connection threads of each application; By capturing the startup timestamp of the application process through the operating system event recording component when the application process starts, and combining the current sampling time, the current sampling time minus the startup timestamp is used to obtain the application running time.

[0008] In a preferred embodiment, the database of the data acquisition module is called to extract the statistical results of the number of threads connected by each application and the application running time; Create an application list, including each application ID, the number of threads and the running time. Initialize the high-risk application list, obtain the number of threads and the running time of each application. If the number of threads is greater than the thread number threshold or the running time is greater than the running time threshold, then add the application ID to the initialized high-risk application list; The statistical results of the number of threads of each application and the application running time are compared with the threshold to screen out the high-risk application list.

[0009] In a preferred embodiment, in the high-risk application list database, a marker field is added to identify the status of the application. When a high-risk application is identified, the access number and load accumulation amount of the application are recorded in real time.

[0010] In a preferred embodiment, when the monitoring module captures a connection request, the access times of the high-risk application are accumulated, and the statistical data is stored in the high-risk application list database to obtain the access number of each high-risk application; Monitor the usage load accumulation of high-risk applications, divide the value of the resident memory set size by the value of the total system memory to obtain the memory usage; Divide the current number of threads by the maximum number of threads to obtain the thread number ratio; Divide the sum of the user-mode time and the kernel-mode time of the process by the total CPU time within the sampling interval to obtain the central processing unit utilization rate value.

[0011] In a preferred embodiment, a central processing unit weighted value, a memory usage weighted value, and a thread count weighted value are obtained using preset weight coefficients, and all the weighted values are added together to obtain a comprehensive load value; Collect all the comprehensive load values of the applications for standardization; Use a weighted algorithm to combine the standardized access quantity and the standardized load value to obtain a comprehensive competitiveness index.

[0012] In a preferred embodiment, traverse the real-time competitiveness of all high-risk applications, and check whether the real-time competitiveness of each application is greater than or equal to a set competitiveness threshold; if the real-time competitiveness is greater than or equal to the competitiveness threshold, mark it as a high-resource competition application; Record the real-time competitiveness of the applications corresponding to being greater than or equal to the competitiveness threshold, and use the final count value as the number of high-resource competition applications.

[0013] In a preferred embodiment, when the system calls the number of high-resource competition applications and the high-resource competition applications, when the number of high-resource competition applications is greater than or equal to a preset threshold, a processing signal will be constructed and sent to the monitoring device to trigger a response mechanism; The monitoring device extracts the target application from the processing signal, multiplies the preset monitoring frequency adjustment coefficient by the existing monitoring time to obtain a new monitoring time, and monitors the number of threads connected to each application within the new monitoring period to obtain an updated number of high-resource competition applications.

[0014] In a preferred embodiment, if the number of high-resource competition applications is still greater than or equal to the preset threshold, the device will construct a secondary processing signal, including the target application id and the current resource status data, and send it to the watchdog circuit monitoring system; After receiving the secondary processing signal, the watchdog parses the signal content and extracts the target application id and the current resource status data; Compare the current resource status data with the preset resource usage threshold. After the current resource status data is greater than or equal to the resource usage threshold, trigger an alarm mechanism, and generate a specific alarm message according to the information of the parsed secondary processing signal; The alarm message includes the application id and the current resource status data.

[0015] The technical effects and advantages of the present invention: 1. The present invention obtains the application running time by calling historical data, obtains the statistical result and the application running time, judges each application in the monitoring device, screens out and marks the high-risk applications in the monitoring device according to the judgment result, monitors and obtains the real-time access quantity and the cumulative usage load of each application, analyzes the real-time competitiveness of each application, and counts the number of high-resource competition applications. According to the number of high-resource competition applications, a processing signal is selected and sent to the watchdog or a tuning prompt is sent to the monitoring device. The monitoring time is set, and the updated result judgment is combined with the tuning response and the count of the number of high-resource competition applications to trigger the alarm mechanism, improving the dynamic monitoring ability of the system, optimizing resource scheduling, and ensuring the accuracy of the alarm mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart implementation diagram of the watchdog circuit monitoring system of the present invention.

[0017] Figure 2 It is a module schematic diagram of the watchdog circuit monitoring system of the present invention.

