eBPF tool management method, device, equipment, readable storage medium and program product

Abstract

The application relates to an eBPF tool management method, device and equipment, a readable storage medium and a program product. The method comprises the following steps: acquiring dynamic link library files for a plurality of eBPF tools; the dynamic link library files encapsulate a plurality of interfaces of each eBPF tool, and the plurality of interfaces comprise an interaction interface and a printing interface; for each interface of each eBPF tool in the dynamic link library files, a corresponding calling function is registered; and a log file of each eBPF tool is initialized; when a calling command is listened to, an operation corresponding to the calling command is performed, and a processing result is returned. The method can realize unified management of a large number of eBPF tools, and makes the management simple and orderly; meanwhile, the interaction interface and the printing interface of the eBPF tool are encapsulated, and the use efficiency of the eBPF tool can be improved.

Description

Technical Field

[0001] This application relates to the fields of network technology and security technology, and in particular to an eBPF tool management method, apparatus, computer equipment, computer-readable storage medium and computer program product. Background Technology

[0002] BPF (Berkeley Packet Filter) is a network packet filtering and tracing technology that captures and filters network packets at the operating system level. It provides a raw data link layer interface, allowing the sending and receiving of raw link layer packets. eBPF (extended BPF) was originally designed for efficient network sniffing, but its functionality has been extended to allow arbitrary user-defined code to be executed in the kernel. This enables eBPF to perform a wide variety of performance analysis, debugging, security, and networking functions.

[0003] However, as eBPF applications become more widespread, the types and number of eBPF tools being developed are also increasing. Each eBPF tool runs independently and requires interaction with user space, which brings many problems to scenarios that require the use of diverse eBPF tools. For example, it is difficult to control the on / off state of related tools; it is difficult to extract the output information of related tools; and it is difficult to interact with related tools, greatly reducing the practicality of the tools.

[0004] Therefore, scenarios that require the use of multiple BPF tools suffer from low management efficiency. Summary of the Invention

[0005] Therefore, it is necessary to provide an eBPF tool management method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the management efficiency of eBPF tools in response to the above-mentioned technical problems.

[0006] Firstly, this application provides an eBPF tool management method, including:

[0007] Obtain dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces;

[0008] For each interface of each eBPF tool in the dynamic link library file, register the corresponding calling function; and initialize the log file of each eBPF tool.

[0009] When a command is detected, the operation corresponding to the command is executed, and the processing result is returned.

[0010] In one embodiment, obtaining the dynamic link library files for multiple eBPF tools includes:

[0011] Based on the relevant interfaces of each eBPF tool, generate dynamic link library files for the multiple eBPF tools;

[0012] Alternatively, it can receive dynamic link library files transmitted from other devices.

[0013] In one embodiment, the step of executing the operation corresponding to the call command when the call command is detected includes:

[0014] When a command is detected, the command is parsed.

[0015] Based on the parsing result of the invocation command, the validity of the invocation command is checked to obtain the detection result;

[0016] If the detection result is valid, the operation corresponding to the call command is executed, and the processing result is returned.

[0017] In one embodiment, parsing the call command upon detecting it includes:

[0018] When a call command is detected, the call function corresponding to the call command is determined based on the tool identifier and interface identifier carried by the call command;

[0019] Based on the called function, parse the called command.

[0020] In one embodiment, the step of performing validity checks on the calling command based on the parsing result of the calling command to obtain a detection result includes:

[0021] Based on the parsing results of the invocation command, the validity of the invocation command's function and format is checked;

[0022] The calling command is deemed valid if both its function and format are valid.

[0023] In one embodiment, the method further includes:

[0024] The event notification mechanism continuously monitors the command calls sent by the command process.

[0025] Secondly, this application also provides an eBPF tool management device, comprising:

[0026] The acquisition module is used to acquire dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces;

[0027] The preprocessing module is used to register the corresponding calling function for each interface of each eBPF tool in the dynamic link library file; and to initialize the log file of each eBPF tool.

[0028] The execution module is used to execute the operation corresponding to the call command when a call command is detected, and return the processing result.

[0029] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0030] Obtain dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces;

[0031] For each interface of each eBPF tool in the dynamic link library file, register the corresponding calling function; and initialize the log file of each eBPF tool.

