The invention relates to the technical field of computer application, in particular to a distributed data state acquisition
system, which comprises the following hierarchical modules: an edge layer, a transmission layer, a storage layer, a calculation layer and a
control layer. A distributed data state acquisition
system is characterized in that an eBPF program is directly mounted in a kernel space, events such as
system calling, network flow and file operation are captured, the overhead of switching between a user mode and a kernel mode of a traditional Agent is bypassed, when the node load is low, an eBPF probe of a non-key index is automatically suspended, and only basic monitoring is reserved; the
edge node caches the
original data, only uploads an aggregation result after calculating a mean value and a quantile, and reduces 80% of transmission data volume; a filtering rule is loaded through a WASM module,
invalid data processing is reduced by 70%, direct collection is carried out on a kernel layer based on an eBPF, and CPU occupation is smaller than 0.5%.