CN109901992B - Method for remotely and dynamically monitoring program execution behavior - Google Patents
Method for remotely and dynamically monitoring program execution behavior Download PDFInfo
- Publication number
- CN109901992B CN109901992B CN201910048145.1A CN201910048145A CN109901992B CN 109901992 B CN109901992 B CN 109901992B CN 201910048145 A CN201910048145 A CN 201910048145A CN 109901992 B CN109901992 B CN 109901992B
- Authority
- CN
- China
- Prior art keywords
- rule
- program
- subscription
- data
- variable
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Abstract
The invention relates to the technical field of software development, in particular to a method for remotely and dynamically monitoring program execution behaviors; the device comprises a subscription rule distribution device, a rule and program behavior matching device, a program behavior data circulation device and a program behavior storage device; the subscription rule distribution device provides the rule and program behavior matching device to the monitored program developer in an SDK form according to the description of the position of a subscription object in the subscription rule, the developer receives the rule sent by the subscription rule distribution device after the program is piled and released, the matching device performs matching calculation on variable information monitored by the piling position and the rule, and pile data meeting the rule are sent to the data circulation device in a certain format.
Description
Technical Field
The invention relates to the technical field of log processing, in particular to a method for remotely and dynamically monitoring program execution behaviors.
Background
The internet background service usually serves the user for 7 × 24 hours continuously, and how to probe the abnormal or logic errors existing in the service program after the service is released is a debugging problem of the service program.
In general, a programmer records abnormal behaviors of a service program in a mode of printing an abnormal log or an error log, and the abnormal behaviors are used for troubleshooting of problems.
Logging is the most common means of recording program execution behavior, but logging only records an extremely small amount of program behavior. The efficiency of the operation of the service is reduced due to the log printing. Meanwhile, the storage capacity of the hard disk has a limit to the number of prints of the log. As a result, the programmer can only log known bugs, exceptions, and normal, or largely unpredictable, errant program behavior. The online fault is often not in a known error and abnormal range, so that the online fault does not have any log record, and the problem cannot be checked.
The prior art discloses a log processing method and a log processing device (with the publication number of CN 108234233A). The processing flow of the multi-node log in the patent is that the log is subjected to unified logic processing such as analysis, statistics, combination and the like in each edge node, then the processing result is transmitted to the central node, and the central node divides the log based on the user to which the log belongs. However, in this method, since the demands of the users are diversified and the processing logic of the edge node is fixed, different demands of different users cannot be met, and the users cannot acquire logs meeting specific conditions inconsistent with the inherent logic of the edge node.
The main drawbacks of this patent are:
1) the content being screened. The patent screens log data which are printed in a hard disk by a program, and uploads a small amount of data in the log data.
2) And (4) filtering the time. The patent refers to screening after program logs are printed, and belongs to delayed screening.
3) The storage location of the data is filtered. The filtered logs of this patent are stored in a hard disk, resulting in a slow reading speed.
4) And (4) preprocessing data. This patent requires pre-processing of the log data and field information is obtained for filtering.
In view of the above-mentioned existing technical problems, it is desirable to provide a new method and a new processing system for remotely and dynamically monitoring program execution behaviors, which provide a new log processing method, and compared with the traditional log printing, the method and the system are similar to the "full-volume program behavior printing", whereas the traditional log printing is the "micro-volume program behavior printing". In this application, the content to be filtered is the variable data that the service program outputs in its entirety to the SDK. Therefore, it can be said that the data analyzable by the present application is N times more than the data analyzable by the log in the prior art. Meanwhile, in the program execution, the instant screening is carried out; and the data of the patent is stored in the memory; finally, the present application filters the variables directly, without the need for pre-processing.
Disclosure of Invention
Aiming at the defects of the prior art, the invention discloses a method for remotely and dynamically monitoring the execution behavior of a program, which can dynamically and remotely monitor the execution behavior of a service program at any time so as to quickly check the problems in the program.
The invention is realized by the following technical scheme:
a method for remotely and dynamically monitoring program execution behaviors is characterized by comprising a subscription rule distribution device, a rule and program behavior matching device, a program behavior data flow device and a program behavior storage device; the subscription rule distributing device is used for describing the position of a subscription object in the subscription rule, the rule and program behavior matching device is provided for a monitored program developer in an SDK mode, the developer receives the rule sent by the subscription rule distributing device after the program is piled and released, the matching device performs matching calculation on variable information monitored by the piling position and the rule, and pile data meeting the rule are sent to the data circulating device in a certain format.