[0032] When a command is detected, the operation corresponding to the command is executed, and the processing result is returned.

[0033] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0034] Obtain dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces;

[0035] For each interface of each eBPF tool in the dynamic link library file, register the corresponding calling function; and initialize the log file of each eBPF tool.

[0036] When a command is detected, the operation corresponding to the command is executed, and the processing result is returned.

[0037] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0038] Obtain dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces;

[0039] For each interface of each eBPF tool in the dynamic link library file, register the corresponding calling function; and initialize the log file of each eBPF tool.

[0040] When a command is detected, the operation corresponding to the command is executed, and the processing result is returned.

[0041] The aforementioned eBPF tool management method, apparatus, computer device, computer-readable storage medium, and computer program product encapsulate the interaction and printing interfaces of each eBPF tool to form dynamic link library files for multiple eBPF tools; register corresponding calling functions for each interface of each eBPF tool in the dynamic link library file; and initialize the log file of each eBPF tool; when a calling command is detected, the operation corresponding to the calling command is executed, and the processing result is returned. This method, employing a dynamic link library-based eBPF tool management approach, can achieve unified management of a large number of eBPF tools, making them concise and orderly; at the same time, encapsulating the interaction and printing interfaces of eBPF tools can improve the efficiency of eBPF tool usage. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart illustrating the eBPF tool management method in one embodiment;

[0044] Figure 2 This is a schematic diagram of the dynamic link library file generation process in one embodiment;

[0045] Figure 3 This is a schematic diagram illustrating the flow of the main process managed by the eBPF tool in one embodiment;

[0046] Figure 4 A flowchart illustrating the process after sending a call command to a command process managed by an eBPF tool in one embodiment;

[0047] Figure 5 This is a structural block diagram of an eBPF tool management device in one embodiment;

[0048] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0050] The eBPF tool management method provided in this application can be applied to devices that require the use of various eBPF tools to achieve various performance analysis, debugging, security, and network functions, such as servers and terminals. This embodiment uses the application of this method to a server as an example for illustration. It can be understood that this method can also be applied to other devices such as terminals, and can also be applied to systems including terminals and servers, and implemented through the interaction between the terminal and the server.

[0051] like Figure 1 The diagram illustrates the flow of the eBPF tool management method provided in this application embodiment, including the following steps:

[0052] Step S110: Obtain dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces.

[0053] Each interface of each eBPF tool is a standardized interface.

[0054] The interactive interfaces may include interfaces for initialization, uninstallation, running, adding, deleting, modifying, and querying.

[0055] The print interface is used to call the log file of the eBPF tool, which is the output information after the eBPF tool runs.

[0056] In the specific implementation, to ensure the normal operation of each eBPF tool, various interaction interfaces and printing interfaces are provided for each eBPF tool, and all interfaces of all eBPF tools are compiled into a dynamic link library file. The server can generate this dynamic link library file itself, or it can have the dynamic link library file generated by other devices and then obtain the dynamic link library file from those other devices.

[0057] Step S120: For each interface of each eBPF tool in the dynamic link library file, register the corresponding calling function; and initialize the log file of each eBPF tool.

[0058] In the specific implementation, after obtaining the dynamic link library file, the directory of the dynamic link library file is read to determine the various eBPF tools it contains and the interfaces of each eBPF tool. For each interface of each eBPF tool, a corresponding calling function is registered; that is, each interface of each eBPF tool has a corresponding calling function. Then, for each eBPF tool, a log file initialization operation is performed to obtain the output information of the eBPF tool, and this output information is saved as the initialized log file, meaning each eBPF tool has a corresponding log file. Subsequently, when the interface of an eBPF tool is called, its log file is updated accordingly, and the log file after execution can be obtained by calling the print interface of the eBPF tool.

[0059] In some embodiments, the dynamic link library file can be extended. For example, after developing a new eBPF tool, the relevant interfaces of the new eBPF tool can be encapsulated in the dynamic link library file, enabling updates to the dynamic link library file. The server can read the information of each interface of the new eBPF tool from the dynamic link library file, register the calling functions of each interface, and initialize the log file of the new eBPF tool.

