Host network configuration monitoring method, device, equipment, medium and product
By using eBPF probe technology that interacts between kernel mode and user mode, configuration change events of host network configuration are captured, solving the problem of lack of accuracy in configuration monitoring in existing technologies, and realizing fine-grained monitoring and real-time anomaly detection of host network configuration.
Patent Information
- Application Number
- CN202511902477.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-16
- Publication Date
- 2026-02-27
AI Technical Summary
In existing technologies, the monitoring of host network configuration parameters lacks accuracy, making it difficult to reconstruct the intent of configuration changes based on system calls, resulting in a lack of accuracy in monitoring configuration anomalies.
A kernel probe is built using eBPF technology to capture configuration change events of system network parameters and network card queuing rule parameters in real time. Through the interaction between kernel mode and user mode, conflicts in configuration update events are detected and corresponding configuration monitoring information is generated.
It enables fine-grained monitoring of host network configurations, timely detection of abnormal configuration changes, avoidance of erroneous alarms, and improved accuracy and real-time performance of configuration anomaly monitoring.
Smart Images
Figure CN121585550A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and more specifically to methods, devices, equipment, media, and products for monitoring host network configuration. Background Technology
[0002] To avoid parameter configuration conflicts, it is necessary to monitor the parameter configuration process of host network configuration. Currently, parameter configuration monitoring for host network configuration mainly focuses on monitoring other subsystems such as the file system, or it is coarse-grained monitoring. It is difficult to restore the intention of configuration changes based on system calls, which easily leads to false alarms and results in a lack of accuracy in monitoring configuration anomalies. Summary of the Invention
[0003] In view of this, the present invention provides a method, apparatus, device, medium and product for monitoring host network configuration, in order to solve the problem of inaccuracy in monitoring configuration anomalies.
[0004] In a first aspect, the present invention provides a method for monitoring host network configuration, comprising: acquiring a configuration update event initiated by user space for host network configuration and first parameter information corresponding to the host network configuration; performing parameter processing on the host network configuration based on the configuration update event to obtain second parameter information corresponding to the host network configuration; and generating configuration monitoring information corresponding to the configuration update event if there is a conflict between the first parameter information and the second parameter information.
[0005] Secondly, the present invention provides a monitoring device for host network configuration, comprising: an acquisition module, configured to acquire a configuration update event initiated by user space for host network configuration and first parameter information corresponding to the host network configuration; an update module, configured to perform parameter processing on the host network configuration based on the configuration update event to obtain second parameter information corresponding to the host network configuration; and a conflict monitoring module, configured to generate configuration monitoring information corresponding to the configuration update event if there is a conflict between the first parameter information and the second parameter information.
[0006] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the host network configuration monitoring method of the first aspect or any corresponding embodiment described above.
[0007] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the host network configuration monitoring method of the first aspect or any corresponding embodiment described above.
[0008] Fifthly, the present invention provides a computer program product, including computer instructions for causing a computer to execute a monitoring method for host network configuration according to the first aspect or any corresponding embodiment thereof.
[0009] The host network configuration monitoring method, apparatus, device, medium, and product provided in this invention acquire configuration update events initiated by the user space for the host network configuration. This allows for the acquisition of host network configuration update behavior from the perspective of the network system, achieving fine-grained monitoring of network parameters. Subsequently, by comparing the first parameter information corresponding to the host network configuration with the changed second parameter information, a conflict between the first and second parameter information is determined. If a conflict exists, configuration monitoring information corresponding to the configuration update event is generated. This enables real-time monitoring of network parameter changes, timely detection of abnormal configuration change behavior, and prompt generation of configuration monitoring information in the event of a conflict. Furthermore, it allows for the direct reconstruction of the configuration change intent based on the parameter processing behavior of the host network configuration, avoiding subsequent error alarms and improving the accuracy of abnormal configuration monitoring. Attached Figure Description
[0010] To more clearly illustrate the technical solutions in the specific embodiments or related technologies of the present invention, the drawings used in the description of the specific embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0011] Figure 1 This is a schematic diagram of an application scenario according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating a method for monitoring host network configuration according to an embodiment of the present invention; Figure 3 This is a flowchart illustrating another host network configuration monitoring method according to an embodiment of the present invention; Figure 4 This is a flowchart illustrating another method for monitoring host network configuration according to an embodiment of the present invention; Figure 5 This is a structural block diagram of a monitoring device for host network configuration according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation
[0012] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0013] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.
[0014] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.
[0015] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.
[0016] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.
[0017] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.
[0018] Monitoring of host network configuration parameters mainly involves monitoring other subsystems such as the file system, or monitoring system calls. This is coarse-grained and makes it difficult to reconstruct the intent of configuration changes based on system calls, which can easily lead to false alarms.
[0019] For example, when modifying the network interface card (NIC) queuing rule parameter `qdisc`, a request to modify `qdisc` is sent to the kernel via `netlink`, but this is actually accomplished through the `send` system call. Monitoring only `send` calls will not reveal that a change to the `qdisc` parameter has occurred. Furthermore, system calls involve various kernel subsystems, and a single system call may be invoked by multiple different types of upper-layer services. On busy hosts in data centers, a massive number of system call events are generated, the vast majority of which are normal behaviors, placing a burden on the kernel. For instance, modifying the `qdisc` parameter frequently uses `send` calls for network communication, especially since the network bandwidth of a single host in a data center can easily reach hundreds of gigabytes, significantly impacting monitoring performance and leading to inaccurate monitoring of configuration anomalies.
