Non-intrusive acquisition method, system and equipment for operation and maintenance data of credential environment and medium

Abstract

The invention relates to a credential environment operation and maintenance data non-intrusive acquisition method, system and device and a medium. The method comprises the following steps: constructing an acquisition probe by utilizing an eBPF technology based on a Linux kernel function to realize non-intrusive acquisition of operation and maintenance data of network traffic, a system call chain and a hardware performance index; generating a validity report by verifying the validity of the operation and maintenance data, and synchronously acquiring operation state data such as a CPU occupancy rate, a memory buffer utilization rate and a data packet loss rate of the acquisition probe; and generating a probe performance analysis report in combination with the operation state data and the validity report, dynamically optimizing the operation parameters of the acquisition probe according to a preset adjustment rule based on the report to form an optimized probe, and executing subsequent operation and maintenance data acquisition by applying the optimized probe. According to the method, the invasive problem that a traditional acquisition tool needs to modify system configuration in a credential environment is solved, and low-overhead and high-reliability closed-loop data acquisition optimization is realized.

Description

Technical Field

[0001] This invention belongs to the field of information system operation and maintenance technology, and in particular relates to a non-intrusive method, system, equipment and medium for collecting operation and maintenance data in a domestically developed information technology environment. Background Technology

[0002] With the development of information system operation and maintenance technology, operation and maintenance data collection has become a core link in ensuring system stability. This technology supports fault diagnosis and performance optimization by collecting data such as network traffic, system call chains, and hardware performance indicators in real time. Its characteristic lies in achieving fine-grained monitoring by penetrating the operating system kernel layer. Traditional methods rely on intrusive collection methods: 1. Proxy deployment mode requires installing a dedicated proxy program on the target system to capture data by hooking system call interfaces or modifying kernel parameters. For example, network traffic collection requires binding the network interface and enabling promiscuous mode, and modifying the network stack configuration; system call chain tracing requires injecting probe code and adjusting process scheduling strategies; hardware indicator collection relies on high-privilege processes periodically reading system files. 2. Kernel module injection method, which directly modifies the system's running state by loading custom kernel modules, disrupting the original balance of resource allocation. Traditional methods suffer from the following drawbacks: system overhead surges, frequent kernel mode switching leads to a spike in CPU utilization (often >15%), and memory buffers consume more than 30% extra; reliability is low, configuration changes cause compatibility issues (such as kernel version / SELinux), and packet loss rate can reach 5%-10%; dynamic adaptability is poor, there is a lack of closed-loop parameter tuning mechanism, and the heterogeneity of software and hardware in the domestic IT innovation environment exacerbates data distortion. Summary of the Invention

[0003] Therefore, it is necessary to provide a non-intrusive method, system, equipment, and medium for collecting operation and maintenance data in a domestically developed information technology environment that can solve the above problems.

[0004] Firstly, this application provides a non-intrusive method for collecting operation and maintenance data in a domestically developed information technology environment, including:

[0005] A data acquisition probe is constructed based on Linux kernel functions and using eBPF technology.

[0006] The system uses a data acquisition probe to collect operational data, which includes network traffic, system call chains, and hardware performance metrics.

[0007] Verify the validity of operation and maintenance data and generate a validity report;

[0008] Acquire the operational status data of the acquisition probe, including CPU utilization, memory buffer usage, and data packet loss rate;

[0009] Generate a probe performance analysis report based on the operational status data and validity report;

[0010] Based on the performance analysis report, the operating parameters of the acquisition probe are adjusted according to the preset adjustment rules to form an optimized probe;

[0011] The application optimization probe performs subsequent collection of operation and maintenance data.

[0012] In one embodiment, verifying the validity of the operation and maintenance data and generating a validity report includes:

[0013] For network traffic data, the packet loss value of the network interface hardware counter is collected, the number of collected data packets is compared with the packet loss value, and the validity verification conclusion of the network traffic is determined based on the comparison result.

[0014] For system call chain data, verify the continuity of the collected process identifier sequence and the continuity of the system call sequence number, and determine the call chain integrity verification conclusion based on the verification results;

[0015] For hardware performance indicators, hardware baseline values ​​are obtained through the sysfs interface, the deviation rate between the collected values ​​and the baseline values ​​is calculated, it is determined whether the deviation rate exceeds the first preset threshold, and the accuracy verification conclusion of the indicators is determined based on the judgment result.

[0016] Summarize the network traffic validity verification conclusions, call chain integrity verification conclusions, and indicator accuracy verification conclusions to generate a validity report.

[0017] In one embodiment, a probe performance analysis report is generated based on operational status data and validity reports, including:

[0018] Based on operational status data and validity reports, a multidimensional input vector is constructed using feature fusion technology.

[0019] The multidimensional input vector is processed by a pre-trained performance diagnostic model to output labels of key performance factors.

[0020] Generate probe performance analysis reports based on performance key factor tags.

[0021] In one embodiment, a multi-dimensional input vector is constructed using feature fusion technology based on runtime status data and validity reports, including:

[0022] Based on the running status data, the following running status vector is generated:

[0023]

[0024] Where X is the running state vector, This represents the CPU utilization rate. This represents the memory buffer usage rate. This represents the packet loss rate.

[0025] The root validity report generates the following validation conclusion vector:

[0026]

[0027] Where Y is the verification conclusion vector. This represents the discrete mapping value for the network traffic validity verification conclusion. For the discrete mapping value of the call chain integrity verification conclusion, Discrete mapping values ​​are used to verify the accuracy of the indicators.

[0028] Apply the following dynamic diagonal weight matrix Perform a weighted operation on the running state vector:

[0029]

[0030] in, It is a dynamic diagonal weight matrix. , and These are CPU weight coefficient, memory weight coefficient, and packet loss rate weight coefficient, which are dynamically generated based on the preset system resource priority configuration.

[0031] Apply the following preset weight matrix Perform a weighted operation on the verification conclusion vector:

[0032]

[0033] Where W is a preset weight matrix, , and These are network traffic verification weight value, call chain verification weight value, and indicator verification weight value, respectively. The weight values ​​are taken from the preset verification conclusion weight table.

[0034] Perform the following vector concatenation operation to generate a multidimensional input vector:

[0035]

[0036] in, For multidimensional input vectors, is a dynamic diagonal weight matrix, X is the running state vector, W is the preset weight matrix, and Y is the verification conclusion vector.

