High-level memory performance monitoring and anomaly detection method, system and equipment

Abstract

The invention provides an advanced memory performance monitoring and anomaly detection method, system and device, and relates to the technical field of memory monitoring, and the method comprises the steps: capturing a current memory operation executed by a monitored kernel and corresponding operation data through a memory delay monitoring module based on a kernel tracking point mechanism, the memory delay alarm module is used for judging whether memory delay alarm is performed for a monitored kernel; under the condition that the judgment result is yes, constructing a memory delay diagnosis event corresponding to the monitored kernel based on the operation data through a diagnosis event generation module; and through a diagnosis event distribution module, the memory delay diagnosis event is added to the to-be-processed diagnosis event queue, so that the memory diagnosis framework processes the memory delay diagnosis event contained in the to-be-processed diagnosis event queue, and a performance monitoring and anomaly detection result corresponding to the monitored kernel is obtained. According to the method, the monitoring fine granularity can be remarkably improved, and the false alarm and missing alarm conditions in the performance monitoring and abnormity monitoring process are reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of memory monitoring, in particular to a high-level memory performance monitoring and abnormality detection method, system and device. BACKGROUND

[0002] With the rapid development of computer technology, the requirements for memory performance in the fields of high-performance computing, cloud computing and embedded systems are becoming higher and higher. As one of the core components of a computer system, memory directly affects the response time of an application program and the overall throughput of a system. In the prior art, memory performance monitoring has become an important means for system optimization and fault diagnosis. At present, memory performance monitoring mainly relies on the following methods: system-level monitoring tools, performance counters and simple threshold alarm mechanisms. However, the above methods usually have the problems of false positives / false negatives, insufficient monitoring granularity, etc. SUMMARY

[0003] Therefore, the purpose of the present application is to provide a high-level memory performance monitoring and abnormality detection method, system and device, which can significantly improve the monitoring granularity and reduce false positives / false negatives in the performance monitoring and abnormality detection process.

[0004] In a first aspect, the present application provides a high-level memory performance monitoring and abnormality detection method applied to a memory performance monitoring system, wherein the memory performance monitoring system is integrated with a memory diagnosis framework, and the memory performance monitoring system comprises a memory delay monitoring module, a diagnosis event occurrence module and a diagnosis event distribution module, and the method comprises the following steps: Through the memory delay monitoring module, the current memory operation performed by the monitored kernel and the corresponding operation data thereof are captured based on a kernel tracepoint mechanism, so as to determine whether to perform memory delay alarm for the monitored kernel; If the determination result is yes, the diagnosis event occurrence module is used to construct a memory delay diagnosis event corresponding to the monitored kernel based on the operation data; The diagnosis event distribution module is used to add the memory delay diagnosis event to a to-be-processed diagnosis event queue, so that the memory diagnosis framework processes the memory delay diagnosis event contained in the to-be-processed diagnosis event queue, and obtains the performance monitoring and abnormality detection result corresponding to the monitored kernel.

[0005] In an embodiment, the memory delay monitoring module comprises a memory delay event capture module and an alarm throttling control module; through the memory delay monitoring module, the current memory operation performed by the monitored kernel and the corresponding operation data thereof are captured based on a kernel tracepoint mechanism, so as to determine whether to perform alarm for the monitored kernel, which comprises the following steps: The memory latency event capture module captures the current memory operations executed by the monitored kernel and their corresponding operation data based on the kernel tracepoint mechanism. The operation data includes operation latency time, process information and event type. Based on the target latency threshold and operation latency time corresponding to the event type, determine whether a memory latency event has occurred in the monitored kernel; If so, the alarm throttling control module will issue an alarm for memory latency events occurring in the monitored kernel.

[0006] In one implementation, a tracepoint is associated with a specified memory operation to link the specified memory operation with a callback function; a memory latency event capture module captures the current memory operation executed by the monitored kernel and its corresponding operation data based on the kernel tracepoint mechanism, including: If the current memory operation being performed by the monitored kernel is a specified memory operation, the callback function associated with the current memory operation is triggered to capture the operation data corresponding to the current memory operation.