[0060] In some embodiments, a main process for managing eBPF tools can be set up on the server. This main process reads dynamic link library files, registers the calling functions of each interface of each eBPF tool, and initializes the log files of each eBPF tool.

[0061] Step S130: When a call command is detected, execute the operation corresponding to the call command and return the processing result.

[0062] The invocation command carries the tool identifier and interface identifier of the eBPF tool being invoked. For example, invoking interface B of eBPF tool A.

[0063] In a specific implementation, when the server (specifically the main process) receives a call command, it extracts the tool identifier and interface identifier carried in the call command, and then executes the operation corresponding to the interface identifier in the call command corresponding to the tool identifier, and returns the processing result. In some embodiments, a command process can also be set up to send the call command to the main process. The main process receives the call command, processes it, and returns the processing result to the command process.

[0064] For example, if the command is to invoke the lookup interface of a certain eBPF tool, then when the command is detected, the call operation for the lookup interface of that eBPF tool is executed, and the processing result is returned.

[0065] The aforementioned eBPF tool management method encapsulates the interaction and printing interfaces of each eBPF tool, forming dynamic link library files for multiple eBPF tools. For each interface of each eBPF tool in the dynamic link library file, a corresponding calling function is registered. Additionally, the log file for each eBPF tool is initialized. When a call command is detected, the corresponding operation is executed, and the processing result is returned. This method, employing a dynamic link library-based eBPF tool management approach, enables unified management of a large number of eBPF tools, keeping them concise and organized. Furthermore, encapsulating the interaction and printing interfaces of eBPF tools improves their usability.

[0066] In an exemplary embodiment, step S110, obtaining dynamic link library files for multiple eBPF tools, includes: generating dynamic link library files for multiple eBPF tools based on the relevant interfaces of each eBPF tool; or receiving dynamic link library files transmitted from other devices.

[0067] In practice, the server can generate the dynamic link library files for the multiple eBPF tools it needs, for example, by standardizing and encapsulating multiple interfaces of each eBPF tool and compiling them into dynamic link library files. Alternatively, it can generate the dynamic link library files for the multiple eBPF tools it needs from other devices and then obtain those dynamic link library files from those other devices, thus obtaining the dynamic link library files for the multiple eBPF tools it needs.

[0068] More specifically, the process of generating dynamic link library files includes: first, designing a standardized interface, i.e., designing a unified interface standard; for each interface, generating a file that can implement the function of that interface, compiling the file to obtain a compiled file; and further, combining the compiled files of each interface of each eBPF tool into a dynamic link library file.

[0069] In this embodiment, by using standardized interfaces and dynamic link libraries appropriately, unified management of a large number of eBPF tools can be achieved, thereby improving management efficiency.

[0070] In an exemplary embodiment, step S130, when a call command is detected, executes the operation corresponding to the call command, including: parsing the call command when it is detected; performing a validity check on the call command based on the parsing result to obtain a check result; and if the check result is valid, executing the operation corresponding to the call command and returning the processing result.

[0071] In the implementation, upon receiving a command call, it is first parsed to obtain the parsing result. Based on this result, the validity of the command is checked. If the result indicates the command is valid, the corresponding operation is executed, and the result is returned. If the result indicates the command is invalid, meaning the operation cannot be executed, an error message is returned to prompt the user to modify the command.

[0072] In this embodiment, the command is first parsed and then its validity is checked. Only if it is valid is the command executed. This standardized command processing flow avoids invalid command processing, achieves high-performance command processing capabilities, and meets the needs of various business scenarios.

[0073] In an exemplary embodiment, when a call command is detected, parsing the call command includes: when a call command is detected, determining the call function corresponding to the call command based on the tool identifier and interface identifier carried by the call command; and parsing the call command based on the call function.

[0074] In practice, the call command carries the tool identifier and interface identifier of the eBPF tool being invoked. Before parsing the call command, the system needs to locate the call functions for each interface of each pre-registered eBPF tool based on the tool identifier and interface identifier carried in the call command. Each call function is bound to an eBPF tool and interface. Therefore, the call function corresponding to the call command can be determined based on the tool identifier and interface identifier carried in the call command. The call function is then used to parse the call command to obtain the parsing result.

[0075] In this embodiment, the call command carries a tool identifier and an interface identifier, so that the corresponding call function can be accurately determined based on the tool identifier and the interface identifier, thereby achieving accurate parsing of the call command.