[0037] In one embodiment, based on the performance analysis report, the operating parameters of the acquisition probe are adjusted according to preset adjustment rules, including:

[0038] Based on the key performance factor tags in the performance analysis report, target parameter items and adjustment strategies are generated using preset adjustment rules.

[0039] Based on the dynamic diagonal weight matrix The target parameters and adjustment strategies are updated to determine the operating parameters of the acquisition probe.

[0040] In one embodiment, based on the dynamic diagonal weight matrix The target parameters and adjustment strategies are used to update the operating parameters of the acquisition probe, including:

[0041] Construct the following runtime parameter adjustment vector:

[0042]

[0043] in, Adjust the vector for runtime parameters. For the adjustment amount of the i-th running parameter, , This represents the baseline adjustment range of the i-th parameter, taken from the target parameter term. Let i be the adjustment strategy function for the i-th parameter, defined in the adjustment strategy. The eigenvalues ​​of the target parameter term;

[0044] Adjust vectors based on operating parameters Perform dynamic iterative update operations with the following parameters:

[0045]

[0046] in, The current parameter vector in the k-th iteration. Let be the updated parameter vector after the (k+1)th iteration. The convergence factor is determined according to the policy function. The output is dynamically configured. This is a preset threshold for parameter changes.

[0047] In one embodiment, the dynamic diagonal weight matrix Generate in the following way:

[0048] Get current system resource priority configuration parameters ,in This is a priority quantification value for CPU resources. Quantification value for the priority of memory resources. These are the priority quantization values ​​for packet loss rate monitoring. The range of values ​​for each priority quantization value is as follows: And satisfy ;

[0049] Use the normalization function through the following formula. Configure priority parameters Convert to weighting coefficients :

[0050]

[0051]

[0052]

[0053] in, , and These are the CPU weighting coefficient, memory weighting coefficient, and packet loss rate weighting coefficient, respectively. This is the normalization function;

[0054] According to the weighting coefficients Constructing a dynamic diagonal weight matrix .

[0055] Secondly, this application also provides a non-intrusive data collection system for operation and maintenance in a domestically developed information technology environment, including:

[0056] The probe building module is used to build acquisition probes based on Linux kernel functions and eBPF technology.

[0057] The non-intrusive acquisition module is used to collect operation and maintenance data using acquisition probes. The operation and maintenance data includes network traffic, system call chains, and hardware performance indicators.

[0058] The validity verification module is used to verify the validity of operation and maintenance data and generate a validity report.

[0059] The monitoring module is used to acquire the running status data of the acquisition probe, including CPU utilization, memory buffer usage, and data packet loss rate.

[0060] The performance analysis module is used to generate probe performance analysis reports based on operational status data and validity reports;

[0061] The parameter optimization module is used to adjust the operating parameters of the acquisition probe based on the performance analysis report and according to preset adjustment rules to form an optimized probe.

[0062] The probe hot-replacement module is used to apply optimized probes to perform subsequent collection of operation and maintenance data.

[0063] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method for non-intrusive data collection in the information technology innovation environment.

[0064] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method for non-intrusive data collection in the IT innovation environment.

[0065] The aforementioned non-intrusive data collection method, system, computer equipment, and storage media for IT innovation environments utilize eBPF technology to construct collection probes based on Linux kernel functions. This enables non-intrusive collection of network traffic, system call chains, and hardware performance indicators, resolving the intrusive issues caused by traditional methods requiring system configuration modifications and avoiding system resource allocation imbalances and compatibility risks. By verifying the validity of the maintenance data and generating a validity report, and combining this with the acquired probe operating status data, a probe performance analysis report is generated. Based on this report, operating parameters are dynamically optimized according to preset adjustment rules to form an optimized probe, which is then applied to subsequent data collection. This achieves a closed-loop parameter tuning mechanism, significantly reducing CPU and memory overhead, improving data reliability, and enhancing dynamic adaptability in heterogeneous IT innovation software and hardware environments. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0067] Figure 1 This is a flowchart of the non-intrusive data collection method for operation and maintenance in the domestic IT innovation environment according to the present invention;

[0068] Figure 2 This is a structural diagram of the non-intrusive data acquisition system for the operation and maintenance of the domestic IT innovation environment according to the present invention. Detailed Implementation

[0069] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0070] In one embodiment, such as Figure 1As shown, a non-intrusive method for collecting operation and maintenance data in a domestically developed environment is provided. This embodiment uses the application of this method to a terminal as an example for illustration. It can be understood that this method can also be applied to servers, and can also be applied to systems including terminals and servers, and can be implemented through the interaction between the terminal and the server. In a domestically developed environment (such as a heterogeneous hardware platform equipped with domestic CPUs, operating systems and middleware), the terminal or server loads a collection probe built using eBPF technology based on Linux kernel functions to achieve non-intrusive data collection: the probe directly captures network traffic (such as network card data packets), system call chains (such as process identifier sequences) and hardware performance indicators (such as CPU utilization) at the kernel layer. When the system faces high-concurrency business loads or resource-constrained scenarios, the terminal / server obtains hardware baseline values ​​through the sysfs interface and simultaneously collects the packet loss value of the network interface hardware counter to verify the validity of the operation and maintenance data; at the same time, it monitors the CPU utilization, memory buffer usage and packet loss rate of the probe itself in real time. Based on the verification conclusions and operational status data, the system uses feature fusion technology to construct a multi-dimensional input vector, generates a performance analysis report through a pre-trained model, and then dynamically generates a weight matrix Λ according to resource priority configuration to drive closed-loop iterative optimization of operating parameters (such as adjusting the sampling frequency or buffer size). Optimization probes are deployed through a hot-replacement mechanism to keep resource overhead within a threshold while ensuring data integrity.

[0071] In this embodiment, the method includes the following steps:

[0072] S01 is a data acquisition probe built using eBPF technology based on Linux kernel functions.

[0073] The system comprises several components: a Linux kernel function-based interface for the operating system kernel layer to directly access and control hardware resources; eBPF (Extended Berkeley Package Filter) technology, an efficient mechanism for securely executing programs within the kernel virtual machine, supporting dynamic loading and execution without modifying kernel source code or system configuration; and a data acquisition probe, a lightweight data acquisition agent built using this technology, deployed at the operating system kernel layer to capture operational data in real time. In implementation, a custom eBPF program can be loaded via the bpf() system call provided by the Linux kernel or the libbpf library. Before loading, the kernel eBPF verifier must check instruction security (e.g., prohibiting out-of-bounds access and limiting loop counts). When deploying the probe, the tracepoint hooks sys_enter / sys_exit (system call tracing), the xdp hooks network device drivers (network traffic collection), and the perf_event binds hardware counters (hardware performance measurement). This allows for the non-intrusive construction of a probe component capable of collecting network traffic, system call chains, and hardware performance metrics in real time, without requiring modification of the kernel source code or loading of additional kernel modules.