[0018] Figure 3 It is a device schematic diagram of the watchdog circuit monitoring device of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention. Embodiment 1

[0020] The watchdog circuit monitoring system, as Figures 1 to 2 shown, includes a data acquisition module, a high-risk screening module, a competition analysis module, and an alarm regulation module, and the signals of each module are connected; The data acquisition module is used to count the number of application connection threads in the monitoring device, call historical data to obtain the application running time, and transmit the statistical result and the application running time to the high-risk screening module; The high-risk screening module receives the statistical result of the number of application connection threads and the application running time, judges each application in the monitoring device, screens out the high-risk applications in the monitoring device according to the judgment result, and sends them to the competition analysis module; The competition analysis module marks the received high-risk applications, monitors and obtains the real-time access quantity and the cumulative usage load of each application when the marked application is enabled, analyzes the real-time competitiveness of each application, obtains the number of high-resource competition applications in the competitiveness statistics of each application, and transmits the number of high-resource competition applications to the alarm regulation module; The alarm control module selects and formulates a processing signal according to the number of high-resource competition applications and sends it to the watchdog or sends an optimization prompt to the monitoring device, monitors the optimization response, sets the monitoring time, combines the optimization response and the statistical update result of the number of high-resource competition applications to judge whether to formulate a secondary processing signal and send it to the watchdog, and the watchdog triggers the alarm mechanism after receiving the processing signal.

[0021] The specific implementation is as follows: S1: Real-time collect the performance data of applications through a network traffic monitoring sensor, including the connection status and thread information of each application; when an application establishes a connection, the network traffic monitoring sensor records the start time of the connection and the end time when the connection is closed; by calculating the difference between the start time and the end time of the same tag recorded by the network traffic monitoring sensor, the running duration of the application can be obtained.

[0022] It should be noted that the network traffic monitoring sensor is a device used to capture and analyze data packets in the network; it can monitor network traffic in real time and record information such as the source, destination, protocol type, and data volume of the data.

[0023] Apply a low-pass filter to the received waveform data of the network traffic monitoring sensor to remove high-frequency noise to ensure the accuracy of the data; initialize a thread counter for each application with an initial value of zero; when an application starts and establishes a connection, the network traffic monitoring sensor monitors the connection request, records the timestamp, source IP address, and target port of the connection request, and marks it as a connection establishment event.

[0024] By traversing all connection establishment events captured by the network traffic monitoring sensor within a set statistical period, and according to the source process ID and the application to which the target port belongs, count the number of threads that successfully establish connections within the period to obtain the number of connection threads of each application; Among them, the statistical period is obtained by the experimenter based on the analysis of the application connection behavior characteristics and the experimental data of the dynamic change law of resource occupancy, which will not be elaborated here; When the network traffic monitoring sensor captures a connection establishment event, the system will increment the value of the thread counter of the application by 1; when the application closes the connection, the network traffic monitoring sensor monitors the connection termination signal, records the timestamp, source IP address, and target port of the event, and marks it as a connection closing event; when the network traffic monitoring sensor captures a connection closing event, the system will decrement the value of the thread counter of the application by 1.

[0025] It should be noted that the Transmission Control Protocol (TCP) is a connection-oriented communication protocol mainly used for reliably transmitting data in a computer network. It ensures that data packets arrive at the receiving end completely and in order through mechanisms such as connection establishment, data segmentation, flow control, and error detection. The network traffic monitoring sensor listens for connection termination signals by monitoring network traffic. Specifically, it captures the end packet in the TCP to represent the signal when the application closes the connection. The network traffic monitoring sensor captures connection establishment events by detecting the synchronization packet in the TCP. When an application initiates a connection request, the synchronization packet is sent and recorded by the network traffic monitoring sensor, thereby realizing the dynamic management of the thread counter.

[0026] By capturing the startup timestamp of the application process through the operating system event recording component when the application process starts, and combining it with the current sampling time, the application running time is obtained by subtracting the startup timestamp from the current sampling time. By monitoring the synchronization packet and end packet in the TCP, the accurate identification of application connection events can be achieved, which not only improves the accuracy of performance data but also effectively manages the dynamic changes of the thread counter. This is of great significance for timely discovering and solving potential network service problems and ensuring the stability and efficiency of the system. All application running durations, thread count information, and connection events will be stored in the database of the data acquisition module in a structured format for subsequent query and analysis.