It should be noted that, a developer calls the SDK at a position where a program needs to be monitored, and transmits a variable name and a variable value of a monitored variable needed by the monitoring position to the SDK, and this process is called "piling".
Preferably, the data circulation device ensures the reliability of the data in the circulation process and stores the data into the program behavior data storage device; the piling is a process that a developer calls the SDK at a position where a program needs to be monitored, and transmits a variable name and a variable value of a monitored variable to the SDK.
Preferably, the implementation method of the subscription rule distribution device is as follows:
s201, a user edits subscription rules through an editing tool;
s202, subscription rule distribution, wherein a cluster dictionary table is inquired according to a cluster name and a stub as addressing marks, and the subscription rule distribution is carried out according to IP: the Port list distributes subscription rules to corresponding programs;
and S203, analyzing the subscription rule, and after receiving the subscription rule, the SDK analyzes the rule.
Preferably, the subscription rule should include:
1) a cluster name describing a program execution behavior of which cluster is to be subscribed;
2) a stub describing execution behavior of which stub of the program is to be subscribed;
3) starting subscription time, if the subscription time is distributed to the SDK end earlier than the starting time, the SDK end keeps subscription rules and starts filtering until the time for starting subscription is reached;
4) ending the subscription time, and if the subscription time is later than the ending time, distributing the subscription time to the SDK end, and discarding the SDK end as an invalid rule;
5) constraint conditions, the body description of rules, describes subscription rules by describing value constraints on certain variables of a certain stub;
6) a switch for filtering the rule, true represents open, false represents closed, if the rule is closed, the SDK discards the rule as an invalid rule;
7) the rule filters the maximum number of behaviors per minute, and the excess is considered invalid data.
Preferably, the constraint on a specific variable is implemented in the following ways:
61) an intra command, in the format "intra (var, num1, num 2)", where var represents the variable name, num1, num2 represent two values, the meaning of the command is that the constraint is satisfied when the value of var is between num1 and num 2;
62) an inlist command, the command format being "inlist (var, str1, str2, str3,. strN)", wherein var represents a variable name, str1, str2, str3, strN represent specific character strings, the number of the character strings is at least one, and the command means that the constraint condition is satisfied if the var value is one of the character strings;
63) a substrinlist command, the command format being "substrinlist (var, str1, str2, str 3.. strN)", wherein var represents a variable name, str1, str2, str3, strN represent a specific character string, the number of character strings is at least one, and the constraint condition is satisfied when a substring whose meaning is a var value is one of the character strings;
64) a notinlist command in the format of "notinlist (var, str1, str2, str3,. strN)", wherein var represents the name of a variable, str1, str2, str3, strN represent specific character strings, the number of which is at least one, and the command means that the value of var satisfies a constraint condition if it is not among the character strings;
65) the cmp command has a command format of "cmp (var1, opt, var 2)", wherein var1 and var2 represent two variable names, opt is a specific operator, and the like, and when a logical expression in the cmp takes a true value, a constraint condition is satisfied.
Preferably, the analyzing includes:
1) judging the validity of the rule, such as the starting time, the ending time, the rule switch and the like, and discarding the rule within the time range which is no longer valid or is closed;
2) judging the correctness of the rule, including whether the cluster name accords with the program, whether the described stub exists in the program, the correctness of the lexical method of the constraint condition, the semantic correctness of the variable described by the constraint condition and the like, and discarding the error rule;
3) instantiating a corresponding rule object for performing the matching calculation.
Preferably, the implementation method of the rule and program behavior matching device is as follows:
s301, receiving parameters through an SDK interface function, and monitoring program execution behaviors;
s302, performing structured storage on the input parameters, and inserting a storage unit into the tail of a program behavior data queue;
s303, the asynchronous thread takes out the storage units one by one from the head of the program behavior data queue, searches all subscription rule objects meeting the conditions according to the pile names of the storage units, and reports a piece of program behavior data on the rule name when each subscription rule is met;
and S404, submitting all program behavior data to be reported to a program behavior circulation device, and finishing uploading by the program behavior circulation device.