[0074] S02 uses acquisition probes to collect operation and maintenance data, including network traffic, system call chains, and hardware performance indicators.

[0075] Among them, the collection of operation and maintenance data using the acquisition probe is a kernel-level agent program built based on eBPF technology. It captures the runtime information of the target system in real time without modifying the operating system configuration or loading additional kernel modules. The operation and maintenance data covers network traffic (i.e., the metadata and payload content of data packets flowing through the network interface), system call chain (the call path composed of the process identifier sequence and the system call sequence number it triggers), and hardware performance indicators (including underlying resource metrics such as CPU utilization, memory usage, and disk I / O throughput). In implementation, a pre-built eBPF program hooks into the Linux kernel's network protocol stack processing functions (such as the XDP framework), system call tracepoints, and hardware performance event monitoring interfaces (perf_event). Utilizing the eBPF virtual machine's zero-copy data path and ring buffer storage mechanism, efficient data transfer from kernel to user space is achieved. (The zero-copy data path is implemented based on the Linux kernel's bpf_ringbuf mechanism; the kernel-mode eBPF program directly writes the collected data to the ring buffer, and the user-mode process reads it via bpf_ringbuf_read(), eliminating the need for kernel / user-mode data copying. The ring buffer size is dynamically configured according to the collection frequency: 64KB for network traffic collection (frequency 1000pps) and 32KB for system call chain collection (frequency 100pps). The buffer size must be a power of 2 (to be compatible with kernel page alignment requirements), specified via the size parameter of bpf_ringbuf_create().) Without needing to start or stop services or adjust system parameters, parallel collection of three types of operational data—network packet capture, call chain tracing, and hardware indicator sampling—is completed simultaneously, forming a real-time monitoring capability with zero-configuration deployment.

[0076] S03, verify the validity of the operation and maintenance data and generate a validity report.

[0077] The verification of operational data involves checking the accuracy, completeness, and consistency of collected operational data through a pre-defined verification mechanism to ensure that the data accurately reflects the system's operating status. The validity report is a summary document generated based on the verification results, containing verification conclusions for three types of data: network traffic, system call chains, and hardware performance metrics, used to indicate data reliability. In implementation, for network traffic data, the packet loss value of the network interface hardware counter is collected and compared with the actual number of collected data packets to determine the validity of the network traffic data. For system call chain data, the continuity of the process identifier sequence and the system call sequence number are verified to generate a call chain integrity verification conclusion. For hardware performance metrics, hardware baseline values ​​are obtained through the sysfs interface, and the deviation rate between the collected values ​​and the baseline values ​​is calculated. The accuracy of the metrics is verified based on whether the deviation rate exceeds a preset threshold. These verification conclusions are summarized and integrated to form a structured validity report, providing data quality assurance for subsequent performance optimization.

[0078] S04, acquire the operating status data of the acquisition probe, including CPU utilization, memory buffer usage and data packet loss rate.

[0079] The acquisition of operational status data from the acquisition probe involves real-time monitoring of its runtime performance metrics to quantify resource consumption and data acquisition reliability. This operational status data includes CPU utilization (representing the percentage of CPU resources used during probe execution), memory buffer usage (reflecting the proportion of kernel buffer memory used by the probe), and packet loss rate (the proportion of packets lost due to resource limitations during acquisition). In implementation, performance monitoring interfaces provided by the Linux kernel (such as perf event or sysfs) are used to periodically sample or trigger events to read CPU time slice allocation statistics, memory buffer allocation status, and network interface hardware counter packet loss values ​​from the probe in real time. This data is then aggregated into a structured operational status dataset, providing dynamic monitoring data for subsequent performance optimization without interrupting probe operation.

[0080] S05. Generate a probe performance analysis report based on the operating status data and validity report.

[0081] The probe performance analysis report is a structured diagnostic output reflecting probe performance bottlenecks and optimization directions. In implementation, based on operational status data and validity reports, a multi-dimensional input vector is constructed using feature fusion technology. This includes generating an operational status vector (such as a vector composed of CPU utilization, memory buffer usage, and packet loss rate) and a verification conclusion vector (such as discrete mapping values ​​of network traffic, call chain integrity, and indicator accuracy verification conclusions). A dynamic diagonal weight matrix is ​​applied to weight the operational status vector (where weight coefficients are dynamically generated based on system resource priority configuration). Simultaneously, a preset weight matrix is ​​applied to weight the verification conclusion vector. These vectors are then concatenated to form a multi-dimensional input vector. This vector is processed by a pre-trained performance diagnostic model, outputting labels for key performance factors. Based on these labels, a probe performance analysis report is generated, providing a decision-making basis for dynamically optimizing the acquisition probe.

[0082] S06. Based on the performance analysis report, adjust the operating parameters of the acquisition probe according to the preset adjustment rules to form an optimized probe.

[0083] The preset adjustment rules are a set of pre-configured parameter optimization strategies, including target parameter items (such as sampling frequency or buffer size) and their associated adjustment strategy functions. The optimized probe is a collection probe instance formed after dynamic parameter iterative updates, achieving a balance between resource consumption and data reliability. In implementation, based on the key performance factor tags in the performance analysis report, the preset adjustment rules can be used to map target parameter items (such as network traffic sampling interval, call chain tracing depth) and their corresponding adjustment strategy functions. A dynamic diagonal weight matrix is ​​then combined to construct a runtime parameter adjustment vector. Based on this vector, the probe parameters are updated through dynamic iterative updates, forming an optimized probe that balances low resource consumption and high data reliability.

[0084] S07, Apply the optimization probe to perform subsequent collection of operation and maintenance data.

[0085] In practice, optimized probes can be dynamically loaded to the operating system kernel layer through a probe hot-replacement mechanism. This replaces the currently running acquisition probes without interrupting the target system services. (Probe hot-replacement first unloads the currently running eBPF program using eBPF's bpf_prog_detach() (preserving the circular buffer data to avoid loss), and then loads the optimized eBPF program using bpf_prog_attach(). During the replacement process, a signal semaphore ensures that the user-space data receiving process is not interrupted. The replacement time is ≤10ms, meeting the real-time requirements of operation and maintenance data acquisition. There are no data breakpoints when the acquisition interval is ≥100ms.) The zero-configuration deployment feature of eBPF technology is used to execute subsequent data acquisition tasks, including real-time capture of network packet metadata, tracking the continuity of process identifier sequences, and sampling hardware performance events, forming a closed-loop optimization cycle. This ensures that the reliability and dynamic adaptability of data acquisition are improved while reducing CPU and memory overhead.