[0027] S2: Call the database of the data acquisition module, extract the thread count statistics results and application running time of each application connection, create an application list A, which contains the id, thread count, and running time of each application ap, initialize the high-risk application list H, obtain the thread count and running time of each application ap, and if the thread count is greater than the thread count threshold or the running time is greater than the running time threshold, then add the id of the application ap to the list H.

[0028] Traverse the application list A through the formula: ; Judge the condition: the thread count t is greater than the thread count threshold or the running time td is greater than the running time threshold.

[0029] It should be noted that the setting basis of the thread count threshold and the running time threshold is based on the performance requirements of the application and the availability of system resources. The thread count threshold is determined according to the design specifications and historical performance data of the application to ensure that the system will not cause resource competition and performance degradation due to too many threads. The running time threshold takes into account the normal running cycle and response time requirements of the application.

[0030] By screening the thread count statistics results and application running time of each application through the above process, the high-risk application list H can be screened out.

[0031] By calling the database of the data collection module to extract the number of threads and running time of each application and create an application list, high-risk applications can be effectively monitored and identified. And by setting thresholds to automatically screen out applications with excessive thread counts or long running times and adding them to the high-risk application list, the efficiency and accuracy of monitoring are improved, potential performance issues and security risks can be detected in a timely manner, providing strong support for system management and helping to optimize resource allocation and enhance system stability. S3: In the high-risk application list database, add a flag field to identify the status of the application. When a high-risk application is identified, its status is updated to marked. When the application starts, the system records the access count and load accumulation of the application in real time.

[0032] It should be noted that the flag field is used to indicate the current status of each application. This field can have multiple values. When a high-risk application is identified, the system updates the status of its flag field, which is marked in this example, indicating that the application has been marked as high risk.

[0033] The system integrates a traffic monitoring module in the network interface of the application server. This module can capture and analyze network data packets entering and leaving the server in real time. When a high-risk application makes a connection request, the monitoring module extracts the target address, source address, and timestamp of the connection request and classifies the connection request according to the Uniform Resource Locator path.

[0034] When the monitoring module captures a connection request, it increments the access count of the high-risk application by 1 and stores the statistical data in the high-risk application list database to obtain the access counts of each high-risk application. The minimum and maximum values among the current access counts are selected as the maximum access data and the minimum access count respectively. The difference between the current access count and the minimum access count is divided by the difference between the maximum access count and the minimum access count to obtain the normalized access count.

[0035] Monitor the usage load accumulation of high-risk applications and use a process monitoring tool to obtain relevant information such as the process identifier, CPU usage rate value, resident memory set size of each high-risk application, and the total memory of the system.

[0036] It should be noted that the process monitoring tool is a library for building and managing Representational State Transfer application programming interfaces. It provides a simple and flexible way to define application interface routing, handle connection requests and responses. In this example, the process monitoring tool is used to calculate the comprehensive load index.

[0037] Divide the sum of the user-mode time and kernel-mode time of the process by the total CPU time within the sampling interval to obtain the CPU usage rate value. Divide the value of the resident memory set size by the value of the total system memory to obtain the memory usage; Monitor the current number of threads of this process, which directly reflects the concurrent execution situation of the application; Standardize the number of threads by dividing the current number of threads by the maximum number of threads to obtain the thread number ratio; The whole process is executed in a timed loop to achieve regular monitoring and ensure real-time acquisition of the resource usage of each high-risk application; Use the preset weight coefficients to obtain the weighted value of the central processing unit, the weighted value of the memory usage, and the weighted value of the number of threads, and add all the weighted values to obtain the comprehensive load value.

[0038] It should be noted that the timed loop is implemented by setting a timer to periodically execute the monitoring task, and the time setting is based on the characteristics of the application, the change frequency of resource usage, and the system performance requirements; The preset weight coefficients are not fixed values but can be adjusted according to specific application scenarios and requirements. In different environments or load situations, the importance of the access quantity and the comprehensive load value to the competitiveness index may vary. For example: the central processing unit usage rate accounts for 50%, the memory usage accounts for 30%, and the number of threads accounts for 20%.