Preferably, the parameters should include:
1) monitoring position description information, and embodying the position description information in a pile name mode;
2) the number of variables;
3) the variable name of each variable;
4) a variable type for each variable;
5) each variable is a variable value of a program execution behavior at a time.
Preferably, the memory unit is a structured memory structure of program behavior, and the contents of the memory unit include:
1) a subscription rule ID for describing which subscription rule the program behavior is subscribed to;
2) the behavior generation time is microsecond and is recorded at the first time when the stub is called;
3) IP, Port: the IP and port number of the monitored program are used for describing the program behavior data generated by which program of the machine;
4) the SDK version number: the SDK version number used by the program is used for reporting and managing the multi-version SDK.
Preferably, the implementation method of the program behavior data flow device is as follows:
s401, an entry function rule of a program behavior data circulation device at an SDK end and a program behavior matching device submit 1 program behavior data through the function, the entry function directly forwards the data to a cloud circulation channel, if circulation is successful, S403 is switched, and if not, S402 is switched;
s402, storing the data failed to be sent into a local file system in a log mode, setting a timer, repeatedly trying to upload the data which are not uploaded in the file system again until the uploading is successful, and turning to S403;
s403, the data circulation channel receives program behavior data sent by a plurality of monitored programs, the data are received in a high throughput manner in a distributed cluster mode, and the data circulation channel carries out unified format processing on the data due to possible difference of data formats reported by different versions of the SDK;
and S404, storing the processed data into a designated database according to the configuration.
The invention has the beneficial effects that:
the invention can dynamically and remotely monitor the execution behavior of the service program at any time, and further quickly troubleshoot the problems in the program, so that sufficient and real-time debugging information is brought by problem analysis and troubleshooting, and the auxiliary problems can be quickly solved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a block diagram of the overall architecture of the present invention;
FIG. 2 is a diagram of a specific implementation method of the subscription rule distribution device of the present invention;
FIG. 3 is a diagram of a specific implementation of the rule and program behavior matching apparatus of the present invention;
fig. 4 is a diagram of a specific implementation method of the program behavior data flow device of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Example 1
The embodiment discloses a method for remotely and dynamically monitoring program execution behaviors, which comprises a subscription rule distribution device, a rule and program behavior matching device, a program behavior data flow device and a program behavior storage device, and is shown in fig. 1.
The subscription rule distribution device integrates rule storage, rule addition, deletion, modification, check and rule distribution. And the user configures the subscription rule, and issues the subscription rule to the specified monitored program terminal for the user according to the description of the subscription object position in the subscription rule.
The rule and program behavior matching device is provided for the monitored program developer in the form of SDK. The developer calls the SDK at the position where the program needs to be monitored, and transmits the variable name and the variable value of the monitoring variable needed by the monitoring position to the SDK, and the process is called 'piling'. After the program after piling is released, the program can receive and order the rule sent by the rule distribution device, the matching device carries out matching calculation on the variable information monitored by the piling position and the rule, and pile data meeting the rule are sent to the data circulation device in a certain format.
The data circulation device ensures the reliability of data in the circulation process and ensures that the data is not transmitted by mistake or leaked. And finally storing the data into a program behavior data storage device.
The program behavior data storage device is used for storing program behavior data for a user to inquire.
Example 2
The present embodiment provides a specific implementation method of a subscription rule distribution apparatus, as shown in fig. 2.
S201, the user edits the subscription rule through an editing tool, where the editing may be: adding, modifying and deleting. The subscription rules should include:
1) cluster name, the program execution behavior that describes which cluster to subscribe to.
2) And a stub describing execution behavior of which stub of the program is to be subscribed.
3) And starting subscription time, if the subscription time is distributed to the SDK end earlier than the starting time, the SDK end keeps the subscription rule until the filtering is started when the subscription starting time is reached.
4) And ending the subscription time, and if the subscription time is distributed to the SDK end later than the subscription ending time, the SDK end discards the rule as an invalid rule.
5) Constraint conditions, body descriptions of rules, describe subscription rules by describing value constraints on certain variables of a certain stub. The constraint on a specific variable can be in the following constraint modes:
the instruction format is "instruction (var, num1, num 2)" and is explained as follows: var represents the variable name, num1, num2 represent two values, and the meaning of the command is that the constraint is satisfied when the var value is between num1 and num 2.