[0076] In an exemplary embodiment, the validity of the calling command is checked based on the parsing result of the calling command to obtain the detection result, including: checking the validity of the function and format of the calling command based on the parsing result of the calling command; and determining that the calling command is valid when both the function and format of the calling command are valid.

[0077] In practice, the validity check of the call command includes both format and functional validity checks. The call command is considered valid if both its function and format are valid; otherwise, it is considered invalid. Specifically, the functional validity check involves searching the eBPF tool in the dynamic link library file for the function of each interface corresponding to the tool identifier carried by the call command. If an interface with the same function as the call command exists among the interfaces related to the eBPF tool, the functional validity check of the call command passes. The format validity check specifically verifies the accuracy of the command's representation text (such as its English name) in the parsed result. If the representation text is correct, the format validity check of the call command passes.

[0078] In this embodiment, by performing validity checks on the calling command in both functional and format dimensions, the reliability and accuracy of the detection results can be improved.

[0079] In one exemplary embodiment, the method further includes: cyclically listening for invocation commands sent by the command process via an event notification mechanism.

[0080] The server can have a main process and a command process. The command process sends call commands to the main process. The main process listens for call commands sent by the command process in a loop using an event notification mechanism (epoll). If a call command is detected, it determines the corresponding calling function based on the tool identifier and interface identifier carried in the call command. Based on the calling function, it parses the call command and checks its validity based on the parsing result. If the result is valid, it executes the operation corresponding to the call command and returns the processing result to the command process. epoll (event poll) is an implementation of I / O multiplexing in the Linux kernel.

[0081] In this embodiment, an event notification mechanism is used to continuously monitor the calling commands sent by the command process, so as to be able to listen for the calling commands in a timely manner and process them promptly.

[0082] To more clearly illustrate the eBPF tool management method based on dynamic link library files provided in the embodiments of this application, the following description is provided in conjunction with examples in the accompanying drawings.

[0083] This method provides a more convenient and practical approach for scenarios involving the simultaneous use of multiple eBPF tools. The implementation process mainly consists of three parts: 1. The eBPF tool encapsulates the standard usage interface and compiles it into a dynamic link library file; 2. A main process reads the dynamic link library file, processes and prints relevant information, and receives and processes call commands; 3. A secondary process (such as a command process) sends call commands to control the eBPF tool. The main process is responsible for the normal operation of the eBPF tool, while the secondary process is responsible for calling the eBPF tool.

[0084] (1) Generate dynamic link library files for multiple eBPF tools.

[0085] refer to Figure 2 To ensure the normal operation of the eBPF tool, interactive interfaces such as initialization, uninstallation, running, adding, deleting, modifying, and querying are provided, as well as a printing interface for retrieving the eBPF tool's log file (output information). These interfaces are standardized and encapsulated, and then compiled into dynamic link library files.

[0086] Step (1) provides the dynamic link library files and standard interfaces for the eBPF tool.

[0087] (2) The flow of the main process managed by the eBPF tool.

[0088] refer to Figure 3 This is a schematic diagram of the process implemented by the main process of the eBPF tool management system. It is mainly divided into four parts: 1. Reading the dynamic link library file directory; 2. Registering the calling functions of the standard interface; 3. Initializing the log file and saving the output information of the eBPF tool; 4. Listening for the calling commands in a loop using epoll.

[0089] After completing the management framework of the eBPF tool through steps (1) and (2), you can enter the application stage.

[0090] (3) The process after the command process managed by the eBPF tool sends the call command.

[0091] refer to Figure 4 This is a flowchart illustrating the process after the eBPF tool management command process sends a call command. It mainly includes five parts: 1. The command process sends the call command; 2. The main process receives the call command; 3. The main process parses the call command according to the standard interface call function; 4. The main process checks the validity of the call command; 5. If the call command is valid, the main process completes the operation of the call command and returns the processing result.

[0092] The eBPF tool management method based on dynamic linking provided in this embodiment facilitates the management of the registration, uninstallation, tracking, and interaction of various eBPF tools. The tracked information is categorized, allowing for a rapid assessment of the actual effectiveness of each eBPF tool.

[0093] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0094] Based on the same inventive concept, this application also provides an eBPF tool management device for implementing the eBPF tool management method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more eBPF tool management device embodiments provided below can be found in the limitations of the eBPF tool management method described above, and will not be repeated here.

[0095] In one exemplary embodiment, such as Figure 5 As shown, an eBPF tool management device is provided, comprising:

[0096] The acquisition module 510 is used to acquire dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces.

[0097] The preprocessing module 520 is used to register the corresponding calling function for each interface of each eBPF tool in the dynamic link library file; and to initialize the log file of each eBPF tool.

[0098] The execution module 530 is used to execute the operation corresponding to the call command when a call command is detected, and return the processing result.

[0099] In one embodiment, the acquisition module 510 is further configured to generate dynamic link library files for multiple eBPF tools based on the relevant interfaces of each eBPF tool; or to receive dynamic link library files transmitted by other devices.

[0100] In one embodiment, the execution module 530 is further configured to, upon receiving a call command, parse the call command; perform a validity check on the call command based on the parsing result, and obtain a check result; if the check result is valid, execute the operation corresponding to the call command and return the processing result.

[0101] In one embodiment, the execution module 530 is further configured to, upon detecting a call command, determine the call function corresponding to the call command based on the tool identifier and interface identifier carried by the call command; and parse the call command based on the call function.

[0102] In one embodiment, the execution module 530 is further configured to perform validity checks on the function and format of the calling command based on the parsing result of the calling command; and determine that the calling command is valid when both the function and format of the calling command are valid.

[0103] In one embodiment, the device further includes a listening module for cyclically listening for invocation commands sent by the command process via an event notification mechanism.

[0104] Each module in the aforementioned eBPF tool management device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0105] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data from the eBPF tool management method implementation process, such as dynamic link library files. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements an eBPF tool management method.

[0106] Those skilled in the art will understand that Figure 6The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0107] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0108] Obtain dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces;

[0109] For each interface of each eBPF tool in the dynamic link library file, register the corresponding calling function; and initialize the log file of each eBPF tool.

[0110] When a command is detected, the operation corresponding to the command is executed, and the processing result is returned.

[0111] In one embodiment, when the processor executes the computer program, it further performs the following steps: generating dynamic link library files for the plurality of eBPF tools according to the relevant interfaces of each eBPF tool; or receiving dynamic link library files transmitted by other devices.

[0112] In one embodiment, when the processor executes a computer program, it further performs the following steps: upon receiving a call command, it parses the call command; based on the parsing result of the call command, it performs a validity check on the call command and obtains a check result; if the check result is valid, it executes the operation corresponding to the call command and returns a processing result.

[0113] In one embodiment, when the processor executes a computer program, it further performs the following steps: upon detecting a call command, determining the call function corresponding to the call command based on the tool identifier and interface identifier carried by the call command; and parsing the call command based on the call function.

[0114] In one embodiment, when the processor executes the computer program, it further performs the following steps: based on the parsing result of the calling command, it performs a validity check on the function and format of the calling command; when both the function and format of the calling command are valid, it determines that the calling command is valid.

[0115] In one embodiment, when the processor executes a computer program, it also performs the following steps: cyclically listening for invocation commands sent by the command process via an event notification mechanism.

[0116] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0117] Obtain dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces;

[0118] For each interface of each eBPF tool in the dynamic link library file, register the corresponding calling function; and initialize the log file of each eBPF tool.

[0119] When a command is detected, the operation corresponding to the command is executed, and the processing result is returned.

[0120] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: generating dynamic link library files for the plurality of eBPF tools according to the relevant interfaces of each eBPF tool; or receiving dynamic link library files transmitted by other devices.

[0121] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving a call command, parses the call command; based on the parsing result of the call command, performs a validity check on the call command to obtain a check result; if the check result is valid, executes the operation corresponding to the call command and returns a processing result.

[0122] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving a call command, determining the call function corresponding to the call command based on the tool identifier and interface identifier carried by the call command; and parsing the call command based on the call function.

[0123] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: based on the parsing result of the calling command, performs a validity check on the function and format of the calling command; and when both the function and format of the calling command are valid, determines that the calling command is valid.

[0124] In one embodiment, when the computer program is executed by the processor, it also performs the following steps: cyclically listening for invocation commands sent by the command process through an event notification mechanism.