[0007] In one implementation, the memory latency monitoring module further includes a configurable threshold management module, which stores a default latency threshold corresponding to each event type; the method further includes: The configurable threshold management module receives the target latency threshold uploaded by the user for the event type and replaces the default latency threshold corresponding to the event type with the target latency threshold.

[0008] In one implementation, alerts are issued for memory latency events occurring in the monitored kernel, including: When the alarm throttling control state corresponding to the event type is enabled, alarms are issued for memory delay events occurring in the monitored kernel based on the alarm throttling time window.

[0009] In one implementation, alerting for memory latency events occurring in the monitored kernel based on an alert throttling time window further includes: Obtain the alarm throttling time window corresponding to the event type. The start time of the alarm throttling time window is the time when the previous alarm for the memory delay event of the event type was issued, and the end time of the alarm throttling time window is determined based on the preset alarm throttling cycle. If the occurrence time of a memory latency event falls within the alarm throttling time window, and the alarm throttling control status corresponding to the event type is determined to be alarm-disallowed, then alarms for memory latency events occurring in the monitored kernel are prohibited. If the occurrence time of a memory delay event is outside the alarm throttling time window, and the alarm throttling control status corresponding to the event type is determined to be alarm-allowed, then an alarm will be issued for the memory delay event occurring in the monitored kernel.

[0010] In one implementation, constructing a memory latency diagnostic event corresponding to the monitored kernel based on operational data includes: Obtain the preset standard diagnostic event structure; The latency severity level is determined based on the target latency threshold and memory latency events. The latency severity level, the occurrence time of the memory latency event, the event type, and process information are then filled into the standard diagnostic event structure to obtain the memory latency diagnostic event corresponding to the monitored kernel.

[0011] Secondly, the present invention also provides a memory performance monitoring system, which is integrated with a memory diagnostic framework. The memory performance monitoring system includes a memory latency monitoring module, a diagnostic event generation module, and a diagnostic event distribution module. The memory latency monitoring module is used to capture the current memory operations and their corresponding operation data executed by the monitored kernel based on the kernel tracepoint mechanism, in order to determine whether to issue a memory latency alarm for the monitored kernel. If the judgment result is yes, the diagnostic event generation module is used to construct a memory latency diagnostic event corresponding to the monitored kernel based on the operation data. The diagnostic event distribution module is used to add memory latency diagnostic events to the queue of diagnostic events to be processed, so that the memory diagnostic framework can process the memory latency diagnostic events contained in the queue of diagnostic events to be processed and obtain the performance monitoring and anomaly detection results corresponding to the monitored kernel.

[0012] Thirdly, the present invention also provides an electronic device including a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement any of the methods provided in the first aspect.

[0013] Fourthly, the present invention also provides a computer-readable storage medium storing computer-executable instructions, which, when invoked and executed by a processor, cause the processor to implement any of the methods provided in the first aspect.

[0014] This invention provides an advanced memory performance monitoring and anomaly detection method, system, and device. The memory performance monitoring system is integrated with a memory diagnostic framework. The memory performance monitoring system includes a memory latency monitoring module, a diagnostic event generation module, and a diagnostic event distribution module. First, the memory latency monitoring module captures the current memory operations executed by the monitored kernel and their corresponding operation data based on the kernel tracepoint mechanism to determine whether a memory latency alarm should be issued for the monitored kernel. Then, if the determination result is yes, the diagnostic event generation module constructs a memory latency diagnostic event corresponding to the monitored kernel based on the operation data. Finally, the diagnostic event distribution module adds the memory latency diagnostic event to a queue of pending diagnostic events so that the memory diagnostic framework can process the memory latency diagnostic events contained in the queue to obtain the performance monitoring and anomaly detection results corresponding to the monitored kernel. The above method utilizes the kernel tracepoint mechanism to capture the current memory operations executed by the monitored kernel and their corresponding operation data, accurately capturing different types of memory latency events and providing more granular observation capabilities. Based on this, memory latency diagnostic events are constructed and distributed, and memory latency diagnostic events are processed using a memory diagnostic framework integrated with the memory performance monitoring system. This invention can significantly improve the granularity of monitoring and reduce false alarms and missed alarms in the performance monitoring and anomaly detection process.