An inlist (in the manifest range) command, in the format "inlist (var, str1, str2, str 3.. strN)", with the command interpretation as follows: var represents the name of a variable, str1, str2, str3 and strN represent specific character strings, the number of the character strings is at least one, and the meaning of the command is that the value of var satisfies the constraint condition if the value of var is one of the character strings.
Substrinlist (substring within list) command, in the format "substrinlist (var, str1, str2, str 3.. strN)", the command interpretation is as follows: var represents the name of a variable, str1, str2, str3 and strN represent specific character strings, the number of the character strings is at least one, and the command has the meaning that the constraint condition is satisfied when the sub-character string of the var value is one of the character strings.
Notinlist (not within the scope of the manifest) command in the format "notinlist (var, str1, str2, str 3.. strN)", with the command interpretation as follows: var represents the name of a variable, str1, str2, str3, strN represent specific character strings, the number of the character strings is at least one, and the meaning of the command is that the value of var satisfies the constraint condition if the value of var is not in the character strings.
The cmp (compare) command, the command format is "cmp (var1, opt, var 2)", var1, var2 represents two variable names, opt is a specific operator (e.g., ═ q, | ═ q, >, <, >, and < ═ etc.), and the constraint condition is satisfied when the logical expression in cmp takes true value.
6) And the switch of the filtering rule, true represents open, and false represents closed. If the rule is closed, the SDK discards the rule as an invalid rule.
7) The rule filters the maximum number of behaviors per minute, and the excess is considered invalid data.
And S202, subscribing rule distribution, wherein the cluster name and the stub are used as addressing marks. Querying a cluster dictionary table (describing the IP (network protocol address) contained in each cluster within the cluster dictionary table): Port (Port) program) based on cluster name, based on IP: the Port manifest distributes subscription rules to the corresponding programs. The distribution may be realized by active distribution or by polling each program SDK.
And S203, analyzing the subscription rule, and after receiving the subscription rule, the SDK analyzes the rule. The analysis comprises the following steps: 1) and judging the validity of the rule, such as the starting time, the ending time, the rule switch and the like, and discarding the rule within the time range which is not valid any more or is closed. 2) And judging the correctness of the rule, including whether the cluster name accords with the program, whether the described stub exists in the program, the correctness of the lexical method of the constraint condition, the semantic correctness of the variable described by the constraint condition and the like, and discarding the error rule. 3) Instantiating a corresponding rule object for performing the matching calculation.
Example 3
The embodiment provides a specific implementation method of a rule and program behavior matching device, as shown in fig. 3.
S301, receiving parameters through an SDK interface function, and monitoring program execution behaviors. The parameters should include: 1) monitoring position description information, and embodying the position description information in a pile name mode; 2) the number of variables; 3) the variable name of each variable; 4) a variable type for each variable; 5) each variable is a variable value of a program execution behavior at a time.
S302, performing structured storage on the input parameters, and inserting a storage unit into the tail of a program behavior data queue. The memory cell is a structured memory structure of program behavior, and the content of the memory cell should include:
1) a subscription rule ID for describing which subscription rule the program behavior is subscribed to;
2) the behavior generation time is microsecond and is recorded at the first time when the stub is called;
3) IP, Port: the IP and port number of the monitored program are used for describing the program behavior data generated by which program of the machine;
4) the SDK version number: the SDK version number used by the program is used for reporting and managing the multi-version SDK;
and S303, the asynchronous thread takes out the storage units one by one from the head of the program behavior data queue, all subscription rule objects meeting the conditions are searched according to the pile names of the storage units, and one program behavior data is reported on the basis of the rule name when one subscription rule is met.
And S404, submitting all program behavior data to be reported to a program behavior circulation device, and finishing uploading by the program behavior circulation device.
Example 4
The embodiment provides a specific implementation method of a program behavior data flow device, as shown in fig. 4.
S401, the SDK end has an entry function rule of the program behavior data circulation device and the program behavior matching device submits 1 program behavior data through the function. And the entry function directly forwards the data to the cloud circulation channel, if the circulation is successful, the operation goes to S403, and if the circulation is not successful, the operation goes to S402.