[0086] The aforementioned non-intrusive data collection method for maintenance operations in a domestically developed IT environment utilizes eBPF technology to construct a collection probe based on Linux kernel functions, enabling non-intrusive collection of maintenance data on network traffic, system call chains, and hardware performance indicators. It verifies the validity of the maintenance data, generates a validity report, and simultaneously acquires operational status data such as CPU utilization, memory buffer usage, and packet loss rate of the collection probe. Combining the operational status data with the validity report, a probe performance analysis report is generated. Based on this report, the operating parameters of the collection probe are dynamically optimized according to preset adjustment rules to form an optimized probe, which is then used to execute subsequent maintenance data collection. This method avoids modification of system configuration through the kernel-level secure execution mechanism of eBPF technology, eliminating compatibility risks caused by traditional agent deployment or kernel module injection at the source. Through a closed-loop dynamic optimization mechanism, based on the performance analysis report generated by multi-dimensional vector fusion, parameters such as sampling frequency and buffer size are adjusted in real time to suppress CPU utilization and reduce memory consumption. A triple verification mechanism based on hardware counter comparison, call chain continuity verification, and baseline deviation detection reduces packet loss rate, achieving highly reliable and low-overhead optimized maintenance data collection in a heterogeneous domestically developed IT environment.

[0087] In one embodiment, verifying the validity of the operation and maintenance data and generating a validity report includes:

[0088] S11. For network traffic data, collect the packet loss value of the network interface hardware counter, compare the number of collected data packets with the packet loss value, and determine the network traffic validity verification conclusion based on the comparison result.

[0089] S12, for system call chain data, verify the continuity of the collected process identifier sequence and the continuity of the system call sequence number, and determine the call chain integrity verification conclusion based on the verification results;

[0090] S13. For hardware performance indicators, obtain hardware baseline values ​​through the sysfs interface, calculate the deviation rate between the collected values ​​and the baseline values, determine whether the deviation rate exceeds the first preset threshold, and determine the accuracy verification conclusion of the indicators based on the judgment result.

[0091] S14: Summarize the network traffic validity verification conclusions, call chain integrity verification conclusions, and indicator accuracy verification conclusions, and generate a validity report.

[0092] For example, network traffic data consists of the metadata and payload content of data packets flowing through the network interface; system call chain data consists of the call path consisting of a sequence of process identifiers and the system call numbers they trigger; hardware performance indicators include underlying resource metrics such as CPU utilization, memory usage, and disk I / O throughput; and the validity report is a structured document that summarizes the network traffic validity verification conclusions, call chain integrity verification conclusions, and indicator accuracy verification conclusions. In implementation, for network traffic data, packet loss values ​​are obtained by collecting network interface hardware counters (such as packet loss statistics in the network card register). The actual number of collected data packets is compared with this packet loss value. If the difference is within a preset tolerance range, it is considered valid; otherwise, it is considered invalid, and a network traffic validity verification conclusion is generated. For system call chain data, it is verified whether the collected process identifier sequence (such as process ID) is continuous and uninterrupted, and whether the system call sequence number (such as system call number) is logically consecutive. The call chain integrity verification conclusion is determined based on the sequence missing or sequence number jump. For hardware performance indicators, the sysfs interface (the hardware baseline value reading path of the sysfs interface is / sys / devices / system / cpu / cpu0 / cpufreq / base_freq (CPU...)) can be used. The reference frequency and total memory capacity ( / sys / devices / virtual / meminfo / MemTotal) are read from the file using the open() / read() system calls and converted into numerical reference values. For custom hardware (such as domestic CPUs), their extended sysfs paths (e.g., / sys / devices / platform / <domestic hardware driver> / base_metric) must be compatible. The deviation rate between the sampled values ​​and the reference values ​​is calculated using the following formula: If the deviation rate exceeds the first preset threshold (determined based on hardware test results in the domestic IT innovation environment: in tests of 3 mainstream domestic CPUs (Phytium 2000+ / Kunpeng 920 / Hygon C86) and 2 Linux systems (Kylin V10 / Euler 22.03), the natural deviation between the collected values ​​of hardware performance indicators (such as CPU utilization and memory utilization) and the sysfs benchmark values). Therefore, it is set Threshold (inclusive) If the tolerance margin exceeds a certain value, it is considered an abnormal data collection. If the tolerance margin is too high, it is considered inaccurate; otherwise, it is considered accurate, and an accuracy verification conclusion is generated. The above three types of verification conclusions are summarized and integrated, and an effectiveness report containing an overall data reliability assessment is generated through a structured data integration mechanism.

[0093] In one embodiment, a probe performance analysis report is generated based on operational status data and validity reports, including:

[0094] S21. Based on the operational status data and validity report, construct a multi-dimensional input vector using feature fusion technology;

[0095] S22 processes the multidimensional input vector through a pre-trained performance diagnostic model and outputs labels of key performance factors.

[0096] S23, based on the performance key factor tags, generates a probe performance analysis report.

[0097] Specifically, the validity report includes discrete mapping values ​​for network traffic validity verification conclusions (quantized values ​​generated by comparing the packet loss value of the network interface hardware counter with the number of collected data packets), discrete mapping values ​​for call chain integrity verification conclusions (integrity identifiers generated by verifying the continuity of process identifier sequences and system call sequence numbers), and discrete mapping values ​​for indicator accuracy verification conclusions (accuracy identifiers generated based on whether the deviation rate between the collected hardware performance indicator values ​​and the benchmark values ​​obtained from the sysfs interface exceeds a first preset threshold). The multidimensional input vector is a high-dimensional data representation constructed through feature fusion technology, used to integrate the weighted running status and verification conclusion data. The performance diagnostic model is a pre-trained machine learning model (using a lightweight neural network (6-dimensional vector input layer, 2 hidden layers (32 neurons each)). The model consists of four categories of labels: CPU overload, insufficient memory, high packet loss rate, and invalid data. The training data comes from the operation and maintenance data of 10 types of domestically produced CPUs and Linux systems (including normal / abnormal scenarios, totaling 100,000 samples). The features are the fusion results of the running status vector (CPU utilization, etc.) and the verification conclusion vector (discrete mapping values). The model is trained using the Adam optimizer and cross-entropy loss function. Training stops when the model accuracy is ≥95%, and the data is saved as model.pt for inference. The performance key factor label is a category identifier of the model output that identifies performance bottlenecks or optimization directions (such as insufficient CPU resources or abnormal data integrity). The probe performance analysis report is a structured output document generated based on this label, containing diagnostic conclusions and optimization suggestions. In implementation, a running status vector is generated based on running status data, and a verification conclusion vector is generated based on the validity report. A dynamic diagonal weight matrix is ​​applied to weight the running status vector, and a preset weight matrix is ​​applied to weight the verification conclusion vector. Vector concatenation is then performed on the weighted vectors to generate a multi-dimensional input vector. A pre-trained performance diagnostic model processes the multi-dimensional input vector, extracting features and outputting key performance factor labels (such as classification labels indicating CPU overload or high packet loss rate). Based on these key performance factor labels, a probe performance analysis report is synthesized through a report generation engine (template filling mechanism), providing quantitative diagnostic basis for subsequent dynamic optimization of probe parameters and ensuring the implementation of a closed-loop parameter tuning mechanism.