[0039] Collect the comprehensive load values of all applications to obtain the minimum comprehensive load value and the maximum comprehensive load value, and substitute the comprehensive load value of each application into the following formula for standardization:

[0040] Where a is the current comprehensive load value; b is the minimum comprehensive load value; c is the maximum comprehensive load value; d is the standardized load value.

[0041] Use the weighted algorithm to combine the standardized access quantity and the standardized load value to obtain the real-time competitiveness:

[0042] Where m is the standardized access quantity, n is the standardized load value, and k is the competitiveness index.

[0043] It should be noted that is the access quantity weight, is the load value weight, and ; In this example, it can be set or adjusted according to the actual situation.

[0044] Traverse the real-time competitiveness of all high-risk applications and check whether the real-time competitiveness of each application is greater than or equal to the set competitiveness threshold; If the real-time competitiveness is greater than or equal to the competitiveness threshold, mark it as a high-resource competition application; Set a counter during the above process, initialize the counter to zero, and increment the count value of the corresponding counter by one whenever the real-time competitiveness of an application is greater than or equal to the competitiveness threshold. Finally, store the value of the counter as the number of high-resource-competition applications in the high-risk application list database.

[0045] It should be noted that the setting of the competitiveness threshold is usually based on historical data analysis, and the position is determined by analyzing past competitiveness index data. For example, set the quantile to 75% to identify applications with poor performance.

[0046] Using a timed loop mechanism to periodically execute monitoring tasks ensures real-time monitoring and dynamic adjustment of application resource usage. This mechanism can flexibly adapt to the needs of different application characteristics and change frequencies, and timely reflect the actual operating conditions of the system.

[0047] S4: When the system calls the number of high-resource-competition applications and the IDs of high-resource-competition applications, when the number of high-resource-competition applications is greater than or equal to the preset threshold, the alarm control module will construct a processing signal, add the IDs of high-resource-competition applications to the signal, and then the module will send the generated processing signal in JSON string format through the network to the monitoring device to trigger the corresponding response mechanism.

[0048] It should be noted that the basis for the preset threshold is usually based on the analysis of system resource usage patterns and the statistics of historical data; the processing signal is when the number of high-resource-competition applications is greater than or equal to the preset threshold, the module organizes relevant information into a structured data object and formats the object into a standardized message format, and sends it to the monitoring device through the Hypertext Transfer Protocol.

[0049] After the monitoring device receives the processing signal, the monitoring device extracts the target application ID from the processing signal, multiplies the preset monitoring frequency adjustment coefficient by the existing monitoring time to obtain a new monitoring time, and monitors the number of threads connected to each application within the new monitoring period to obtain an updated statistical result of the number of high-resource-competition applications. If the number of high-resource-competition applications is still greater than or equal to the preset threshold, the device will construct a secondary processing signal, including the target application ID and the current resource status data, and send it to the watchdog circuit monitoring system.

[0050] It should be noted that the current resource status data is obtained by calling the interfaces provided by the process monitoring tool. Using these interfaces, the system can accurately monitor and analyze the resource usage of each application; the preset monitoring frequency adjustment coefficient is a value between 0 and 1 determined based on the system's historical resource usage, the importance of the application, and dynamic load changes; this coefficient is used to accurately regulate the monitoring frequency of specific applications to ensure that while improving monitoring sensitivity, it does not consume excessive system resources.

[0051] After receiving the secondary processing signal, the watchdog parses the signal content, extracts the target application ID and the current resource status data. The system compares the current resource status data with the preset resource usage threshold. After the current resource status data is greater than or equal to the resource usage threshold, the system generates a specific alarm message based on the parsed secondary processing signal information, including the application ID and the current resource status data; sends the alarm information to the administrator's desktop in a pop-up window and simultaneously notifies relevant personnel via email.

[0052] After receiving the signal, the monitoring device adjusts the monitoring time according to the monitoring frequency adjustment coefficient and re-evaluates the application status. This method improves the response speed to changes in the critical application status, effectively balances the monitoring accuracy and system resource consumption, ensures the efficient and stable operation of the system, and reduces unnecessary resource waste.