[0020] Based on this, the technical solution disclosed herein constructs a kernel probe using eBPF technology to achieve real-time and accurate capture of configuration change events for system network parameters and network interface card queuing rule parameters (qdisc). An alarm is generated when the change conflicts with existing declared configuration dependencies. Simultaneously, a configuration dependency declaration channel is provided, allowing host processes to request dependencies on specific configuration items. Failure and an alarm are returned when a conflict occurs with dependencies from other processes, thus mitigating potential configuration conflict issues during the deployment phase.
[0021] As an optional application scenario of this invention, such as Figure 1 As shown, this application scenario includes a configuration change monitoring module 101, a configuration management module 102, and a configuration dependency storage module 103. The configuration change monitoring module 101, the configuration management module 102, and the configuration dependency storage module 103 are event-driven, meaning that specific actions are only executed when a configuration change event occurs or an external component requests a configuration dependency.
[0022] Specifically, such as Figure 1 As shown, when a configuration dependency request occurs, configuration dependency conflict detection is performed via the API interface; when a configuration change request occurs, relevant configuration information is read by setting a kernel probe point `kprobe` at the entry point of the kernel function corresponding to the kernel monitor and a kernel return probe point `kretprobe` at the return point of the kernel function corresponding to the kernel monitor. Then, the configuration update event is encapsulated using the relevant configuration information and sent from the kernel space to the user space to perform configuration change conflict detection in the user space.
[0023] According to an embodiment of the present invention, a method for monitoring host network configuration is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.
[0024] This embodiment provides a method for monitoring host network configuration, which can be used for electronic devices such as hosts. Figure 2 This is a flowchart of a host network configuration monitoring method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: Obtain the configuration update event initiated by the user space for the host network configuration and the first parameter information corresponding to the host network configuration.
[0025] User space is the memory area where user-mode applications run; host network configuration refers to configuring the network parameters corresponding to network communication functions. Specifically, it can include configuring network parameters such as system network parameter sysctl and network card queuing rule parameter qdisc.
[0026] Configuration update events are events where any component or thread requests changes to existing configurations. Specifically, they can include configuration dependency request events and configuration change request events. A configuration dependency request event is generated when a component requests a dependency on a specific configuration item; multiple components can request the same dependency on the same configuration item. A configuration change request event is generated when a component calls a kernel-provided interface to modify a network configuration item. The first parameter information consists of the configuration parameters declared by other components at the time of the host network configuration update.
[0027] Specifically, for configuration dependency request events, components can initiate them through API interfaces set in user space; for configuration change request events, components can initiate them to kernel space, and probe programs can capture the configuration change request event and send it to user space so that the configuration parameter information corresponding to the configuration change request can be obtained in user space.
[0028] When a host receives a configuration update event for the host network configuration, it queries the database for the configuration parameter information of the configuration item to be updated in the configuration update event, that is, the first parameter information declared when responding to the configuration update event.
[0029] Step S202: Based on the configuration update event, perform parameter processing on the host network configuration to obtain the second parameter information corresponding to the host network configuration.
[0030] The second parameter information is the configuration parameter information generated when the configuration parameters of the configuration item to be updated are changed; that is, the actual configuration parameter information generated in response to the configuration update event. After receiving the configuration update event, the host network configuration can respond to the configuration update event to execute the parameter processing process for the host network configuration.
[0031] Specifically, the host determines the parameter processing content carried in the configuration update event by parsing the configuration update event. The parameter processing content includes the parameter to be processed corresponding to the current configuration update event and the second parameter information corresponding to the parameter to be processed.
[0032] Step S203: If there is a conflict between the first parameter information and the second parameter information, then generate configuration monitoring information corresponding to the configuration update event.
[0033] Configuration monitoring information is generated by monitoring configuration items that have undergone configuration changes. This configuration monitoring information may include monitoring information for configuration dependency request events and monitoring information for configuration change request events.
[0034] As described above, based on the configuration update request, the configuration item to be changed can be determined from the host network configuration. The first parameter information and the second parameter information corresponding to the configuration item to be changed are compared to determine whether there is a configuration conflict. If there is a configuration conflict, configuration monitoring information for the current configuration update event is generated, and the configuration parameter processing behavior of the host network configuration is determined through this monitoring information. If there is no configuration conflict, the parameter value of the configuration item is determined based on the second parameter information, and the parameter value of the configuration item is stored in the database.
[0035] The host network configuration monitoring method provided in this embodiment acquires configuration update events initiated by the user space for the host network configuration, thereby obtaining the configuration update behavior of the host network configuration from the perspective of the network system and realizing fine-grained monitoring of network parameters. Then, by comparing the first parameter information corresponding to the host network configuration with the changed second parameter information, it is determined whether there is a conflict between the first and second parameter information. If a conflict exists, configuration monitoring information corresponding to the configuration update event is generated. This achieves real-time monitoring of network parameter changes, enabling timely detection of abnormal configuration change behavior so that configuration monitoring information can be generated promptly when conflicts occur. Simultaneously, it can directly reconstruct the configuration change intent based on the parameter processing behavior of the host network configuration, avoiding subsequent error alarms and improving the accuracy of configuration anomaly monitoring.