[0015] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0016] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an advanced memory performance monitoring and anomaly detection method provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the architecture of a memory performance monitoring system provided in an embodiment of the present invention; Figure 3A complete flowchart of memory latency monitoring provided in an embodiment of the present invention; Figure 4 A complete flowchart of a diagnostic event handling method provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Currently, memory performance monitoring mainly relies on the following methods: (1) System-level monitoring tools, such as vmstat, free, top, etc.: These tools can only provide system-level memory usage statistics, but cannot be accurate to the specific memory access operation latency, and lack fine-grained observation capabilities; (2) Performance counters: Although they can provide hardware-level memory access statistics, they cannot distinguish different types of memory operations, and the configuration is complex, making it difficult to integrate into systems that require real-time monitoring; (3) Simple threshold alarm mechanism: Existing technologies usually use fixed thresholds for alarms, which cannot be dynamically adjusted according to system load and operating status, and are prone to generating a large number of false alarms or missed alarms.

[0021] Therefore, the main problems with existing technologies include: (1) insufficient granularity: unable to accurately capture and analyze specific types of memory latency events; (2) poor adaptability: unable to dynamically adjust monitoring parameters according to system status; (3) low alarm accuracy: fixed thresholds are prone to false alarms or missed alarms; (4) lack of contextual association: existing monitoring methods often only report memory latency events in isolation, unable to associate them with specific processes, operation types and system status, making it difficult to perform root cause analysis; (5) lack of unified diagnostic framework integration: the memory monitoring system lacks effective integration with the overall system diagnostic framework, resulting in a fragmented process for discovering and handling memory problems, affecting the rapid location and resolution of problems. These problems make it difficult for system administrators and developers to identify memory performance bottlenecks in real time and accurately, and to take timely measures to optimize system performance, thereby affecting the stability and reliability of the entire system.

[0022] Based on this, the present invention provides an advanced memory performance monitoring and anomaly detection method, system and device, which aims to solve the above-mentioned problems existing in the prior art. Specifically: (1) Fine-grained monitoring problem: The embodiments of the present invention utilize the kernel tracepoint mechanism to accurately capture memory latency events of different types (memory swapping, memory compression, copy-on-write), providing more fine-grained observation capabilities; (2) Dynamic threshold adjustment problem: The embodiments of the present invention implement a configurable threshold management mechanism, allowing users to dynamically adjust the latency threshold of various types of memory operations according to system characteristics and business needs; (3) Alarm accuracy problem: The embodiments of the present invention introduce an alarm throttling mechanism to effectively control the alarm frequency, reduce false alarms and false negatives, and improve the accuracy and effectiveness of alarms; (4) Context association problem: When capturing memory latency events, the embodiments of the present invention simultaneously record relevant process information, operation type and event ID and other context data, which facilitates root cause analysis of problems; (5) System integration problem: The embodiments of the present invention seamlessly integrate the memory monitoring module with the system diagnostic framework to realize a unified event processing and distribution mechanism.

[0023] To facilitate understanding of this embodiment, a detailed description of an advanced memory performance monitoring and anomaly detection method disclosed in this embodiment of the invention will be provided first. This method is applied to a memory performance monitoring system, which is integrated with a memory diagnostic framework. The memory performance monitoring system includes a memory latency monitoring module, a diagnostic event generation module, and a diagnostic event distribution module. See [link to relevant documentation]. Figure 1 The diagram shows a flowchart of an advanced memory performance monitoring and anomaly detection method, which mainly includes the following steps S102 to S106: Step S102: The memory latency monitoring module captures the current memory operations and corresponding operation data executed by the monitored kernel based on the kernel tracepoint mechanism to determine whether to issue a memory latency alarm for the monitored kernel.

[0024] The kernel tracepoint mechanism can be understood as pre-configuring tracepoints associated with specified memory operations. These tracepoints are used to associate specified memory operations with callback functions. When the current memory operation being monitored by the kernel is a specified memory operation, the callback function is triggered to collect corresponding operation data (such as operation delay time, process information, and event type). A configurable threshold management mechanism and alarm throttling mechanism are introduced to determine whether to issue a memory delay alarm.