[0053] It should be noted that the process of presetting the resource usage threshold is based on historical data analysis and system performance requirements. Technical personnel collect the resource usage data of the application under different load conditions, analyze these data to identify the resource usage patterns of the application in normal operation and high-load states, and set reasonable resource usage thresholds according to these patterns. Embodiment 2

[0054] Please refer to Figure 3 , the watchdog circuit monitoring device, including a main monitoring device and a collaborative processing device; The main monitoring device is used to count the number of application connection threads in the monitoring device, call historical data to obtain the application running time, obtain the statistical result and the application running time, judge each application in the monitoring device, and screen out high-risk applications in the monitoring device according to the judgment result; The collaborative processing device is used to mark the received high-risk applications, monitor and obtain the real-time access quantity and the cumulative usage load of each application when the marked applications are enabled, analyze the real-time competitiveness of each application, obtain the number of high-resource-competition applications in the competitiveness statistics of each application, and select to formulate a processing signal to send to the watchdog or give an optimization prompt to the monitoring device, monitor the optimization response, set the monitoring time, combine the optimization response and the statistical update result of the number of high-resource-competition applications to judge whether to formulate a secondary processing signal and send it to the watchdog, and the watchdog triggers the alarm mechanism after receiving the processing signal.

[0055] The above formulas are all dimensionless and take their numerical values for calculation. The formula is obtained by collecting a large amount of data for software simulation to get a formula closest to the real situation. The preset parameters in the formula are set by those skilled in the art according to the actual situation.

[0056] The above embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center in a wired or wireless (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that contains one or more sets of available media. The available media can be magnetic media (such as floppy disks, hard disks, magnetic tapes), optical media (such as DVDs), or semiconductor media. The semiconductor media can be a solid-state drive.

[0057] It should be understood that in various embodiments of the present application, the order numbers of the above processes do not mean the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.

[0058] Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or by a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0059] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0060] In several embodiments provided in the present application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of the devices or units can be in electrical, mechanical, or other forms.

[0061] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0062] In addition, in each embodiment of the present application, the functional units can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit.

[0063] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present application. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

[0064] As described above, the above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present application can easily think of changes or substitutions, which should all be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A watchdog circuit monitoring system, characterized in that: It includes data acquisition module, high-risk screening module, competition analysis module and alarm control module, and the signal connections between the modules; The data collection module is used to count the number of connection threads of each application in the monitoring device, call historical data to obtain the application running time, and obtain the statistical results and application running time; The high-risk screening module receives the statistical results of the number of connection threads of each application and the application running time to judge each application in the monitoring device, and screens out the high-risk applications in the monitoring device according to the judgment results; The competition analysis module marks the received high-risk applications, monitors and obtains the real-time access quantity and usage load accumulation of each application when the marked application is enabled, analyzes the real-time competitiveness of each application, and obtains the competitiveness statistics of each application and the number of high resource competition applications; The alarm control module selects and formulates processing signals to be sent to the watchdog or prompts the monitoring device for tuning according to the number of applications with high resource competition, monitors the tuning response, sets the monitoring time, and determines whether to formulate and send secondary processing signals to the watchdog based on the statistical update results of the tuning response and the number of applications with high resource competition. The watchdog triggers the alarm mechanism after receiving the processing signal.

2. The watchdog circuit monitoring system according to claim 1, characterized in that: Apply a low-pass filter to the received network traffic monitoring sensor waveform data to remove high-frequency noise; When the application starts and establishes a connection, the network traffic monitoring sensor listens to the connection request and marks it as a connection establishment event; By traversing all connection establishment events captured by the network traffic monitoring sensor within the set statistical period, the number of threads that successfully establish connections within the period is counted according to the source process ID and the target port belonging to the application, and the number of connection threads of each application is obtained; When the application process starts, its startup timestamp is captured by the operating system event recording component, combined with the current sampling time, and the application running time is obtained by subtracting the startup timestamp from the current sampling time.