[0098] In one embodiment, a multi-dimensional input vector is constructed using feature fusion technology based on runtime status data and validity reports, including:

[0099] S31, Based on the running status data, generate the following running status vector:

[0100]

[0101] Where X is the running state vector, This represents the CPU utilization rate. This represents the memory buffer usage rate. This represents the packet loss rate.

[0102] S32, Root Validity Report, generates the following validation conclusion vector:

[0103]

[0104] Where Y is the verification conclusion vector. This represents the discrete mapping value for the network traffic validity verification conclusion. For the discrete mapping value of the call chain integrity verification conclusion, Discrete mapping values ​​are used to verify the accuracy of the indicators.

[0105] S33, apply the following dynamic diagonal weight matrix Perform a weighted operation on the running state vector:

[0106]

[0107] in, It is a dynamic diagonal weight matrix. , and These are CPU weight coefficient, memory weight coefficient, and packet loss rate weight coefficient, which are dynamically generated based on the preset system resource priority configuration.

[0108] S34, apply the following preset weight matrix Perform a weighted operation on the verification conclusion vector:

[0109]

[0110] Where W is a preset weight matrix, , and These are network traffic verification weight value, call chain verification weight value, and indicator verification weight value, respectively. The weight values ​​are taken from the preset verification conclusion weight table.

[0111] S35, perform the following vector concatenation operation to generate a multidimensional input vector:

[0112]

[0113] in, For multidimensional input vectors, is a dynamic diagonal weight matrix, X is the running state vector, W is the preset weight matrix, and Y is the verification conclusion vector.

[0114] For example, the runtime status data is a set of real-time performance metrics including CPU utilization (reflecting the percentage of CPU resources consumed when the acquisition probe is executed), memory buffer utilization (representing the real-time memory usage ratio of the kernel-mode circular buffer), and packet loss rate (referring to the statistical ratio of packet loss due to resource limitations). The verification conclusion vector is a mathematical representation generated based on the validity report, where the network traffic validity verification conclusion is a discrete mapping value ( The result is obtained by comparing the packet loss value of the quantized network interface hardware counter with the actual number of packets collected (valid mapping is 1, invalid is 0), and the chain integrity verification conclusion is called to obtain the discrete mapping value. The jump variable is calculated based on the number of interrupt points in the process identifier sequence and the system call sequence number (1 for continuous and complete jumps, 0 for otherwise). The accuracy of the indicator is verified by the discrete mapping value. The system determines whether the deviation rate between the hardware performance index collected and the sysfs interface baseline value exceeds a threshold setting (deviation ≤ 5% is mapped to 1, otherwise it is 0); where the dynamic diagonal weight matrix... The weighted diagonal matrix is ​​a weighted sum of the running state vectors, and its weight coefficients are... , and It can be dynamically generated using a normalization function, with a preset weight matrix. For a fixed diagonal matrix, its weight values , and Load directly from a predefined verification conclusion weight table (e.g., network traffic verification weight values). The default configuration is 0.5). During implementation, a running state vector X is generated based on the running state data. (Periodic sampling via the Linux kernel perf event interface) and x, read through the network card register Simultaneously, a validation conclusion vector is generated based on the validity report. (Converting textual conclusions into discrete numerical values ​​using a pre-defined mapping table); applying a dynamic diagonal weight matrix. Perform a weighted operation on X (achieving adaptive scalar scaling of resource priorities through matrix multiplication), and simultaneously apply a pre-defined weight matrix W to Y to perform a weighted operation (implementing static weight allocation for verification conclusions); perform a vector concatenation operation. A 6-dimensional input vector (which is a fusion of weighted 3-dimensional running status data and 3-dimensional verification conclusion data) is generated to provide a structured input for feature fusion for the performance diagnostic model.

[0115] In one embodiment, based on the performance analysis report, the operating parameters of the acquisition probe are adjusted according to preset adjustment rules, including:

[0116] S41, Based on the key performance factor labels in the performance analysis report, generate target parameter items and adjustment strategies using preset adjustment rules;

[0117] S42, based on the dynamic diagonal weight matrix The target parameters and adjustment strategies are updated to determine the operating parameters of the acquisition probe.

[0118] Specifically, the preset adjustment rules are a pre-configured set of optimization strategies, the target parameter items are the identifiers of the operating parameters to be adjusted (such as network traffic sampling interval, call chain tracing depth, or memory buffer capacity), and the adjustment strategies are mathematical function mapping relationships associated with the target parameter items. In implementation, based on the key performance factor tags in the performance analysis report (such as CPU resource overload or high packet loss rate tags), the preset adjustment rule library is queried through the rule mapping engine to generate the target parameter items and their associated adjustment strategy functions (e.g., mapping the sampling frequency parameter and the corresponding linear frequency reduction function for the CPU overload tag). Resource-aware parameter updates are performed using a dynamic diagonal weight matrix: the baseline adjustment magnitude of the target parameter item (obtained from a preset magnitude table based on the parameter type) is multiplied by the adjustment strategy function, and a global parameter adjustment vector is formed through weighted fusion using the dynamic diagonal weight matrix. The probe operating parameters are updated in a controlled iterative manner (the update magnitude is dynamically constrained by a convergence factor), achieving a dynamic balance between resource allocation and data acquisition reliability. Closed-loop feedback continuously optimizes the probe configuration, ensuring low-overhead, high-reliability data acquisition in a heterogeneous environment.