S402, storing the data failed to be sent into a local file system in a log mode, setting a timer, and repeatedly trying to upload the data which are not uploaded in the file system again until the uploading is successful, and turning to S403.
S403, the circulation channel receives program behavior data sent by a plurality of monitored programs and receives data with high throughput in a distributed cluster mode. Because the data formats reported by different versions of the SDK may have differences, the data circulation channel performs unified format processing on the data.
And S404, storing the processed data into a designated database according to the configuration.
Example 5
The invention also discloses a system for remotely and dynamically monitoring the execution behavior of the program on the basis of the embodiments 1-4, which comprises a subscription rule distribution device, a rule and program behavior matching device, a program behavior data flow device and a program behavior storage device; the subscription rule distribution device describes the position of a subscription object according to a subscription rule, the rule and program behavior matching device is provided for a developer of a monitored program in an SDK form, the developer receives the rule sent by the subscription rule distribution device after the program is piled and released, the matching device performs matching calculation on variable information monitored by the piling position and the rule, and pile data meeting the rule are sent to the data flow device in a certain format, and the embodiment 5 is matched with the embodiments 1 to 4.
In summary, the program behavior data storage device of the present scheme is implemented by using a database commonly used in the industry, and has no particularly worthy of a waiting method. A feasible method for remotely and dynamically capturing the program variable values in the program execution process is provided, so that sufficient and real-time debugging information is brought to problem analysis and troubleshooting, and auxiliary problems can be quickly solved.
By integrating the above embodiments, the scheme has the following characteristics:
the program developer calls (piles), and provides the pile name and any variable name and variable value of the called position of the program to be monitored. It can describe the monitored program when a certain pile meets the condition, and the pile execution information is captured. And (4) searching a dictionary table through the cluster name, the IP and the Port, determining which service programs the subscription rule belongs to, and distributing the variable subscription rule for capturing the variable values meeting the rule. And uploading the pile data meeting the rules to a cloud database through comparison calculation of the subscription rules, and marking the uploaded data by the subscription rule ID. The comparison calculation of the rules is completed by the service program process, and after the SDK interface is called, the SDK performs asynchronous calculation.
Therefore, the invention can dynamically and remotely monitor the execution behavior of the service program at any time, and further quickly troubleshoot the problems in the program, so that very sufficient and real-time debugging information is brought by problem analysis and troubleshooting, and the auxiliary problems can be quickly solved.
The above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (9)
1. A method for remotely and dynamically monitoring program execution behaviors is characterized by comprising a subscription rule distribution device, a rule and program behavior matching device, a program behavior data flow device and a program behavior storage device; the subscription rule distributing device describes the position of a subscription object according to a subscription rule, the rule and program behavior matching device is provided for a developer of a monitored program in an SDK form, the developer receives the rule sent by the subscription rule distributing device after piling and releasing the program, the matching device performs matching calculation on variable information monitored by a piling position and the rule, and pile data meeting the rule are sent to the data streaming device in a certain format;
the implementation method of the subscription rule distribution device comprises the following steps:
s201, a user edits subscription rules through an editing tool;
s202, subscription rule distribution, wherein a cluster dictionary table is inquired according to a cluster name and a stub as addressing marks, and the subscription rule distribution is carried out according to IP: the Port list distributes subscription rules to corresponding programs;
and S203, analyzing the subscription rule, and after receiving the subscription rule, the SDK analyzes the rule.
2. The method for remote dynamic monitoring of program execution behavior according to claim 1, wherein the data flow device ensures the reliability of data during the flow process and stores the data in the program behavior data storage device; and the piling is a process that the developer calls the SDK at the position where the program needs to be monitored and transmits the variable name and the variable value of the monitored variable to the SDK.
3. The method of claim 1, wherein the subscription rule comprises:
1) a cluster name describing a program execution behavior of which cluster is to be subscribed;
2) a stub describing execution behavior of which stub of the program is to be subscribed;
3) starting subscription time, if the subscription time is distributed to the SDK end earlier than the starting time, the SDK end keeps subscription rules and starts filtering until the time for starting subscription is reached;
4) ending the subscription time, and if the subscription time is later than the ending time, distributing the subscription time to the SDK end, and discarding the SDK end as an invalid rule;
5) constraint conditions, the body description of rules, describes subscription rules by describing value constraints on certain variables of a certain stub;
6) a switch for filtering the rule, true represents open, false represents closed, if the rule is closed, the SDK discards the rule as an invalid rule;
7) the rule filters the maximum number of behaviors per minute, and the excess is considered invalid data.