3. The watchdog circuit monitoring system according to claim 2, characterized in that: Call the data collection module database to extract the statistical results of the number of threads connected to each application and the application running time; Create an application list, including each application ID, number of threads and running time, initialize the high-risk application list, obtain the number of threads and running time of each application, and if the number of threads is greater than the thread number threshold or the running time is greater than the running time threshold, add the application ID to the initialized high-risk application list; The statistical results of the number of threads of each application and the application running time are compared with the threshold to filter out a list of high-risk applications.

4. The watchdog circuit monitoring system according to claim 3, characterized in that: In the high-risk application list database, a tag field is added to identify the status of the application. When a high-risk application is identified, the number of accesses and the accumulated load of the application are recorded in real time.

5. The watchdog circuit monitoring system according to claim 4, characterized in that: When the monitoring module captures a connection request, it accumulates the number of accesses to the high-risk application and stores the statistical data in the high-risk application list database to obtain the number of accesses to each high-risk application; Monitor the accumulated usage load of high-risk applications, and divide the value of the resident memory set size by the value of the total system memory to obtain the memory usage; Divide the current number of threads by the maximum number of threads to get the thread ratio; The sum of the process's user state time and kernel state time is divided by the total CPU time during the sampling interval to obtain the CPU usage value.

6. The watchdog circuit monitoring system according to claim 5, characterized in that: Use the preset weight coefficients to obtain the weighted value of the CPU, the weighted value of the memory usage, and the weighted value of the number of threads, and add up all the weighted values ​​to obtain the comprehensive load value; Collect all application comprehensive load values ​​for standardization; A weighted algorithm is used to combine the standardized access quantity and the standardized load value to obtain a comprehensive competitiveness indicator.

7. The watchdog circuit monitoring system according to claim 6, characterized in that: Traverse the real-time competitiveness of all high-risk applications and check whether the real-time competitiveness of each application is greater than or equal to the set competitiveness threshold; if the real-time competitiveness is greater than or equal to the competitiveness threshold, mark it as a high resource contention application; The real-time competitiveness of applications that is greater than or equal to the competitiveness threshold is recorded, and the final count value is used as the number of applications with high resource contention.

8. The watchdog circuit monitoring system according to claim 7, characterized in that: When the number of applications with high resource contention and the number of applications with high resource contention are called by the system, when the number of applications with high resource contention is greater than or equal to a preset threshold, a processing signal will be constructed and sent to the monitoring device to trigger a response mechanism; The monitoring device extracts the target application from the processed signal, multiplies the preset monitoring frequency adjustment coefficient by the existing monitoring time to obtain a new monitoring time, and monitors the number of threads connected to each application in the new monitoring cycle to obtain an updated number of applications with high resource contention.

9. The watchdog circuit monitoring system according to claim 8, characterized in that: If the number of applications with high resource contention is still greater than or equal to the preset threshold, the device will construct a secondary processing signal, including the target application ID and current resource status data, and send it to the watchdog circuit monitoring system; After receiving the secondary processing signal, the watchdog parses the signal content and extracts the target application ID and current resource status data; Compare the current resource status data with the preset resource usage threshold. When the current resource status data is greater than or equal to the resource usage threshold, the alarm mechanism is triggered, and a specific alarm message is generated according to the parsed secondary processing signal information; The alarm message includes the application id and current resource status data.

10. A watchdog circuit monitoring device, used to implement the watchdog circuit monitoring system according to any one of claims 1 to 7, characterized in that: It includes a main monitoring device and a collaborative processing device; The main monitoring device is used to count the number of connection threads of each application in the monitoring device, call historical data to obtain the application running time, obtain statistical results and application running time, judge each application in the monitoring device, and screen out high-risk applications in the monitoring device according to the judgment results; The collaborative processing device is used to mark the received high-risk applications, monitor and obtain the real-time access count and accumulated usage load of each application when the marked application is enabled, analyze the real-time competitiveness of each application, obtain the competitiveness statistics of each application and the number of high resource competition applications, and choose to formulate a processing signal to send to the watchdog or to prompt the monitoring device to tune, monitor the tuning response, set the monitoring time and combine the tuning response and the statistical update results of the number of high resource competition applications to determine whether to formulate a secondary processing signal and send it to the watchdog. After receiving the processing signal, the watchdog triggers the alarm mechanism.

Images