[0119] In one embodiment, based on the dynamic diagonal weight matrix The target parameters and adjustment strategies are used to update the operating parameters of the acquisition probe, including:

[0120] S51, construct the following runtime parameter adjustment vector:

[0121]

[0122] in, Adjust the vector for runtime parameters. For the adjustment amount of the i-th running parameter, , This represents the baseline adjustment range of the i-th parameter, taken from the target parameter term. Let i be the adjustment strategy function for the i-th parameter, defined in the adjustment strategy. The eigenvalues ​​of the target parameter term;

[0123] S52, adjust vectors according to operating parameters Perform dynamic iterative update operations with the following parameters:

[0124]

[0125] in, The current parameter vector in the k-th iteration. Let be the updated parameter vector after the (k+1)th iteration. The convergence factor is determined according to the policy function. The output is dynamically configured. This is a preset threshold for parameter changes.

[0126] For example, the runtime parameter adjustment vector A mathematical vector representing the parameter adjustment amount, its elements This represents the adjustment amount of the i-th operating parameter (such as the network traffic sampling interval or memory buffer size), where the baseline adjustment range is... Taken from the preset target parameter item (taken from the preset configuration table of the target parameter item: network traffic sampling interval (unit: milliseconds)). (i.e., baseline adjustment range 20ms), memory buffer size (unit: KB) (Base adjustment range 128KB), call chain sampling depth (Baseline adjustment range, 2-level call); The range of α values ​​is determined based on hardware resources, such as memory. At that time, buffer ;Memory hour, Adjusting the strategy function For mathematical mapping rules associated with the target parameter term (such as linear functions) (or piecewise threshold function), eigenvalues This represents the real-time status value of the target parameter (if the target parameter is the network traffic sampling interval). If it is the current sampling interval, such as 100ms; if it is the size of the memory buffer, (Assuming the current buffer utilization is 60%), the dynamic iterative update operation is a parameter vector optimization process, where... This is the current parameter vector for the k-th iteration (containing the current configuration values ​​of all running parameters). Let be the updated parameter vector after the (k+1)th iteration, and let γ be the step size control coefficient dynamically configured according to the policy function output (dynamically configured according to the policy function adjustment: if the policy function is a linear function (such as sampling frequency adjustment)). (Fast convergence); If it is a non-linear function (such as buffer size adjustment, it needs to be compatible with hardware page size), (Smooth convergence), the range of γ is... System resource load (CPU utilization) (Adaptive adjustment: take larger value when the time is right, and smaller value when the time is wrong) Preset parameter change threshold (preset parameter change threshold) The unit is the relative rate of change of the parameter, i.e. ( (To avoid parameter mutations); during implementation, construct a runtime parameter adjustment vector. (where the dynamic diagonal weight matrix) Inherited from the resource priority matrix generated in the multidimensional input vector stage, through its diagonal elements , and Resource-aware weighting is applied to each adjustment, for example, when CPU priority is high... Increase and enhance CPU-related parameter adjustments), and perform dynamic iterative parameter update operations. and through constraints Ensure the update volume is controlled and output the optimized parameter vector; for example, for the network traffic sampling interval parameter. If the target parameter item specifies The policy function is (in (At the current sampling rate of 1000Hz), In the matrix (Because CPU resources have high priority), then , combined The convergence factor will Iterative updates from 1000Hz to 952Hz (meeting requirements) (Constraints) to achieve a dynamic balance between resource consumption and data reliability.

[0127] In one embodiment, the dynamic diagonal weight matrix Generate in the following way:

[0128] S61, Obtain current system resource priority configuration parameters ,in This is a priority quantification value for CPU resources. Quantification value for the priority of memory resources. These are the priority quantization values ​​for packet loss rate monitoring. The range of values ​​for each priority quantization value is as follows: And satisfy ;

[0129] S62, using the normalization function through the following formula. Configure priority parameters Convert to weighting coefficients :

[0130]

[0131]

[0132]

[0133] in, , and These are the CPU weighting coefficient, memory weighting coefficient, and packet loss rate weighting coefficient, respectively. This is the normalization function;

[0134] S63, based on weighting coefficients Constructing a dynamic diagonal weight matrix .

[0135] Specifically, system resource priority configuration parameters It is obtained from the user-space configuration file / etc / ebpf_probe / priority.conf, and the file format is... (correspond , , If dynamic adjustments are required, configuration commands can be sent via the ioctl() interface (device file / dev / ebpf_priority). The interface command code is EBPF_SET_PRIORITY, and the parameters are the structure structpriority_config { float cpu; float mem; float loss;}, ensuring that the configuration takes effect in real time (effectiveness delay ≤ 500ms). System resource priority configuration parameters. It is a three-dimensional column vector, where This represents the priority quantification value of CPU resources (reflecting the relative importance of CPU monitoring tasks in system resource allocation). This represents the priority quantification value of memory resources (identifying the weight level of memory buffer monitoring). This represents the priority quantification value for packet loss rate monitoring (representing the priority of network data integrity assurance), and the range of each quantification value is as follows: And must meet Normalization constraints; normalization function The transformation function is based on exponential operations, and its mathematical expression is: This is used to convert priority quantization values ​​into weight coefficients in the form of a probability distribution; in implementation, the current resource priority parameters are obtained in real time through system configuration interfaces (such as kernel modules or user-space configuration files). Applying the normalization function Calculate each weight coefficient separately: , and This function ensures that the output weights satisfy the conditions through exponential operations and denominator normalization. Call the matrix construction engine to calculate the... Coefficients are filled into the diagonal matrix The main diagonal position generates a dynamic weight matrix that can be directly used for vector weighting operations. Dynamic adaptation of resource allocation is achieved through soft priority configuration, such as when... , , hour, (coefficient) (Approximate calculation) significantly improves the weighting of CPU-related metrics, optimizing data acquisition efficiency in resource-constrained scenarios.

[0136] The aforementioned non-intrusive data collection method for IT infrastructure environments utilizes eBPF technology to construct a kernel-level collection probe. By hooking into the Linux kernel network protocol stack, system call tracing points, and hardware monitoring interfaces, it achieves non-intrusive data collection without the need for agent installation or kernel module injection, eliminating compatibility risks and resource allocation imbalances caused by system configuration modifications. Through a triple verification mechanism—including network packet loss comparison, call chain continuity verification, and hardware indicator deviation rate detection—combined with operational status monitoring, a fusion resource priority weight matrix is ​​generated. Multidimensional diagnostic input drives the pre-trained model to accurately locate performance bottlenecks; based on a dynamic parameter iteration algorithm, the sampling frequency and buffer parameters are optimized in real time, and optimization probes are deployed through a hot-swap mechanism to form a closed-loop parameter tuning, achieving the following beneficial effects: significantly reduced resource overhead, and CPU utilization rate reduced from traditional solutions. Down to The following reduces memory buffer consumption. Reliability is fundamentally improved, and the packet loss rate is controlled within a certain range. Within the threshold; dynamic adaptation to heterogeneous environments, through Matrix priority self-adaptation and The iterative constraints maintain data integrity in heterogeneous software and hardware scenarios of information technology innovation, overcoming the shortcomings of poor dynamic adaptability.

[0137] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0138] Based on the same inventive concept, this application also provides a non-intrusive data collection system for implementing the aforementioned non-intrusive data collection method for operations and maintenance in a domestically developed IT environment. The solution provided by this system is similar to the implementation scheme described in the above method. Therefore, the specific limitations of one or more embodiments of the non-intrusive data collection system for operations and maintenance in a domestically developed IT environment provided below can be found in the limitations of the non-intrusive data collection method for operations and maintenance in a domestically developed IT environment described above, and will not be repeated here.

[0139] In one exemplary embodiment, such as Figure 2 As shown, a non-intrusive data collection system for operation and maintenance in a domestic IT innovation environment is provided, including:

[0140] The probe building module 101 is used to build acquisition probes based on Linux kernel functions and eBPF technology.

[0141] The non-intrusive acquisition module 102 is used to collect operation and maintenance data using acquisition probes. The operation and maintenance data includes network traffic, system call chains and hardware performance indicators.

[0142] The validity verification module 103 is used to verify the validity of operation and maintenance data and generate a validity report;

[0143] The monitoring module 104 is used to acquire the running status data of the acquisition probe, including CPU utilization, memory buffer usage and data packet loss rate.

[0144] The performance analysis module 105 is used to generate a probe performance analysis report based on the running status data and validity report;

[0145] The parameter optimization module 106 is used to adjust the operating parameters of the acquisition probe based on the performance analysis report and according to preset adjustment rules to form an optimized probe.

[0146] The probe hot-replacement module 107 is used to perform subsequent collection of operation and maintenance data using the application optimization probe.

[0147] In one embodiment, the validity verification module 103 is further configured to:

[0148] For network traffic data, the packet loss value of the network interface hardware counter is collected, the number of collected data packets is compared with the packet loss value, and the validity verification conclusion of the network traffic is determined based on the comparison result.

[0149] For system call chain data, verify the continuity of the collected process identifier sequence and the continuity of the system call sequence number, and determine the call chain integrity verification conclusion based on the verification results;

[0150] For hardware performance indicators, hardware baseline values ​​are obtained through the sysfs interface, the deviation rate between the collected values ​​and the baseline values ​​is calculated, it is determined whether the deviation rate exceeds the first preset threshold, and the accuracy verification conclusion of the indicators is determined based on the judgment result.

[0151] Summarize the network traffic validity verification conclusions, call chain integrity verification conclusions, and indicator accuracy verification conclusions to generate a validity report.

[0152] In one embodiment, the performance analysis module 105 is further configured to:

[0153] Based on operational status data and validity reports, a multidimensional input vector is constructed using feature fusion technology.

[0154] The multidimensional input vector is processed by a pre-trained performance diagnostic model to output labels of key performance factors.

[0155] Generate probe performance analysis reports based on performance key factor tags.

[0156] In one embodiment, the performance analysis module 105 is further configured to:

[0157] Based on the running status data, the following running status vector is generated:

[0158]

[0159] Where X is the running state vector, This represents the CPU utilization rate. This represents the memory buffer usage rate. This represents the packet loss rate.

[0160] The root validity report generates the following validation conclusion vector:

[0161]

[0162] Where Y is the verification conclusion vector. This represents the discrete mapping value for the network traffic validity verification conclusion. For the discrete mapping value of the call chain integrity verification conclusion, Discrete mapping values ​​are used to verify the accuracy of the indicators.

[0163] Apply the following dynamic diagonal weight matrix Perform a weighted operation on the running state vector:

[0164]

[0165] in, It is a dynamic diagonal weight matrix. , and These are CPU weight coefficient, memory weight coefficient, and packet loss rate weight coefficient, which are dynamically generated based on the preset system resource priority configuration.

[0166] Apply the following preset weight matrix Perform a weighted operation on the verification conclusion vector:

[0167]

[0168] Where W is a preset weight matrix, , and These are network traffic verification weight value, call chain verification weight value, and indicator verification weight value, respectively. The weight values ​​are taken from the preset verification conclusion weight table.

[0169] Perform the following vector concatenation operation to generate a multidimensional input vector:

[0170]

[0171] in, For multidimensional input vectors, is a dynamic diagonal weight matrix, X is the running state vector, W is the preset weight matrix, and Y is the verification conclusion vector.

[0172] In one embodiment, the parameter optimization module 106 is further configured to:

[0173] Based on the key performance factor tags in the performance analysis report, target parameter items and adjustment strategies are generated using preset adjustment rules.

[0174] Based on the dynamic diagonal weight matrix The target parameters and adjustment strategies are updated to determine the operating parameters of the acquisition probe.

[0175] In one embodiment, the parameter optimization module 106 is further configured to:

[0176] Construct the following runtime parameter adjustment vector:

[0177]

[0178] in, Adjust the vector for runtime parameters. For the adjustment amount of the i-th running parameter, , This represents the baseline adjustment range of the i-th parameter, taken from the target parameter term. Let i be the adjustment strategy function for the i-th parameter, defined in the adjustment strategy. The eigenvalues ​​of the target parameter term;

[0179] Adjust vectors based on operating parameters Perform dynamic iterative update operations with the following parameters:

[0180]

[0181] in, The current parameter vector in the k-th iteration. Let be the updated parameter vector after the (k+1)th iteration. The convergence factor is determined according to the policy function. The output is dynamically configured. This is a preset threshold for parameter changes.

[0182] In one embodiment, the dynamic diagonal weight matrix in parameter optimization module 106 Generate in the following way:

[0183] Get current system resource priority configuration parameters ,in This is a priority quantification value for CPU resources. Quantification value for the priority of memory resources. These are the priority quantization values ​​for packet loss rate monitoring. The range of values ​​for each priority quantization value is as follows: And satisfy ;

[0184] Use the normalization function through the following formula. Configure priority parameters Convert to weighting coefficients :

[0185]

[0186]

[0187]

[0188] in, , and These are the CPU weighting coefficient, memory weighting coefficient, and packet loss rate weighting coefficient, respectively. This is the normalization function;

[0189] According to the weighting coefficients Constructing a dynamic diagonal weight matrix .