[0025] Step S104: If the judgment result is yes, construct the memory latency diagnostic event corresponding to the monitored kernel based on the operation data through the diagnostic event generation module.

[0026] In one example, a standard diagnostic event structure is pre-configured. The severity level of the latency, the occurrence time of the memory latency event, the event type, and process information are filled into the standard diagnostic event structure to obtain the memory latency diagnostic event corresponding to the monitored kernel.

[0027] Step S106: The memory latency diagnostic event is added to the pending diagnostic event queue through the diagnostic event distribution module, so that the memory diagnostic framework can process the memory latency diagnostic events contained in the pending diagnostic event queue and obtain the performance monitoring and anomaly detection results corresponding to the monitored kernel.

[0028] The queue of pending diagnostic events stores multiple memory latency diagnostic events. In one example, the interface of the memory diagnostic framework is called to add a memory latency diagnostic event to the queue of pending diagnostic events. This wakes up the worker thread of the memory diagnostic framework to process the memory latency diagnostic events in the queue and obtain the corresponding results.

[0029] To facilitate understanding, the system architecture of the memory performance monitoring system will first be explained. (See [link to documentation]). Figure 2 The diagram shows the architecture of a memory performance monitoring system, which includes a user space and a kernel space. The user space includes a user configuration interface module and a diagnostic framework integration module. The kernel space includes a memory latency monitoring module, a diagnostic event generation module, and a diagnostic event distribution module. The memory latency monitoring module further includes a memory latency event capture module, a configurable threshold management module, and an alarm throttling control module.

[0030] The system includes the following modules: A memory latency event capture module, responsible for capturing latency events of various memory operations via the kernel tracepoint mechanism; a configurable threshold management module, providing a user-configurable threshold setting interface to support dynamic adjustment of latency thresholds for various memory operations; an alarm throttling control module, controlling alarm frequency to prevent a large number of repetitive alarms from occurring in a short period; a diagnostic event generation module, converting memory latency events into a standard diagnostic event format; a diagnostic event distribution module, responsible for distributing diagnostic events to the appropriate processing components; a user configuration interface module, providing a proc filesystem interface to allow users to dynamically configure monitoring parameters; and a diagnostic framework integration module, enabling seamless integration with the system's diagnostic framework.

[0031] Based on the above system architecture, this embodiment of the invention provides a specific implementation method for an advanced memory performance monitoring and anomaly detection method.

[0032] (a) Memory latency monitoring, see Figure 3 The diagram shows a complete flowchart for memory latency monitoring, including the initialization phase, event capture phase, threshold check phase, alarm throttling phase, diagnostic event generation phase, and event distribution phase. Specifically: (1.1) Initialization phase.

[0033] In practical applications, the memory latency monitoring function is implemented as a kernel module, which is dynamically loaded and unloaded using the insmod / rmmod commands. Then, the module is initialized, including registering tracepoint callbacks, proc file system interfaces, and integrating the diagnostic framework.

[0034] In practical implementation: (a) Register a tracepoint callback function and associate it with a specified memory operation in the kernel. This can be understood as associating a specified memory operation with a tracepoint, so that the specified memory operation and the callback function can be associated through the tracepoint.

[0035] (b) Initialize the default latency threshold for each type of memory operation.

[0036] (c) Initialize alarm throttling control parameters, which may include alarm intervals.

[0037] (d) Register the proc filesystem interface for users to configure latency thresholds for various types of memory operations. In practical applications, create a subdirectory named mem_delay_alarm under the / proc / sys / kernel / directory and provide the following configuration file: swapin_delay_threshold: Swapin operation delay threshold (nanoseconds); compact_delay_threshold: The latency threshold (nanoseconds) for memory compression operations; wpcopy_delay_threshold: The delay threshold (nanoseconds) for copy-on-write operations; alarm_interval: Alarm interval time (milliseconds); enabled: Module enable state (0 / 1).

[0038] Furthermore, embodiments of the present invention also provide the following configuration information: # Set the swapin operation latency threshold to 100 microseconds: echo 100000> / proc / sys / kernel / mem_delay_alarm / swapin_delay_threshold; # Set the alarm interval to 5 seconds: echo 5000> / proc / sys / kernel / mem_delay_alarm / alarm_interval; # Enable memory latency monitoring module: echo 1> / proc / sys / kernel / mem_delay_alarm / enabled.

[0039] (1.2) Event capture phase: The memory latency event capture module captures the current memory operations and their corresponding operation data executed by the monitored kernel based on the kernel tracepoint mechanism. Specifically, when the current memory operation executed by the monitored kernel is a specified memory operation, the callback function associated with the current memory operation is triggered, and the operation data corresponding to the current memory operation is captured. This operation data includes the operation latency time, process information, and event type.

[0040] For example, when the kernel executes specified memory operations such as swapin, compact, and wpcopy, it triggers the corresponding tracepoint callback function. The tracepoint callback function captures operation data such as operation latency, process information, and event type. For instance, during system operation, when the kernel executes a swapin operation, it triggers the tracepoint callback function, which captures the operation latency as 150 microseconds.

[0041] This invention utilizes the kernel tracepoint mechanism to accurately capture latency information for different types of memory operations (memory swapping, memory compression, copy-on-write, etc.), thereby achieving fine-grained monitoring.

[0042] Furthermore, embodiments of the present invention may also employ lightweight callback functions to ensure that the execution time of the tracepoint callback function is as short as possible, thereby avoiding impact on the performance of the monitored memory operations.

[0043] Furthermore, under high load conditions, a sampling mechanism can be implemented to monitor only a portion of memory operations, reducing system overhead.

[0044] (1.3) Threshold check stage: The configurable threshold management module stores the default latency threshold for each event type. It receives target latency thresholds uploaded by users for each event type and replaces the default latency thresholds for those event types with these target thresholds. Specifically, a user-configurable interface is provided through the proc file system, supporting dynamic adjustment of the target latency thresholds for various memory operation types, thus enhancing system adaptability.

[0045] Based on this, and according to the target latency threshold and operation latency time corresponding to the event type, it is determined whether a memory latency event has occurred in the monitored kernel. For example, if the operation latency time is greater than the target latency threshold, a memory latency event is determined to have occurred. Please continue to refer to the example above, where the operation latency time is 150 microseconds and the target latency threshold is 100 microseconds, meaning the operation latency time is greater than the target latency threshold, thus a memory latency event is determined to have occurred.

[0046] (1.4) Alarm throttling stage: In the event of a memory delay event, the alarm throttling control module will issue an alarm for the memory delay event that occurred in the monitored kernel.

[0047] First, check the alarm throttling control status to determine whether the current alarm is allowed. For example, if the alarm throttling control status corresponding to the event type is enabled (the alarm throttling control status value is 1), determine whether to issue an alarm for memory latency events occurring in the monitored kernel based on the alarm throttling time window; conversely, if the alarm throttling control status corresponding to the event type is disabled (the alarm throttling control status value is 0), an alarm can be directly issued for memory latency events occurring in the monitored kernel.

[0048] The steps for issuing alerts for memory latency events occurring in the monitored kernel based on the alert throttling time window include: (a) Obtain the alarm throttling time window corresponding to the event type. The start time of the alarm throttling time window is the time when the previous alarm for the memory delay event of the event type was issued, and the end time of the alarm throttling time window is determined based on the preset alarm throttling period.

[0049] (b) If the occurrence time of a memory delay event is within the alarm throttling time window, and the alarm throttling control status corresponding to the event type is determined to be alarm-disallowed, then alarms for memory delay events occurring in the monitored kernel are prohibited. (c) If the occurrence time of a memory latency event is outside the alarm throttling time window, and the alarm throttling control state corresponding to the event type is determined to be alarm-allowed, then an alarm is issued for the memory latency event occurring in the monitored kernel. Please refer to the previous example. The alarm interval is 5 seconds. If the same type of memory latency event is captured again within 5 seconds, no alarm is issued.