[0036] This embodiment provides a method for monitoring host network configuration, which can be used in electronic devices such as computer hosts and servers. Figure 3 This is a flowchart of a host network configuration monitoring method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps: Step S301: Obtain the configuration update event initiated by the user space for the host network configuration and the first parameter information corresponding to the host network configuration. For details, please refer to the relevant descriptions of the steps in the embodiments shown above, which will not be repeated here.
[0037] Step S302: Perform parameter processing on the host network configuration based on the configuration update event to obtain the second parameter information corresponding to the host network configuration.
[0038] Specifically, step S302 includes: Step S3021: Obtain the event type corresponding to the configuration update event.
[0039] The event type is the type corresponding to the configuration update event, which can specifically include configuration dependency events and configuration change request events.
[0040] In a specific example, different event types have different triggering methods. For instance, configuration dependency events are triggered by API interfaces set in user space, while configuration change request events are obtained from kernel space. That is, the host can determine the event type of a configuration update event by parsing its triggering method.
[0041] In another specific example, different event types have different request information; for instance, configuration dependency events and configuration change request events have different request information. That is, the host can determine the event type of a configuration update event by parsing the request content carried in the configuration update event.
[0042] Step S3022: Based on the parameter change content carried by the event type, perform parameter processing on the host network configuration corresponding to the event type to obtain the second parameter information.
[0043] The parameter change content refers to the event content carried in the configuration update event. This parameter change content includes the configuration item for which the change is requested and the corresponding change information. Specifically, the host network configuration includes multiple configuration items, and the configuration update event requests a change for one or more of these configuration items. Therefore, by combining the event type, the configuration item under that event type can be determined from the host network configuration, and the change information in the parameter change content can be used to process the parameters of the configuration item for which the change is requested under that event type to obtain the corresponding second parameter information.
[0044] Step S303: If there is a conflict between the first parameter information and the second parameter information, then generate configuration monitoring information corresponding to the configuration update event.
[0045] Specifically, the configuration update event includes a configuration dependency request event. The first parameter information includes first existing declaration information, the second parameter information includes dependency information, and the configuration monitoring information includes dependency conflict alarm information. Here, the configuration dependency request event is the event that requests a dependency; the first existing declaration information indicates the dependency declaration information already configured by other components; the dependency information indicates the dependency declaration information generated after executing the configuration dependency request event; and the dependency conflict alarm information indicates the conflict alarm information generated when a configuration dependency conflict is detected.
[0046] Accordingly, step S303 above includes: Step S3031: Obtain the dependency configuration item corresponding to the configuration dependency request event and the dependency information for the dependency configuration item.
[0047] A dependency configuration item is a specific configuration item requested in a dependency request. Specifically, when a host receives a configuration update event and determines that the configuration update event is a configuration dependency request event, it parses the dependency configuration item requested in the configuration dependency request event and queries the database for the dependency configuration item to determine the dependency information corresponding to that dependency configuration item.
[0048] Step S3032: Detect whether there is a configuration dependency conflict between the dependency information and the first existing declaration information corresponding to the dependency configuration item.
[0049] Perform configuration dependency conflict detection between the dependency information and the first existing declaration information to determine whether there is a conflict. If there is a configuration dependency conflict between the dependency information and the first existing declaration information, proceed to step S3033; otherwise, proceed to step S3034.
[0050] Step S3033: If there is a configuration dependency conflict between the dependency information and the first existing declaration information corresponding to the dependency configuration item, then generate a dependency conflict alarm message corresponding to the configuration dependency request event.
[0051] If a dependency conflict exists between the dependency information and the first existing declaration information corresponding to the dependency configuration item, a failure response is returned, and a corresponding dependency conflict alarm message is generated. For example, if component A requests a dependency on net.ipv4.ip_forward=1, while component B has already requested a dependency on net.ipv4.ip_forward=0 before component A requested the dependency, then it indicates that there is a conflict between the configuration dependencies declared by component A and component B.
[0052] It should be noted that if the configuration dependency requests from component A and component B originate from the same user ID, it means that they were triggered by the same user. At the same time as generating configuration dependency conflict warning information, the user is allowed to make mandatory changes to the dependency declaration. If the configuration dependency requests from component A and component B correspond to different user IDs, it means that they were triggered by different users. In this case, the user is not allowed to make changes to the dependency declaration.
[0053] Step S3034: If there is no configuration dependency conflict between the dependency information and the first existing declaration information, then the dependency configuration item is updated using the dependency information to obtain the target dependency declaration information corresponding to the dependency configuration item.
[0054] If there is no configuration dependency conflict between the dependency information and the first existing declaration information, then the dependency information is directly updated for the dependency configuration item, and the dependency information is determined as the target dependency declaration information corresponding to the dependency configuration item.
[0055] Step S3035: Store the target dependency declaration information in the target dependency database.
[0056] The target dependency database is deployed on the host and stores dependency declaration information corresponding to each configuration item in the host's network configuration. If it is determined that there is no configuration dependency conflict between the dependency information and the first existing declaration information, a success response is returned, and the target dependency declaration information generated by the current configuration dependency request event is stored in the target dependency database for subsequent configuration dependency request conflict detection.
[0057] The host network configuration monitoring method provided in this embodiment determines the corresponding parameter change content based on the event type of the configuration update event, and uses the parameter change content to process the relevant host network configuration parameters, thereby achieving accurate acquisition of the parameters corresponding to the host network configuration. By detecting whether there are configuration dependency conflicts between dependency information and existing declaration information, corresponding alarm information is generated when configuration dependency conflicts exist, thereby realizing the configuration of dependency declaration channels and facilitating the avoidance of possible configuration conflict issues during the deployment phase.
[0058] This embodiment provides a method for monitoring host network configuration, which can be used in electronic devices such as computer hosts and servers. Figure 4 This is a flowchart of a host network configuration monitoring method according to an embodiment of the present invention, such as... Figure 4 As shown, the process includes the following steps: Step S401: Obtain the configuration update event initiated by the user space for the host network configuration and the first parameter information corresponding to the host network configuration. For details, please refer to the relevant descriptions of the steps in the embodiments shown above, which will not be repeated here.
[0059] Step S402: Based on the configuration update event, perform parameter processing on the host network configuration to obtain the second parameter information corresponding to the host network configuration. For details, please refer to the relevant descriptions of the corresponding steps in the embodiments shown above, which will not be repeated here.
[0060] Step S403: If there is a conflict between the first parameter information and the second parameter information, generate configuration monitoring information corresponding to the configuration update event.
[0061] Specifically, the configuration update event includes a configuration change request event, the first parameter information includes second existing declaration information, the second parameter information includes change information, and the configuration monitoring information includes configuration conflict alarm information. Here, the configuration change request event is an event that requests a change to configuration item information; the second existing declaration information represents the configuration declaration information that the configuration item had before the change; the change information represents the configuration declaration information generated after executing the configuration change request event; and the configuration conflict alarm information represents the conflict alarm information generated when a conflict is detected in the configuration change.
[0062] Accordingly, step S403 above includes: Step S4031: Obtain the configuration change item corresponding to the configuration change request event and the parameter change identifier corresponding to the configuration change item.
[0063] The parameter change identifier is used to indicate whether a configuration change item has been modified. A configuration change item represents a specific configuration item that the configuration change request event requests to be modified. Specifically, when a host receives a configuration update event and determines that it is a configuration change request event, it parses the requested configuration change item in the event and queries the database to determine the parameter change identifier corresponding to that item. For example, a parameter change identifier of 0 indicates that the configuration change item has not been updated, while a parameter change identifier of 1 indicates that the item has been updated.
[0064] Step S4032: If the parameter change identifier indicates that the configuration change item has been updated, then check whether there is a configuration conflict between the change information corresponding to the configuration change item and the second existing declaration information corresponding to the configuration change item.
[0065] If the parameter change identifier indicates that the configuration change item has been updated, then the change information generated by the configuration change request event for the configuration change item is obtained, and a configuration change conflict detection is performed between the change information and the second existing declaration information to determine whether there is a configuration conflict between the change information and the second existing declaration information. If there is a configuration conflict between the change information and the second existing declaration information, step S4033 is executed; otherwise, step S4034 is executed.
[0066] Step S4033: If there is a configuration conflict between the change information and the second existing declaration information, generate configuration conflict alarm information corresponding to the configuration change request event.
[0067] If the change information conflicts with the existing declaration information, it means that the change information is different from the existing declaration information stored in the database. This may cause abnormal system operation. In this case, the host will generate a configuration conflict alarm message corresponding to the configuration change request event to remind the person performing the configuration change to operate with caution.
[0068] Step S4034: If there is no configuration conflict between the change information and the second existing declaration information, then generate the configuration change log corresponding to the change information.
[0069] If the change information does not conflict with the existing declaration information, it means that the change information does not conflict with the existing declaration information stored in the database. In this case, no conflict alarm will be issued, and the configuration item change behavior will be recorded to generate a corresponding configuration change log so that the configuration change behavior can be determined later through the configuration change log.
[0070] In some optional implementations, the above method further includes: Step a1: If the parameter change identifier indicates that the configuration change item has been updated, check whether there is any dependent configuration information associated with the configuration change item.
[0071] Step a2: If there is dependent configuration information associated with the configuration change item, then obtain the change information corresponding to the configuration change item.
[0072] Dependency configuration information represents the dependency entries of a configuration change item. Specifically, if a parameter change identifier indicates that a configuration change item has been updated, the target dependency database is accessed, using the configuration change request event as the query keyword, to check if there is any dependency configuration information associated with the configuration change item. If dependency configuration information associated with the configuration change item is found in the target dependency database, the change information corresponding to the configuration change item is obtained for configuration conflict detection.
[0073] In the above implementation, by detecting the dependent configuration information associated with the configuration change item, it is convenient to restore the intention of the configuration change by combining the dependent configuration information.
[0074] In some optional implementations, the above-mentioned acquisition of configuration change request events includes: Step b1: Based on the monitoring of configuration change requests by the kernel monitor program, generate configuration change request events corresponding to the configuration change requests in the kernel space.
[0075] Step b2: Send the configuration change request event to the user space to obtain the configuration change request event from the user space.
[0076] A kernel monitor is a program that attaches eBPF (extended Berkeley Packet Filter) to a kernel function to execute configured monitoring functions. Specifically, a kernel probe point `kprobe` is set at the entry point of the kernel function corresponding to the kernel monitor. This probe is triggered when the kernel function is called to collect information such as the parameters, call stack, and timestamps of the kernel function calls. Simultaneously, a kernel return probe point `kretprobe` is set at the return point of the kernel function corresponding to the kernel monitor. This return probe point `kretprobe` is triggered when the kernel function completes execution and returns, and is used to measure the execution time of the kernel function and obtain its return value. The kernel return probe point `kretprobe` works in conjunction with the kernel probe point `kprobe` to completely track the execution triggering and completion of a kernel function.
[0077] The kernel monitoring program corresponding to the configuration change request event, when a component initiates a configuration change request to attempt to modify a configuration item, obtains the configuration change information corresponding to the configuration change request by the kprobe-type kernel monitoring program attached to the kernel function, and generates a corresponding configuration change request event. Then, the configuration change process is handled by the kernel function. The kretprobe-type kernel monitoring program attached to the kernel function completes the return value information in the configuration change request event and sends the configuration change request event from kernel space to user space, so that the host can obtain the configuration change request event from user space for subsequent configuration conflict detection.
[0078] In the above implementation, by generating configuration change request events corresponding to configuration change requests in the kernel space, real-time and accurate capture of change behaviors can be achieved.
[0079] In some alternative implementations, the kernel monitor includes a first kernel monitor and a second kernel monitor, wherein the first kernel monitor is a kernel monitor of type kprobe and the second kernel monitor is a kernel monitor of type kretprobe.
[0080] Accordingly, step b1 above includes: Step b11: Based on the first kernel monitoring program corresponding to the configuration change request, obtain the configuration change information corresponding to the configuration change request and the execution thread identifier corresponding to the configuration change request.
[0081] Step b12: In kernel space, the configuration change information is encapsulated into a first change event, a mapping relationship is constructed between the first change event and the execution thread identifier, and the mapping relationship is stored in the target data table.
[0082] Step b13: Based on the second kernel monitoring program corresponding to the configuration change request, query the first change event corresponding to the execution thread identifier from the target data table according to the mapping relationship.
[0083] Step b14: If there is a parameter change execution result for the first change event, then add the parameter change execution result to the first change event and generate a configuration change request event.
[0084] When a component initiates a configuration change request to attempt to modify a configuration item, the first kernel monitoring program of type kprobe attached to the kernel function obtains the configuration change information carried in the configuration change request, encapsulates the configuration change information into a first change event, and constructs a mapping relationship between the first change event and the execution thread identifier using the ID of the current execution thread performing the configuration change as the key and the first change event as the value. This mapping relationship is then temporarily stored in a target data table, which can be a hash table.
[0085] After the kernel function completes processing the configuration change request, a second kernel monitoring program of type `kretprobe` attached to the kernel function queries the target data table for change events using the current execution thread ID as the key. If no first change event corresponding to the execution thread ID is found in the target data table, the second kernel monitoring program exits. If a first change event corresponding to the execution thread ID is found, the return value of the kernel function executing the configuration change request is obtained, and this return value information is used to complete the first change event, generating the corresponding configuration change request event. Then, the configuration change request event is sent to user space through the event map table `perf event map`. In this way, user space can obtain the configuration items changed by the new configuration change request event through a queue for subsequent configuration conflict detection.
[0086] In the above implementation, by utilizing the first kernel monitoring program and the second kernel monitoring program to fully monitor the execution and completion of the change behavior, a large amount of useless information is avoided from burdening the host operating system.
[0087] In some optional implementations, the above method further includes: Step c1: Obtain the parameter change type corresponding to the configuration change request event.
[0088] Step c2: Retrieve a configuration change request event from user space that matches the parameter change type.
[0089] The parameter change type indicates the parameter that the configuration change request event requires to be changed. This parameter change type can include system network parameter `sysctl` and network interface card (NIC) queuing rule parameter `qdisc`. Specifically, the host parses the configuration change request event to determine whether the parameter to be changed is the system network parameter `sysctl` or the NIC queuing rule parameter `qdisc`. Then, it retrieves the matching configuration change request event according to the system network parameter `sysctl` or the NIC queuing rule parameter `qdisc`, i.e., a system network parameter change or a NIC queuing rule parameter change. By retrieving the matching configuration change request event from user space according to the parameter change type, the accuracy of retrieving configuration change request events is improved.
[0090] The host network configuration monitoring method provided in this embodiment detects whether there is a configuration conflict between the change information corresponding to the configuration change item and the relevant existing declaration information. When a configuration conflict exists, corresponding alarm information is generated. This achieves accurate configuration of the host network configuration, avoids host network failure caused by current configuration changes, and helps maintain the operational stability of the host network.
[0091] As an application embodiment of the present invention, a corresponding eBPF probe program is set for the system network parameters, and the eBPF probe program is attached to the kernel function __cgroup_bpf_run_filter_sysctl. At the same time, a configuration change event structure including information such as type identifier, network identifier netns_id, process name procname, and return value ret is set.
[0092] Specifically, for the `kprobe` type, an `event` variable of type `sysctl_write_event` can be set, with `event.type` set to 0 (indicating a `sysctl_write_event` type event). This retrieves the event type parameter from the kernel function, representing either a read or write event. If the event type parameter is 0, it indicates a read event of system network parameters, and the eBPF probe program exits its processing flow. If the event type parameter is 1, it indicates a write event of system network parameters, and the program continues to retrieve data table parameters and variable name parameters from the kernel function to read attribute information. Then, combining the retrieved attribute information, the complete path of the modified system network parameters is parsed to obtain the current execution thread identifier (ID). Using this execution thread identifier as the key, the corresponding configuration change event is temporarily stored in a hash map.
[0093] Specifically, for the `kretprobe` type, the current execution thread identifier (ID) is retrieved. Using this ID as the key, the system searches the hash map for a temporarily stored configuration change event. If no configuration change event is found, the eBPF probe program exits its processing flow. If a configuration change event is found, the return value of the kernel function is obtained and assigned to `event.ret` in the configuration change event structure. The configuration change event is then stored in the perf event map. Programs in user space can retrieve the configuration change event from this perf event map and delete the record from the hash map.
[0094] For the network interface card queuing rule parameter qdisc, set the corresponding eBPF probe program, attach the eBPF probe program to the kernel functions tc_modify_qdisc and tc_get_qdisc, and set the configuration change event structure including information such as type identifier, action, network identifier netns_id, index ifIndex, attribute parent, handle and return value ret.
[0095] Specifically, for the `kprobe` type, under the kernel parameter `tc_modify_qdisc`, a configuration change event is set, of type `struct qdisc_modify_event`, with `event.type` set to 1 (indicating a configuration change event of type `qdisc`) and `event.action` set to 1 (indicating the action is modification). The current thread ID and the current executing thread identifier ID are obtained from the kernel function `tc_modify_qdisc`. Using this executing thread identifier ID as the key, the corresponding configuration change event is temporarily stored in a hash map.
[0096] Under the kernel parameter `tc_get_qdisc`, a configuration change event is set, of type `struct qdisc_modify_event`, with `event.type` set to 1 (indicating a configuration change event of type `qdisc`) and `event.action` set to 2 (indicating the action is deletion). The current thread ID and the current executing thread identifier ID are retrieved from the kernel parameter `tc_get_qdisc`. Using this executing thread identifier ID as the key, the corresponding configuration change event is temporarily stored in a hash map.
[0097] Specifically, for the `kretprobe` type, the current execution thread identifier (ID) is retrieved. Using this ID as the key, the system searches the hash map for a temporarily stored configuration change event. If no configuration change event is found, the eBPF probe program exits its processing flow. If a configuration change event is found, the return value of the kernel function is obtained and assigned to `event.ret` in the configuration change event structure. The configuration change event is then stored in the perf event map. Programs in user space can retrieve the configuration change event from this perf event map and delete the record from the hash map.
[0098] When a dependency request is made for a configuration item in the network interface card queuing rule parameter `qdisc` or the system network parameter `sysctl`, the system checks whether there are any conflicts in the configuration dependencies between different components. Specifically, the relevant dependency parameter information is obtained from the configuration dependency request, and the dependency item is retrieved from the dependency data table in the database based on the dependency parameter information. If the dependency item is empty, a new entry is added to the dependency data table, and a success response is returned; if the dependency item is not empty, the current dependency is compared with existing dependencies. If they are the same, a new entry is added to the dependency data table, and a success response is returned; if they are different, a configuration dependency conflict is determined, a configuration dependency conflict alarm is issued, and a failure response is returned.
[0099] When a change is made to the network interface card queuing rule parameter `qdisc` or a configuration item of the system network parameter `sysctl`, it is checked whether the corresponding configuration conflicts with existing declared dependencies. Specifically, the relevant configuration change parameter information is obtained from the configuration change event, and the corresponding dependency information is queried from the kernel space based on the configuration change parameter information. This dependency information is then used to retrieve the dependency item from the dependency data table. If the dependency item is empty or has a set value, it is determined that no configuration conflict has occurred, and the process ends; otherwise, a configuration abnormal change alarm is generated.
[0100] This embodiment also provides a host network configuration monitoring device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.
[0101] This embodiment provides a monitoring device for host network configuration, such as... Figure 5 As shown, it includes: The acquisition module 501 is used to acquire configuration update events initiated by the user space for the host network configuration and the first parameter information corresponding to the host network configuration.
[0102] The update module 502 is used to process the host network configuration parameters based on the configuration update event to obtain the second parameter information corresponding to the host network configuration.
[0103] The conflict monitoring module 503 is used to generate configuration monitoring information corresponding to the configuration update event if there is a conflict between the first parameter information and the second parameter information.
[0104] In some alternative implementations, the update module 502 includes: The type retrieval unit is used to retrieve the event type corresponding to the configuration update event.
[0105] The parameter update unit is used to process the host network configuration corresponding to the event type based on the parameter change content carried by the event type, and obtain the second parameter information.
[0106] In some alternative implementations, the configuration update event includes a configuration dependency request event, and accordingly, the conflict monitoring module 503 includes: The dependency retrieval unit is used to retrieve the dependency configuration items corresponding to the configuration dependency request event and the dependency information for the dependency configuration items.
[0107] The dependency detection unit is used to detect whether there is a configuration dependency conflict between the dependency information and the first existing declaration information corresponding to the dependency configuration item.
[0108] The dependency alarm unit is used to generate dependency conflict alarm information corresponding to the configuration dependency request event if there is a configuration dependency conflict between the dependency information and the first existing declaration information corresponding to the dependency configuration item; wherein, the first parameter information includes the first existing declaration information, the second parameter information includes the dependency information, and the configuration monitoring information includes the dependency conflict alarm information.
[0109] In some optional implementations, the conflict monitoring module 503 further includes: The target dependency determination unit is used to update the dependency configuration item using the dependency information if there is no configuration dependency conflict between the dependency information and the first existing declaration information, so as to obtain the target dependency declaration information corresponding to the dependency configuration item.
[0110] The storage unit is used to store target dependency declaration information into the target dependency database.
[0111] In some alternative implementations, the configuration update event includes a configuration change request event, and accordingly, the conflict monitoring module 503 includes: The change acquisition unit is used to acquire the configuration change items corresponding to the configuration change request event and the parameter change identifiers corresponding to the configuration change items.
[0112] The change detection unit is used to detect whether there is a configuration conflict between the change information corresponding to the configuration change item and the second existing declaration information corresponding to the configuration change item if the parameter change identifier indicates that the configuration change item has been updated.
[0113] The second alarm unit is used to generate configuration conflict alarm information corresponding to the configuration change request event if there is a configuration conflict between the change information and the second existing declaration information. The first parameter information includes the second existing declaration information, the second parameter information includes the change information, and the configuration monitoring information includes the configuration conflict alarm information.
[0114] In some optional implementations, the conflict monitoring module 503 further includes: The target configuration determination unit is used to generate a configuration change log corresponding to the change information if there is no configuration conflict between the change information and the second existing declaration information.
[0115] In some optional implementations, the conflict monitoring module 503 further includes: The dependency configuration detection unit is used to detect whether there is any dependency configuration information associated with the configuration change item if the parameter change identifier indicates that the configuration change item has been updated.
[0116] The change information acquisition unit is used to acquire the change information corresponding to the configuration change item if there is dependent configuration information associated with the configuration change item.
[0117] In some alternative embodiments, the above-described apparatus further includes: The event acquisition module is used to acquire configuration change request events.
[0118] Specifically, the event acquisition module includes: The event generation unit is used to monitor configuration change requests based on the kernel monitor program and generate configuration change request events corresponding to the configuration change requests in the kernel space.
[0119] The sending unit is used to send configuration change request events to user space in order to obtain configuration change request events from user space.
[0120] In some alternative implementations, the kernel monitor includes a first kernel monitor and a second kernel monitor. Accordingly, the event generation unit includes: The information acquisition subunit is used to acquire the configuration change information corresponding to the configuration change request and the execution thread identifier corresponding to the configuration change request based on the first kernel monitoring program corresponding to the configuration change request.
[0121] The mapping construction subunit is used to encapsulate configuration change information into a first change event in kernel space, construct a mapping relationship between the first change event and the execution thread identifier, and store the mapping relationship in the target data table.
[0122] The query unit is used to query the first change event corresponding to the execution thread identifier from the target data table according to the mapping relationship, based on the second kernel monitoring program corresponding to the configuration change request.
[0123] The information supplementation subunit is used to supplement the first change event with the parameter change execution result if there is a parameter change execution result for the first change event, and generate a configuration change request event.
[0124] In some alternative embodiments, the above-described apparatus further includes: The change type acquisition module is used to obtain the parameter change type corresponding to the configuration change request event.
[0125] The event matching module is used to retrieve configuration change request events that match the parameter change type from user space.
[0126] The host network configuration monitoring device provided in this disclosure can execute the host network configuration monitoring method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of the execution method. By acquiring configuration update events initiated by the user space for the host network configuration, the configuration update behavior of the host network configuration can be obtained from the perspective of the network system, realizing fine-grained monitoring of network parameters. Then, by combining the comparison results of the first parameter information corresponding to the host network configuration and the changed second parameter information, it is determined whether there is a conflict between the first parameter information and the second parameter information. When a conflict exists, configuration monitoring information corresponding to the configuration update event is generated. Thus, real-time monitoring of network parameter changes is realized, and abnormal configuration change behavior can be detected in a timely manner so that configuration monitoring information can be generated in a timely manner when a conflict occurs. At the same time, the configuration change intention can be directly restored based on the parameter processing behavior of the host network configuration, avoiding subsequent error alarms and improving the accuracy of configuration anomaly monitoring.
[0127] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.
[0128] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure.
[0129] The following is a detailed reference. Figure 6This diagram illustrates a suitable structural schematic for implementing an electronic device according to embodiments of the present disclosure. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 601, which can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) 602 or a program loaded from memory 608 into random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the electronic device. The processor 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.
[0130] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.
[0131] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a memory 608, or installed from a ROM 602. When the computer program is executed by the processor 601, it performs the functions defined in the host network configuration monitoring method of embodiments of this disclosure.
[0132] Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.
[0133] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded over a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the host network configuration monitoring method shown in the above embodiments is implemented.
[0134] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.
[0135] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.
Claims
1. A method of monitoring a host network configuration, the method comprising: The method comprises: obtaining a configuration update event initiated by a user space for a host network configuration and first parameter information corresponding to the host network configuration; performing parameter processing on the host network configuration based on the configuration update event to obtain second parameter information corresponding to the host network configuration; if the first parameter information and the second parameter information exist in conflict, generating configuration monitoring information corresponding to the configuration update event.
2. The method of claim 1, wherein, The parameter processing on the host network configuration based on the configuration update event to obtain second parameter information corresponding to the host network configuration comprises: obtaining an event type corresponding to the configuration update event; performing parameter processing on the host network configuration corresponding to the event type based on parameter change content carried by the event type to obtain the second parameter information.
3. The method of claim 1, wherein, The configuration update event comprises a configuration dependency request event; The generation of the configuration monitoring information corresponding to the configuration update event if the first parameter information and the second parameter information exist in conflict comprises: obtaining a dependency configuration item corresponding to the configuration dependency request event and dependency information corresponding to the dependency configuration item; detecting whether the dependency information and first existing declaration information corresponding to the dependency configuration item exist in configuration dependency conflict; if the dependency information and the first existing declaration information corresponding to the dependency configuration item exist in configuration dependency conflict, generating dependency conflict alarm information corresponding to the configuration dependency request event; wherein the first parameter information comprises first existing declaration information, the second parameter information comprises the dependency information, and the configuration monitoring information comprises the dependency conflict alarm information.
4. The method of claim 3, wherein, Further comprising: if the dependency information and the first existing declaration information do not exist in configuration dependency conflict, updating the dependency configuration item using the dependency information to obtain target dependency declaration information corresponding to the dependency configuration item; storing the target dependency declaration information to a target dependency database.
5. The method of claim 1, wherein, The configuration update event comprises a configuration change request event; The generation of the configuration monitoring information corresponding to the configuration update event if the first parameter information and the second parameter information exist in conflict comprises: obtaining a configuration change item corresponding to the configuration change request event and a parameter change identifier corresponding to the configuration change item; if the parameter change identifier represents that the configuration change item is updated, detecting whether change information corresponding to the configuration change item and second existing declaration information corresponding to the configuration change item exist in configuration conflict; if the change information and the second existing declaration information exist in configuration conflict, generating configuration conflict alarm information corresponding to the configuration change request event; wherein the first parameter information comprises second existing declaration information, the second parameter information comprises the change information, and the configuration monitoring information comprises the configuration conflict alarm information.
6. The method of claim 5, wherein, Further comprising: if the change information and the second existing declaration information do not exist in configuration conflict, generating a configuration change log corresponding to the change information.
7. The method of claim 5, wherein, Further comprising: If the parameter change identifier represents that the configuration change item completes updating, it is detected whether there is dependent configuration information associated with the configuration change item; If there is dependent configuration information associated with the configuration change item, change information corresponding to the configuration change item is obtained.
8. The method of claim 5, wherein, The configuration change request event is obtained, including: Based on the kernel monitoring program monitoring the configuration change request, the configuration change request event corresponding to the configuration change request is generated in the kernel space; The configuration change request event is sent to the user space to obtain the configuration change request event from the user space.
9. The method of claim 8, wherein, The kernel monitoring program includes a first kernel monitoring program and a second kernel monitoring program, and the configuration change request event corresponding to the configuration change request is generated in the kernel space based on the kernel monitoring program monitoring the configuration change request, including: Based on the first kernel monitoring program corresponding to the configuration change request, configuration change information corresponding to the configuration change request and an execution thread identifier corresponding to the configuration change request are obtained; In the kernel space, the configuration change information is encapsulated as a first change event, a mapping relationship between the first change event and the execution thread identifier is constructed, and the mapping relationship is stored to a target data table; Based on the second kernel monitoring program corresponding to the configuration change request, the first change event corresponding to the execution thread identifier is queried from the target data table according to the mapping relationship; If there is a parameter change execution result for the first change event, the parameter change execution result is supplemented into the first change event to generate the configuration change request event.
10. The method according to claim 8 or 9, characterized in that, Further comprising: Obtaining a parameter change type corresponding to the configuration change request event; Obtaining the configuration change request event matching the parameter change type from the user space.
11. A monitoring device of a host network configuration, characterized in that The device includes: An obtaining module configured to obtain a configuration update event initiated by a user space for a host network configuration and first parameter information corresponding to the host network configuration; An updating module configured to perform parameter processing on the host network configuration based on the configuration update event to obtain second parameter information corresponding to the host network configuration; A conflict monitoring module configured to generate configuration monitoring information corresponding to the configuration update event if the first parameter information and the second parameter information conflict.
12. An electronic device, comprising: Including: A memory and a processor, which are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the host network configuration monitoring method in any one of claims 1 to 10.
13. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a computer to perform the host network configuration monitoring method in any one of claims 1 to 10.
14. A computer program product, characterised in that, Including computer instructions for causing a computer to perform the host network configuration monitoring method in any one of claims 1 to 10.