4. The method of claim 3, wherein the constraint on a specific variable is as follows:
61) an intra command, in the format "intra (var, num1, num 2)", where var represents the variable name, num1, num2 represent two values, the meaning of the command is that the constraint is satisfied when the value of var is between num1 and num 2;
62) an inlist command, the command format being "inlist (var, str1, str2, str3,. strN)", wherein var represents a variable name, str1, str2, str3, strN represent specific character strings, the number of the character strings is at least one, and the command means that the constraint condition is satisfied if the var value is one of the character strings;
63) a substrinlist command, the command format being "substrinlist (var, str1, str2, str 3.. strN)", wherein var represents a variable name, str1, str2, str3, strN represent a specific character string, the number of character strings is at least one, and the constraint condition is satisfied when a substring whose meaning is a var value is one of the character strings;
64) a notinlist command in the format of "notinlist (var, str1, str2, str3,. strN)", wherein var represents the name of a variable, str1, str2, str3, strN represent specific character strings, the number of which is at least one, and the command means that the value of var satisfies a constraint condition if it is not among the character strings;
65) the cmp command has a command format of "cmp (var1, opt, var 2)", var1 and var2 represent two variable names, opt is a specific operator, and when a logic expression in the cmp takes a true value, a constraint condition is satisfied.
5. The method of claim 3, wherein the parsing comprises:
1) judging the validity of the rule, and discarding the rule within the time range which is no longer valid or is closed;
2) judging the correctness of the rule, including whether the cluster name accords with the program, whether the described stub exists in the program, the correctness of the lexical method of the constraint condition and the semantic correctness of the variable described by the constraint condition, and discarding the error rule;
3) instantiating a corresponding rule object for performing the matching calculation.
6. The method for remote dynamic monitoring of program execution behavior according to claim 1, wherein the rule and program behavior matching device is implemented by:
s301, receiving parameters through an SDK interface function, and monitoring program execution behaviors;
s302, performing structured storage on the input parameters, and inserting a storage unit into the tail of a program behavior data queue;
s303, the asynchronous thread takes out the storage units one by one from the head of the program behavior data queue, searches all subscription rule objects meeting the conditions according to the pile names of the storage units, and reports a piece of program behavior data on the rule name when each subscription rule is met;
and S404, submitting all program behavior data to be reported to a program behavior circulation device, and finishing uploading by the program behavior circulation device.
7. The method of claim 6, wherein the parameters comprise:
1) monitoring position description information, and embodying the position description information in a pile name mode;
2) the number of variables;
3) the variable name of each variable;
4) a variable type for each variable;
5) each variable is a variable value of a program execution behavior at a time.
8. The method of claim 6, wherein the memory location is a structured memory structure of program behavior, and the contents of the memory location comprise:
1) a subscription rule ID for describing which subscription rule the program behavior is subscribed to;
2) the behavior generation time is microsecond and is recorded at the first time when the stub is called;
3) IP, Port: the IP and port number of the monitored program are used for describing the program behavior data generated by which program of the machine;
4) the SDK version number: the SDK version number used by the program is used for reporting and managing the multi-version SDK.