[0050] This invention implements alarm frequency control based on time windows, effectively reducing duplicate alarms and optimizing system resource utilization. Furthermore, it can dynamically adjust monitoring granularity and alarm thresholds according to system load, optimizing resource utilization while ensuring monitoring effectiveness.

[0051] In another implementation, an alarm count constraint can be added. For example, if the number of times a certain type of memory delay event occurs exceeds a preset threshold, then no alarm will be issued for that type of memory delay event.

[0052] (1.5) Diagnostic event generation phase: Obtain the preset standard diagnostic event structure; determine the latency severity level based on the target latency threshold and memory latency events, and fill the latency severity level, the occurrence time of the memory latency event, the event type and process information into the standard diagnostic event structure to obtain the memory latency diagnostic event corresponding to the monitored kernel.

[0053] For example, a memory latency diagnostic event includes the following key fields: Event ID: uniquely identifies the event type; Severity: indicates the severity of the problem; Occurrence Time: timestamp of the event occurrence; Process Information: PID and name of the relevant process; Latency Time: the actual measured latency value.

[0054] This invention provides a context-dependent memory latency event handling technique that, when capturing memory latency events, simultaneously records relevant process information, operation type, and event ID, etc., to facilitate root cause analysis of problems.

[0055] (1.6) Event distribution phase: In one example, a diagnostic event can be sent by calling the `diagnose_send_event` interface to add a memory latency diagnostic event to the pending diagnostic event queue. This embodiment of the invention integrates the memory monitoring module with the system diagnostic framework through a standardized interface, unifying the event handling and distribution process.

[0056] (ii) Diagnostic event handling, see [link / reference] Figure 4 The diagram illustrates a complete flowchart for handling diagnostic events, including: a diagnostic worker thread retrieving events to be processed; determining a processing strategy based on the event level and type; recording, analyzing, or reporting the events; and triggering corresponding processing actions as needed. In practical applications, processing strategies corresponding to event levels and types can be pre-configured. These strategies describe at least one processing action, which is then triggered according to the strategy. Furthermore, batch processing can be employed to reduce frequent thread scheduling and context switching in the handling of diagnostic events.

[0057] In summary, the key technical mechanisms of the embodiments of the present invention include: (1) Tracepoint event capture mechanism: By utilizing the tracepoint mechanism provided by the kernel, observation points are set at key memory operation points to accurately capture operation latency information. By registering specific tracepoint callback functions, non-intrusive monitoring of memory operations can be achieved without modifying the kernel core code.

[0058] (2) Configurable threshold management mechanism: The system provides a user configuration interface through the proc file system, allowing dynamic adjustment of latency thresholds for different types of memory operations. This enables the system to flexibly set appropriate alarm conditions according to different application scenarios and system characteristics, improving the adaptability and accuracy of monitoring.

[0059] (3) Alarm throttling control mechanism: Implement alarm throttling control based on time window to avoid generating a large number of duplicate alarms in a short period of time. By recording the timestamp and count of each alarm, the frequency of alarms can be effectively controlled, reducing system overhead, while ensuring that important alarms are not missed.

[0060] (4) Diagnostic framework integration mechanism: The memory monitoring module is seamlessly integrated with the system diagnostic framework to unify the event handling and distribution process. By calling the standard interface provided by the diagnostic framework, it can be ensured that memory latency events can be correctly processed, recorded and reported, which facilitates system administrators to analyze and handle problems.

[0061] Based on the aforementioned key technical mechanisms, the embodiments of the present invention can achieve the following technical effects: (1) Improve the accuracy of performance problem detection: fine-grained event capture can accurately identify specific types of memory latency problems; configurable threshold management allows alarm conditions to be adjusted according to actual needs.

[0062] (2) Reduce system operation and maintenance costs: Automated monitoring and alarm mechanisms reduce manual intervention; a unified diagnostic framework simplifies the problem handling process; rich contextual information accelerates problem localization.

[0063] (3) Enhance system stability: promptly detect memory performance problems and avoid performance degradation; a precise alarm mechanism ensures that important problems are handled in a timely manner; reasonable resource use ensures that the monitoring system itself does not become a performance bottleneck.