[0125] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0126] Obtain dynamic link library files for multiple eBPF tools; the dynamic link library files encapsulate multiple interfaces for each eBPF tool, including interactive interfaces and printing interfaces;

[0127] For each interface of each eBPF tool in the dynamic link library file, register the corresponding calling function; and initialize the log file of each eBPF tool.

[0128] When a command is detected, the operation corresponding to the command is executed, and the processing result is returned.

[0129] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: generating dynamic link library files for the plurality of eBPF tools according to the relevant interfaces of each eBPF tool; or receiving dynamic link library files transmitted by other devices.

[0130] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving a call command, parses the call command; based on the parsing result of the call command, performs a validity check on the call command to obtain a check result; if the check result is valid, executes the operation corresponding to the call command and returns a processing result.

[0131] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving a call command, determining the call function corresponding to the call command based on the tool identifier and interface identifier carried by the call command; and parsing the call command based on the call function.

[0132] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: based on the parsing result of the calling command, performs a validity check on the function and format of the calling command; and when both the function and format of the calling command are valid, determines that the calling command is valid.

[0133] In one embodiment, when the computer program is executed by the processor, it also performs the following steps: cyclically listening for invocation commands sent by the command process through an event notification mechanism.

[0134] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0135] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0136] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for managing eBPF tools, characterized in that, The method includes: Design a unified interface standard; For each interface of each eBPF tool, generate a file that implements the functionality of that interface, and compile the file to obtain a compiled file; The compiled files of each interface of each eBPF tool are combined into a dynamic link library file; the interface of each eBPF tool includes an interactive interface and a log file printing interface for calling the eBPF tool; The main process, managed by the eBPF tools, reads the directory of the dynamic link library files, determines the various eBPF tools and interfaces contained therein, registers the corresponding calling functions for each interface of each eBPF tool, and initializes the log files of each eBPF tool. When the main process detects a call command sent by the command process, it executes the operation corresponding to the call command and returns the processing result; the call command carries the identifier of the tool being called and the identifier of the interface; the main process listens for call commands sent by the command process in a loop through an event notification mechanism.

2. The method according to claim 1, characterized in that, The methods for obtaining the dynamic link library files also include: Receive dynamic link library files transmitted from other devices.

3. The method according to claim 1, characterized in that, When the main process detects a call command sent by the command process, the operation corresponding to the call command is executed, including: When a command is detected, the command is parsed. Based on the parsing result of the invocation command, the validity of the invocation command is checked to obtain the detection result; If the detection result is valid, the operation corresponding to the call command is executed, and the processing result is returned.

4. The method according to claim 3, characterized in that, The step of parsing the call command upon receiving it includes: When a call command is detected, the call function corresponding to the call command is determined based on the tool identifier and interface identifier carried by the call command; Based on the called function, parse the called command.

5. The method according to claim 3, characterized in that, The step of performing validity checks on the calling command based on the parsing result of the calling command, and obtaining the check result, includes: Based on the parsing results of the invocation command, the validity of the invocation command's function and format is checked; The calling command is deemed valid if both its function and format are valid.

6. The method according to claim 1, characterized in that, The method further includes: When a new eBPF tool emerges, the relevant interfaces of the new eBPF tool are encapsulated into the dynamic link library file to dynamically extend the dynamic link library file.

7. An eBPF tool management device, characterized in that, The device includes: The module is used to design a unified interface standard; for each interface of each eBPF tool, a file that implements the function of the interface is generated, and the file is compiled to obtain a compiled file; the compiled files of each interface of each eBPF tool are combined into a dynamic link library file; the interface of each eBPF tool includes an interactive interface and a log file printing interface for calling the eBPF tool. The preprocessing module is used to read the directory of the dynamic link library file through the main process managed by the eBPF tools, determine the various eBPF tools and the various interfaces of each eBPF tool, register the corresponding calling function for each interface of each eBPF tool, and initialize the log file of each eBPF tool. The execution module is used to execute the operation corresponding to the call command when the main process listens for the call command sent by the command process, and return the processing result; the call command carries the tool identifier and interface identifier to be called; the main process listens for the call commands sent by the command process in a loop through an event notification mechanism.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images