[0190] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the non-intrusive data collection method for the operation and maintenance of the information technology innovation environment as described above.

[0191] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0192] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0193] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A non-intrusive method for collecting operation and maintenance data in a domestically developed information technology environment, characterized in that, The method includes: A data acquisition probe is constructed based on Linux kernel functions and using eBPF technology. The acquisition probe is used to collect operation and maintenance data, which includes network traffic, system call chains, and hardware performance indicators. Verify the validity of the operation and maintenance data and generate a validity report; The operating status data of the acquisition probe is obtained, including CPU utilization, memory buffer usage, and data packet loss rate. Based on the operational status data and the validity report, a probe performance analysis report is generated; Based on the performance analysis report, the operating parameters of the acquisition probe are adjusted according to preset adjustment rules to form an optimized probe; The optimized probe is then used to perform subsequent collection of operational and maintenance data.

2. The method according to claim 1, characterized in that, The verification of the validity of the operation and maintenance data and the generation of a validity report include: For the network traffic data, the packet loss value of the network interface hardware counter is collected, the number of collected data packets is compared with the packet loss value, and the validity verification conclusion of the network traffic is determined based on the comparison result. For the system call chain data, verify the continuity of the collected process identifier sequence and the continuity of the system call sequence number, and determine the call chain integrity verification conclusion based on the verification results; For the aforementioned hardware performance indicators, a hardware baseline value is obtained through the sysfs interface, the deviation rate between the collected value and the baseline value is calculated, it is determined whether the deviation rate exceeds a first preset threshold, and the accuracy verification conclusion of the indicator is determined based on the judgment result. The validity report is generated by summarizing the network traffic validity verification conclusions, call chain integrity verification conclusions, and indicator accuracy verification conclusions.

3. The method according to claim 1, characterized in that, The step of generating a probe performance analysis report based on the operating status data and the validity report includes: Based on the operational status data and the validity report, a multidimensional input vector is constructed using feature fusion technology; The multidimensional input vector is processed by a pre-trained performance diagnostic model to output labels of key performance factors. Based on the aforementioned key performance factor tags, a probe performance analysis report is generated.

4. The method according to claim 3, characterized in that, The step of constructing a multi-dimensional input vector using feature fusion technology based on the operational status data and the validity report includes: Based on the aforementioned operational status data, the following operational status vector is generated: Where X is the running state vector, This represents the CPU utilization rate. This represents the memory buffer usage rate. This represents the packet loss rate. Based on the aforementioned validity report, the following validation conclusion vector is generated: Where Y is the verification conclusion vector. This represents the discrete mapping value for the network traffic validity verification conclusion. For the discrete mapping value of the call chain integrity verification conclusion, Discrete mapping values ​​are used to verify the accuracy of the indicators. Apply the following dynamic diagonal weight matrix Perform a weighted operation on the running state vector: in, It is a dynamic diagonal weight matrix. , and These are CPU weight coefficient, memory weight coefficient, and packet loss rate weight coefficient, which are dynamically generated based on the preset system resource priority configuration. Apply the following preset weight matrix Perform a weighted operation on the verification conclusion vector: Where W is a preset weight matrix, , and These are network traffic verification weight value, call chain verification weight value, and indicator verification weight value, respectively. The weight values ​​are taken from the preset verification conclusion weight table. Perform the following vector concatenation operation to generate a multidimensional input vector: in, For multidimensional input vectors, is a dynamic diagonal weight matrix, X is the running state vector, W is the preset weight matrix, and Y is the verification conclusion vector.

5. The method according to claim 4, characterized in that, The step of adjusting the operating parameters of the acquisition probe based on the performance analysis report and according to preset adjustment rules includes: Based on the key performance factor tags in the performance analysis report, target parameter items and adjustment strategies are generated using the preset adjustment rules. According to the dynamic diagonal weight matrix The target parameters and adjustment strategies are used to update the operating parameters of the acquisition probe.

6. The method according to claim 5, characterized in that, The dynamic diagonal weight matrix The target parameter items and adjustment strategies are used to update the operating parameters of the acquisition probe, including: Construct the following runtime parameter adjustment vector: in, Adjust the vector for runtime parameters. For the adjustment amount of the i-th running parameter, , This represents the baseline adjustment range of the i-th parameter, taken from the target parameter term. Let be the adjustment strategy function for the i-th parameter, defined within the adjustment strategy. This represents the feature value of the target parameter term; Adjust the vector according to the operating parameters. Perform dynamic iterative update operations with the following parameters: in, The current parameter vector in the k-th iteration. Let be the updated parameter vector after the (k+1)th iteration. The convergence factor is determined according to the policy function. The output is dynamically configured. This is a preset threshold for parameter changes.

7. The method according to claim 4, characterized in that, The dynamic diagonal weight matrix Generate in the following way: Get current system resource priority configuration parameters ,in This is a priority quantification value for CPU resources. Quantification value for the priority of memory resources. These are the priority quantization values ​​for packet loss rate monitoring. The range of values ​​for each priority quantization value is as follows: And satisfy ; Use the normalization function through the following formula. The priority configuration parameters Convert to weighting coefficients : in, , and These are the CPU weighting coefficient, memory weighting coefficient, and packet loss rate weighting coefficient, respectively. This is the normalization function; According to the weighting coefficients Construct the dynamic diagonal weight matrix .

8. A non-intrusive data acquisition system for operation and maintenance in a domestically developed information technology environment, characterized in that, The system includes: The probe building module is used to build acquisition probes based on Linux kernel functions and eBPF technology. A non-intrusive acquisition module is used to collect operation and maintenance data using the acquisition probe. The operation and maintenance data includes network traffic, system call chain, and hardware performance indicators. The validity verification module is used to verify the validity of the operation and maintenance data and generate a validity report; The monitoring module is used to acquire the operating status data of the acquisition probe, including CPU utilization, memory buffer usage, and data packet loss rate. The performance analysis module is used to generate a probe performance analysis report based on the running status data and the validity report; The parameter optimization module is used to adjust the operating parameters of the acquisition probe according to the performance analysis report and preset adjustment rules to form an optimized probe. The probe hot-replacement module is used to apply the optimized probe to perform subsequent collection of operation and maintenance data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images