[0064] (4) Simplify the problem diagnosis process: The associated process information and event types facilitate root cause analysis; the unified diagnostic framework provides a consistent problem handling experience; and the standardized event format facilitates subsequent analysis and processing.

[0065] (5) Improve user experience: Reduce application response time by optimizing memory performance; stable system performance provides a better user experience; and fast problem response and handling reduce service interruption time.

[0066] The embodiments of the present invention can be extended to the following scenarios: (1) Container environment monitoring: For containerized environments, the monitoring capabilities can be extended, and container ID and namespace information can be associated to achieve more granular container-level memory performance monitoring; (2) Distributed system monitoring: The memory latency monitoring of a single machine can be extended to a distributed environment to achieve cross-node memory performance analysis and optimization; (3) Specific application monitoring: For critical applications, dedicated monitoring configurations can be provided to achieve application-level memory performance assurance; (4) Predictive analysis: Based on historical memory latency data, predictive analysis functions can be implemented to discover potential performance problems in advance.

[0067] Based on the foregoing embodiments, this invention provides a memory performance monitoring system integrated with a memory diagnostic framework. The memory performance monitoring system includes a memory latency monitoring module, a diagnostic event generation module, and a diagnostic event distribution module. The memory latency monitoring module is used to capture the current memory operations and their corresponding operation data executed by the monitored kernel based on the kernel tracepoint mechanism, in order to determine whether to issue a memory latency alarm for the monitored kernel. If the judgment result is yes, the diagnostic event generation module is used to construct a memory latency diagnostic event corresponding to the monitored kernel based on the operation data. The diagnostic event distribution module is used to add memory latency diagnostic events to the queue of diagnostic events to be processed, so that the memory diagnostic framework can process the memory latency diagnostic events contained in the queue of diagnostic events to be processed and obtain the performance monitoring and anomaly detection results corresponding to the monitored kernel.

[0068] The system provided in this embodiment of the invention has the same implementation principle and technical effects as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0069] This invention provides an electronic device, specifically, the electronic device includes a processor and a memory; the memory stores a computer program, which, when run by the processor, executes the method described in any of the above embodiments.

[0070] Figure 5 The present invention provides a schematic diagram of the structure of an electronic device 100, which includes a processor 50, a memory 51, a bus 52 and a communication interface 53. The processor 50, the communication interface 53 and the memory 51 are connected through the bus 52. The processor 50 is used to execute executable modules, such as computer programs, stored in the memory 51.

[0071] The memory 51 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 53 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0072] Bus 52 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0073] The memory 51 is used to store programs. After receiving an execution instruction, the processor 50 executes the programs. The method executed by the device for defining the flow process disclosed in any of the foregoing embodiments of the present invention can be applied to the processor 50 or implemented by the processor 50.

[0074] Processor 50 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 50 or by instructions in software form. Processor 50 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 51. The processor 50 reads the information in memory 51 and, in conjunction with its hardware, completes the steps of the above method.

[0075] The computer program product of the readable storage medium provided in the embodiments of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the foregoing method embodiments. For specific implementation, please refer to the foregoing method embodiments, which will not be repeated here.

[0076] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0077] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An advanced memory performance monitoring and anomaly detection method, characterized in that, The method, applied to a memory performance monitoring system integrated with a memory diagnostic framework, includes a memory latency monitoring module, a diagnostic event generation module, and a diagnostic event distribution module. The memory latency monitoring module captures the current memory operations performed by the monitored kernel and their corresponding operation data based on the kernel tracepoint mechanism, in order to determine whether to issue a memory latency alarm for the monitored kernel. If the judgment result is yes, the diagnostic event generation module constructs a memory latency diagnostic event corresponding to the monitored kernel based on the operation data. The memory latency diagnostic events are added to the pending diagnostic event queue through the diagnostic event distribution module, so that the memory diagnostic framework processes the memory latency diagnostic events contained in the pending diagnostic event queue to obtain the performance monitoring and anomaly detection results corresponding to the monitored kernel.

2. The advanced memory performance monitoring and anomaly detection method according to claim 1, characterized in that, The memory latency monitoring module includes a memory latency event capture module and an alarm throttling control module; The memory latency monitoring module captures the current memory operations performed by the monitored kernel and their corresponding operation data based on the kernel tracepoint mechanism, in order to determine whether to issue an alarm for the monitored kernel, including: The memory latency event capture module captures the current memory operations performed by the monitored kernel and their corresponding operation data based on the kernel tracepoint mechanism. The operation data includes operation latency time, process information and event type. Based on the target latency threshold corresponding to the event type and the operation latency time, it is determined whether the monitored kernel has experienced a memory latency event; If so, the alarm throttling control module will issue an alarm for the memory latency event occurring in the monitored kernel.

3. The advanced memory performance monitoring and anomaly detection method according to claim 2, characterized in that, A specified memory operation is associated with a trace point, through which the specified memory operation is associated with a callback function; The memory latency event capture module captures the current memory operations performed by the monitored kernel and their corresponding operation data based on the kernel tracepoint mechanism, including: If the current memory operation being performed by the monitored kernel is a specified memory operation, the callback function associated with the current memory operation is triggered to capture the operation data corresponding to the current memory operation.

4. The advanced memory performance monitoring and anomaly detection method according to claim 2, characterized in that, The memory latency monitoring module further includes a configurable threshold management module, which stores a default latency threshold corresponding to each event type; the method further includes: The configurable threshold management module receives the target latency threshold uploaded by the user for the event type and replaces the default latency threshold corresponding to the event type with the target latency threshold.

5. The advanced memory performance monitoring and anomaly detection method according to claim 2, characterized in that, Alerts are issued for memory latency events occurring in the monitored kernel, including: When the alarm throttling control state corresponding to the event type is enabled, an alarm is issued for the memory delay event occurring in the monitored kernel based on the alarm throttling time window.

6. The advanced memory performance monitoring and anomaly detection method according to claim 5, characterized in that, Based on the alarm throttling time window, alarms are generated for the memory latency events occurring in the monitored kernel, including: Obtain the alarm throttling time window corresponding to the event type. The start time of the alarm throttling time window is the time when the previous alarm was issued for the memory delay event of the event type. The end time of the alarm throttling time window is determined based on a preset alarm throttling cycle. If the occurrence time of the memory delay event is within the alarm throttling time window, and the alarm throttling control state corresponding to the event type is determined to be alarm-disallowed, then alarms for the memory delay event occurring in the monitored kernel are prohibited. If the occurrence time of the memory delay event is outside the alarm throttling time window, and the alarm throttling control state corresponding to the event type is determined to be alarm-allowed, then an alarm is issued for the memory delay event occurring in the monitored kernel.

7. The advanced memory performance monitoring and anomaly detection method according to claim 2, characterized in that, Constructing a memory latency diagnostic event corresponding to the monitored kernel based on the operational data includes: Obtain the preset standard diagnostic event structure; The latency severity level is determined based on the target latency threshold and the memory latency event, and the latency severity level, the occurrence time of the memory latency event, the event type, and the process information are filled into the standard diagnostic event structure to obtain the memory latency diagnostic event corresponding to the monitored kernel.

8. A memory performance monitoring system, characterized in that, The memory performance monitoring system is integrated with a memory diagnostic framework. The memory performance monitoring system includes a memory latency monitoring module, a diagnostic event generation module, and a diagnostic event distribution module. The memory latency monitoring module is used to capture the current memory operations performed by the monitored kernel and their corresponding operation data based on the kernel tracepoint mechanism, in order to determine whether to issue a memory latency alarm for the monitored kernel. If the judgment result is yes, the diagnostic event generation module is used to construct a memory latency diagnostic event corresponding to the monitored kernel based on the operation data; The diagnostic event distribution module is used to add the memory latency diagnostic events to the queue of diagnostic events to be processed, so that the memory diagnostic framework can process the memory latency diagnostic events contained in the queue of diagnostic events to be processed to obtain the performance monitoring and anomaly detection results corresponding to the monitored kernel.

9. An electronic device, characterized in that, The method includes a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions that, when invoked and executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

Images