9. The method for remote dynamic monitoring of program execution behavior according to claim 1, wherein the program behavior data flow device is implemented by:
s401, an entry function rule of a program behavior data circulation device at an SDK end and a program behavior matching device submit 1 program behavior data through the function, the entry function directly forwards the data to a cloud circulation channel, if circulation is successful, S403 is switched, and if not, S402 is switched;
s402, storing the data failed to be sent into a local file system in a log mode, setting a timer, repeatedly trying to upload the data which are not uploaded in the file system again until the uploading is successful, and turning to S403;
s403, the data circulation channel receives program behavior data sent by a plurality of monitored programs, the data are received in a high throughput manner in a distributed cluster mode, and the data circulation channel carries out unified format processing on the data due to possible difference of data formats reported by different versions of the SDK;
and S404, storing the processed data into a designated database according to the configuration.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910048145.1A CN109901992B (en) | 2019-01-18 | 2019-01-18 | Method for remotely and dynamically monitoring program execution behavior |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910048145.1A CN109901992B (en) | 2019-01-18 | 2019-01-18 | Method for remotely and dynamically monitoring program execution behavior |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109901992A CN109901992A (en) | 2019-06-18 |
| CN109901992B true CN109901992B (en) | 2022-03-04 |
Family
ID=66943786
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910048145.1A Active CN109901992B (en) | 2019-01-18 | 2019-01-18 | Method for remotely and dynamically monitoring program execution behavior |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109901992B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113885814A (en) * | 2021-08-31 | 2022-01-04 | 珠海读书郎软件科技有限公司 | Method for remotely grabbing and printing |
| CN116225925B (en) * | 2023-02-21 | 2023-11-21 | 东南大学 | Online real-time visual debugging method for computer software |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103929329A (en) * | 2014-04-14 | 2014-07-16 | 百度在线网络技术（北京）有限公司 | Log processing and configuration method, configuration server, service end device and system |
| CN104702638A (en) * | 2013-12-06 | 2015-06-10 | 华为技术有限公司 | Event subscribing and dispatching method and device |
| CN107844378A (en) * | 2016-09-21 | 2018-03-27 | 北京航天长峰科技工业集团有限公司 | A kind of Distributed Heterogeneous Data resources integration and management system |
| CN108600300A (en) * | 2018-03-06 | 2018-09-28 | 北京思空科技有限公司 | Daily record data processing method and processing device |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8855625B2 (en) * | 2012-12-10 | 2014-10-07 | At&T Mobility Ii Llc | Dynamic steering of traffic across radio access networks |
-
2019
- 2019-01-18 CN CN201910048145.1A patent/CN109901992B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104702638A (en) * | 2013-12-06 | 2015-06-10 | 华为技术有限公司 | Event subscribing and dispatching method and device |
| CN103929329A (en) * | 2014-04-14 | 2014-07-16 | 百度在线网络技术（北京）有限公司 | Log processing and configuration method, configuration server, service end device and system |
| CN107844378A (en) * | 2016-09-21 | 2018-03-27 | 北京航天长峰科技工业集团有限公司 | A kind of Distributed Heterogeneous Data resources integration and management system |
| CN108600300A (en) * | 2018-03-06 | 2018-09-28 | 北京思空科技有限公司 | Daily record data processing method and processing device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109901992A (en) | 2019-06-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107341258B (en) | Log data acquisition method and system | |
| CN109901992B (en) | Method for remotely and dynamically monitoring program execution behavior | |
| CN104007994B (en) | Updating method, upgrading method and upgrading system based on strategy storeroom interaction | |
| CN106649071B (en) | Method and device for reporting log in process | |
| CN111190755B (en) | Application program function exception handling method and device | |
| CN110895488B (en) | Task scheduling method and device | |
| CN111858251B (en) | Data security audit method and system based on big data computing technology | |
| CN111209166A (en) | Automatic inspection system for B/S architecture business system | |
| US11681606B2 (en) | Automatic configuration of logging infrastructure for software deployments using source code | |
| CN110806966A (en) | Log management method and device, electronic equipment and computer storage medium | |
| CN115102877A (en) | Virtual network card network detection method, device, equipment and medium | |
| CN112565232B (en) | Log analysis method and system based on template and flow state | |
| CN112559525B (en) | Data checking system, method, device and server | |
| KR102088285B1 (en) | Method and device for collecting log based on rule | |
| CN113472881B (en) | Statistical method and device for online terminal equipment | |
| CN113392079B (en) | Distributed storage cluster log storage optimization method, system and terminal | |
| CN115344609A (en) | Scatter diagram rendering method and system based on non-sampling big data | |
| CN113407415A (en) | Log management method and device of intelligent terminal | |
| CN112685370A (en) | Log collection method, device, equipment and medium | |
| CN111061580B (en) | Computer system emergency plan exercise method, server and system | |
| CN116361261B (en) | Distributed log acquisition processing method and system | |
| CN111526196B (en) | Method and system for managing port ledger based on open source scanner | |
| CN114816942B (en) | Mobile terminal application stability monitoring method and device, electronic equipment and storage medium | |
| US20240111655A1 (en) | Software log processing method | |
| CN117591490A (en) | Audit log data processing method, audit log data processing device, audit log data processing equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |