CN115865734B - Fault detection method, data generation method, device, equipment and medium - Google Patents
Fault detection method, data generation method, device, equipment and medium Download PDFInfo
- Publication number
- CN115865734B CN115865734B CN202211543086.3A CN202211543086A CN115865734B CN 115865734 B CN115865734 B CN 115865734B CN 202211543086 A CN202211543086 A CN 202211543086A CN 115865734 B CN115865734 B CN 115865734B
- Authority
- CN
- China
- Prior art keywords
- data
- trace data
- event
- determining
- trace
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 130
- 238000001514 detection method Methods 0.000 title claims abstract description 51
- 230000006870 function Effects 0.000 claims description 118
- 230000008569 process Effects 0.000 claims description 47
- 230000015654 memory Effects 0.000 claims description 18
- 238000004590 computer program Methods 0.000 claims description 16
- 230000005540 biological transmission Effects 0.000 claims description 11
- 238000012545 processing Methods 0.000 claims description 11
- 239000003795 chemical substances by application Substances 0.000 description 97
- 238000004458 analytical method Methods 0.000 description 17
- 238000010586 diagram Methods 0.000 description 9
- 238000004891 communication Methods 0.000 description 8
- 238000012544 monitoring process Methods 0.000 description 4
- 230000009286 beneficial effect Effects 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 238000013024 troubleshooting Methods 0.000 description 3
- 238000012098 association analyses Methods 0.000 description 2
- 230000000903 blocking effect Effects 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000011835 investigation Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 239000011521 glass Substances 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 239000000178 monomer Substances 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 230000001953 sensory effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a fault detection method, a data generation method, a device, equipment and a medium. The fault detection method is performed by a back-end component, the method comprising: receiving trace data sent by a client agent and trace data sent by a server agent; according to the trace data sent by the client agent and the trace data sent by the server agent, the fault detection result is determined, and by the technical scheme, the fault cause can be more accurately positioned, the fault checking time is saved, and the system resource consumption is reduced.
Description
Technical Field
The embodiment of the invention relates to the technical field of networks, in particular to a fault detection method, a data generation method, a device, equipment and a medium.
Background
With the landing of cloud technology, more and more application architectures are deployed in a containerization and microservice mode, the number of application monomers is more and more, and the network transmission is more dependent. In the prior art, when a container network problem is encountered, most of effective obstacle removing means are to manually analyze packets by grabbing on a host, judge whether the problems of handshake failure, handshake failure stage, packet loss and the like exist or judge the problem of TCP network connection failure by checking real-time socket information by using tools such as tcpdump, ss, netstat and the like.
However, TCP network connection failure detection is performed through tcpdump, ss, netstat and other tools, and a packet grabbing tool needs to be started for a long time, so that system resources are consumed. In addition, manual analysis and network fault scene reproduction are difficult, so that the fault analysis time is increased.
Disclosure of Invention
The embodiment of the invention provides a fault detection method, a data generation method, a device, equipment and a medium, which can solve the problem of system resource consumption caused by long-time starting of a packet grabbing tool for fault analysis and the problem of increased fault analysis time caused by manual analysis and difficult network fault scene reproduction.
According to an aspect of the present invention, there is provided a fault detection method performed by a back-end component, the fault detection method including:
receiving trace data sent by a client agent and trace data sent by a server agent;
And determining a fault detection result according to the trace data sent by the client agent and the trace data sent by the server agent.
According to another aspect of the present invention, there is provided a data generation method performed by a client agent, the data generation method including:
Acquiring a return result of calling the connection function;
determining connection state information according to a return result of calling the connection function;
and if the connection state information is connection failure, generating first trace data according to a return result of the call connection function.
According to another aspect of the present invention, there is provided a data generation method performed by a server agent, the data generation method including:
acquiring a second execution time, second socket data and a second structure body of a kernel package receiving function;
determining four-tuple information of a second package receiving party and a target client according to the state information of the second socket data;
acquiring a TCP (transmission control protocol) zone bit in the second structural body;
Generating second data corresponding to the first event according to the second receiving party, the second execution time of the kernel receiving function and the TCP zone bit;
generating fourth trace data according to the second data corresponding to the first event and the four-tuple information of the target client;
and sending the fourth trace data to a back-end component.
According to another aspect of the present invention, there is provided a fault detection device including:
The first receiving module is used for receiving trace data sent by the client agent and trace data sent by the server agent;
And the first determining module is used for determining a fault detection result according to trace data sent by the client agent and trace data sent by the server agent.
According to another aspect of the present invention, there is provided a data generating apparatus including:
the first acquisition module is used for acquiring a return result of calling the connection function;
The second determining module is used for determining connection state information according to a return result of calling the connection function;
And the first generation module is used for generating first trace data according to the return result of the call connection function if the connection state information is connection failure.
According to another aspect of the present invention, there is provided a data generating apparatus including:
the second acquisition module is used for acquiring second execution time of the kernel package receiving function, second socket data and a second structure body;
The third determining module is used for determining four-tuple information of the second package receiving party and the target client according to the state information of the second socket data;
A third obtaining module, configured to obtain a TCP flag bit in the second structure;
The second generation module is used for generating second data corresponding to the first event according to the second execution time of the second packet receiving party and the kernel packet receiving function and the TCP zone bit;
The third generation module is used for generating fourth trace data according to the second data corresponding to the first event and the four-tuple information of the target client;
and the first sending module is used for sending the fourth trace data to the back-end component.
According to another aspect of the present invention, there is provided an electronic apparatus including:
At least one processor; and
A memory communicatively coupled to the at least one processor; wherein,
The memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the fault detection method or the data generation method according to any one of the embodiments of the present invention.
According to another aspect of the present invention, there is provided a computer readable storage medium storing computer instructions for causing a processor to implement the fault detection method or the data generation method according to any of the embodiments of the present invention when executed.
The embodiment of the invention receives trace data sent by the client agent and trace data sent by the server agent; according to the trace data sent by the client agent and the trace data sent by the server agent, the fault detection result is determined, the problem that system resources are consumed due to the fact that a packet grabbing tool is started for a long time to conduct fault analysis and the problem that the fault analysis time is increased due to the fact that manual analysis and network fault scene reproduction are difficult are solved, fault reasons can be located more accurately, fault troubleshooting time is saved, and system resource consumption is reduced.
It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the invention or to delineate the scope of the invention. Other features of the present invention will become apparent from the description that follows.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments will be briefly described below, it being understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart of a fault detection method in accordance with a first embodiment of the present invention;
FIG. 2 is a flow chart of a data generation method in a second embodiment of the present invention;
FIG. 3 is a flow chart of a data generation method in a third embodiment of the present invention;
Fig. 4 is a schematic structural diagram of a fault detection device according to a fourth embodiment of the present invention;
fig. 5 is a schematic structural diagram of a data generating device in a fifth embodiment of the present invention;
fig. 6 is a schematic structural diagram of a data generating device in a sixth embodiment of the present invention;
fig. 7 is a schematic structural diagram of an electronic device in a seventh embodiment of the present invention.
Detailed Description
In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
It will be appreciated that prior to using the technical solutions disclosed in the embodiments of the present disclosure, the user should be informed and authorized of the type, usage range, usage scenario, etc. of the personal information related to the present disclosure in an appropriate manner according to the relevant legal regulations.
Example 1
Fig. 1 is a flowchart of a fault detection method in the first embodiment of the present invention, and the present embodiment is applicable to the situation of fault detection of a TCP four-layer network connection, and it should be noted that the connection establishment process of the entire three-way handshake of the TCP four-layer network includes the following steps:
The first handshake client sends a TCP message with SYN=1 and ACK=0 flag bit to the server, and at the moment, the server receives the captured data of the event through a kernel receiving function tcp_rcv_state_process (), and triggers a preset eBPF program to process a user space sent to a server agent process;
The second handshake server sends a TCP message with SYN=1 and ACK=1 flag bit to the client, and at the moment, the client receives the captured data of the event through a kernel receiving function tcp_rcv_state_process (), and triggers a preset eBPF program to process and send the captured data to a user space of a client agent process;
The third handshake client sends a TCP message with a syn=0 and an ack=1 flag bit to the server, and at this time, the server receives the captured data of the event through a kernel packet receiving function tcp_rcv_state_process (), and triggers a preset eBPF program to process a user space sent to a process of the server agent.
It should be noted that, in the three-way handshake process, the tcp_rcv_state_process event corresponding data of the client and the server are stored in the user space memories of the client agent and the server agent process, respectively.
The fault detection method may be performed by the fault detection device in the fourth embodiment of the present invention, where the device may be implemented in software and/or hardware, as shown in fig. 1, and the method is performed by a back-end component, and specifically includes the following steps:
S110, receiving trace data sent by the client agent and trace data sent by the server agent. The back-end component is used for receiving data sent by agents on all hosts, and storing the data to the database after association analysis. The agent is deployed on all hosts needing to collect data, and after collecting data from the kernel by using a eBPF method, the agent is sent to a user state space of the agent, and then is sent to the back-end component after carrying out association analysis.
The trace data is data of a TCP connection failure obtained by calling a return result of a connect () function or a return result of a getsockopt () function by the agent.
Specifically, the manner of receiving trace data sent by the client agent and trace data sent by the server agent may be: and receiving trace data sent by the client agent and trace data sent by the server agent by the back-end component.
S120, determining a fault detection result according to trace data sent by the client agent and trace data sent by the server agent.
The fault detection result may be any one of a first handshake process failure, a second handshake process failure, and a third handshake process failure.
Specifically, the manner of determining the fault detection result according to the trace data sent by the client agent and the trace data sent by the server agent may be: judging the existence of a tcp_rcv_state_process event according to trace data sent by a client agent and trace data sent by a server agent, and if the trace data sent by the client agent and the trace data sent by the server agent do not exist the tcp_rcv_state_process event, determining that the fault detection result is failure of the first handshake process; if the trace data sent by the client end agent does not have a tcp_rcv_state_process event, determining that the fault detection result is that the second handshake process fails; if the trace data sent by the client agent and the trace data sent by the server agent both have tcp_rcv_state_process events, determining that the fault detection result is that the third handshake process fails.
Optionally, determining the fault detection result according to the trace data sent by the client agent and the trace data sent by the server agent includes:
If the trace data sent by the client agent does not have the first data corresponding to the first event and the trace data sent by the server agent does not have the second data corresponding to the first event, determining that the first handshake process fails;
If the trace data sent by the client agent does not have the first data corresponding to the first event, and the trace data sent by the server agent only has the second data corresponding to the first event with one TCP (transmission control protocol) flag bit as the first flag bit, determining that the second handshake process fails;
If only one piece of first data corresponding to the first event with the TCP flag bit being the second flag bit exists in trace data sent by the client agent, and only one piece of second data corresponding to the first event with the TCP flag bit being the third flag bit exists in trace data sent by the server agent, the third handshake process is determined to fail.
The first event is a tcp_rcv_state_process event, and the first data corresponding to the first event and the second data corresponding to the first event are mainly used for distinguishing the client and the server, wherein the first data corresponding to the first event is data corresponding to the tcp_rcv_state_process event in trace data sent by a client agent; the second data corresponding to the first event is data corresponding to a tcp_rcv_state_process event in trace data sent by the server agent.
Wherein, the first flag bit is syn=1, ack=0; the second flag bit is syn=1, ack=1; the third flag is syn=0, ack=1.
Specifically, if there is no first data corresponding to the first event in trace data sent by the client agent, and there is no second data corresponding to the first event in trace data sent by the server agent, the manner of determining that the first handshake process fails may be: if the trace data sent by the client agent does not have the first data corresponding to the tcp_rcv_state_process event, and the trace data sent by the server agent does not have the second data corresponding to the tcp_rcv_state_process event, determining that the first handshake process fails.
Specifically, if there is no first data corresponding to the first event in trace data sent by the client agent, and there is only one piece of second data corresponding to the first event with a TCP flag bit as the first flag bit in trace data sent by the server agent, the manner of determining that the second handshake process fails may be: if the trace data sent by the client agent does not have the first data corresponding to the tcp_rcv_state_process event, and meanwhile, the trace data sent by the server agent only has the second data corresponding to the tcp_rcv_state_process event with syn=1 and ack=0 flag bit, then the second handshake process is determined to fail.
Specifically, if only one piece of trace data corresponding to the first event with the TCP flag bit being the second flag bit exists in trace data sent by the client agent, and only one piece of second data corresponding to the first event with the TCP flag bit being the third flag bit exists in trace data sent by the server agent, the manner of determining that the third handshake process fails may be: if only one piece of first data corresponding to the tcp_rcv_state_process event with the sign bit of syn=1 and ack=1 exists in trace data sent by the client agent, and meanwhile, only one piece of second data corresponding to the tcp_rcv_state_process event with the sign bit of syn=0 and ack=1 exists in trace data sent by the server agent, a third handshake process failure is determined.
According to the technical scheme, trace data sent by a client agent and trace data sent by a server agent are received; according to the trace data sent by the client agent and the trace data sent by the server agent, the fault detection result is determined, the problem that system resources are consumed due to the fact that a packet grabbing tool is started for a long time to conduct fault analysis and the problem that the fault analysis time is increased due to the fact that manual analysis and network fault scene reproduction are difficult are solved, fault reasons can be located more accurately, fault troubleshooting time is saved, and system resource consumption is reduced.
Example two
Fig. 2 is a flowchart of a data generation method in the second embodiment of the present invention, where the present embodiment is applicable to the case of fault detection of a TCP four-layer network connection, the method may be performed by a data generation device in the fifth embodiment of the present invention, and the device may be implemented in a software and/or hardware manner, as shown in fig. 2, and the method is performed by a client agent, and specifically includes the following steps:
S210, obtaining a return result of calling the connection function.
Wherein the connection function is a connect () function.
Specifically, the method for obtaining the returned result of calling the connection function may be: the client agent obtains a return result of the system call connect () function based on the method of eBPF. It should be noted that, the connect () function is only a connect () function under the TCP protocol.
S220, determining connection state information according to a return result of calling the connection function.
The connection status information is connection establishment status information of the TCP, and may be connection failure or connection success.
Specifically, the manner of determining the connection state information according to the return result of calling the connection function may be: after the client agent obtains the return result of the system call connect () function based on the eBPF method, the preset eBPF program is triggered to send the return result to the user space of the agent process, and the connection establishment state information of the TCP is determined by analyzing the return result of the call connect () function. It should be noted that, the return result of calling the connect () function may be any result of connection success, connection failure, or processing.
And S230, if the connection state information is connection failure, generating first trace data according to a return result of calling the connection function.
The first trace data is trace data of TCP connection failure, which is obtained by the client agent according to a return result of calling a connect () function.
Specifically, if the connection status information is a connection failure, the method for generating the first trace data according to the return result of calling the connection function may be: if the returned result of calling the connect () function determines that the connection status information is connection failure, the client agent may directly generate first trace data according to the returned result of calling the connect () function and send the first trace data to the back-end component.
Optionally, the method further comprises:
if the connection state information is in the process of processing, acquiring a return result of calling a state acquisition function;
And if the connection failure is determined according to the return result of the state acquisition function, generating second trace data according to the return result of the state acquisition function.
Wherein processing may be represented as invoking connect () function return INPROCESSING. The state acquisition function is getsockopt () function. The second trace data is trace data of TCP connection failure, which is obtained by the client agent according to the returned result of calling getsockopt () function.
It should be noted that, in most application usage scenarios, the call of the connect () function is mostly in a non-blocking form, if the return result of the connect () function after the function call is INPROCESSING (in processing) cannot obtain a clear TCP connection result, the return result of the call getsockopt () function is needed to be analyzed (the getsockopt () function is only getsockopt () function under the TCP protocol), and the return result of the call getsockopt () function can compensate the return result of the call connect () function under the non-blocking condition.
It should be noted that, there is a value element in the returned result of calling getsockopt () function, the value element has a specific value, the connection state information can be determined according to the specific value of the value element, if the value is 0, the connection is determined to be successful, if the value is negative, the connection is determined to be failed, and the corresponding failure reason can be determined according to the specific value.
Specifically, if the connection status information is in process, the manner of acquiring the return result of the call status acquisition function may be: if the return result of calling the connect () function is INPROCESSING, the return result of calling the getsockopt () function is obtained.
Specifically, if the connection failure is determined according to the return result of the state acquisition function, the manner of generating the second trace data according to the return result of the state acquisition function may be: if the value in the return result of the call getsockopt () function is negative, then the connection failure is determined, and the second trace data is generated according to the return result of the call getsockopt () function.
Optionally, the method further comprises:
Acquiring a first execution time, first socket data and a first structure body of a kernel package receiving function;
Determining state information of the first socket data according to the first socket data;
Determining a first package receiving party according to the state information of the first socket data;
generating first data corresponding to a first event according to the first receiving party, the first execution time of the kernel receiving function, the first socket data and the first structure;
generating third trace data according to the first trace data or the second trace data and the first data corresponding to the first event;
and sending the third trace data to a back-end component.
The kernel packet receiving function may be a tcp_rcv_state_process () function, the structure is sk_buffer, the first execution time, the first socket data, and the first structure are used for distinguishing the client from the server, and the first execution time, the first socket data, and the first structure are the execution time, the socket data, and the sk_buffer of the kernel packet receiving function acquired by the client. Note that the socket data acquired in the kernel packet receiving function is socket data of TCP type.
The state information of the first socket data is sk_state, the first packet receiving party may be a client or a server, the first packet receiving party may determine whether the TCP request is a server or a client according to sk_state, if sk_state is list or syn_recv, the first packet receiving party is a server, and if sk_state is syn_send, the first packet receiving party is a client.
The third trace data is first trace data or second trace data, and the trace data is generated after the first data corresponding to the first event is associated with the second trace data.
Specifically, the method for obtaining the first execution time, the first socket data and the first structure body of the kernel packet receiving function may be: the client agent obtains a kernel TCP wrapping function based on a eBPF method, and further obtains first execution time, first socket data and first sk_buff of a tcp_rcv_state_process () function.
Specifically, the manner of determining the state information of the first socket data according to the first socket data may be: the state information sk_state of the first socket data can be acquired through the first socket data.
Specifically, the method for determining the first packet receiving party according to the state information of the first socket data may be: determining state information of the first socket data according to the socket data, and if the state information of the first socket data is LISTEN or SYN_RECV, the first package receiving party is a server; if the state information of the first socket data is syn_send, the first packet receiving party is a client.
Specifically, the method for generating the first data corresponding to the first event according to the first receiving party, the first execution time of the kernel receiving function, the first socket data and the first structure body may be: and generating first data corresponding to the first event according to the first receiving party, the first execution time of the kernel receiving function, the first socket data and the first sk_buff, and storing the first data in a user space memory of the client agent process.
Specifically, according to the first trace data or the second trace data, the manner of generating the third trace data from the first data corresponding to the first event may be: when the client agent fails to establish TCP connection, first trace data or second trace data are generated, TCP (transmission control protocol) flag bits (comprising SYN flag bits and ACK (acknowledgement) flag bits) are obtained through the first structural body, the first socket data are analyzed to obtain TCP network four-element data sequence, the first data corresponding to the first event stored in the user space memory of the client agent process are associated through the TCP network four-element information sequence, and third trace data are generated according to the first trace data or the second trace data and the first data corresponding to the first event.
According to the technical scheme, a return result of calling the connection function is obtained; determining connection state information according to a return result of calling the connection function; if the connection state information is connection failure, generating first trace data according to the return result of the call connection function, solving the problem of system resource consumption caused by long-time starting of a packet grabbing tool for fault analysis and the problem of increased fault analysis time caused by manual analysis and network fault scene reproduction difficulty, determining TCP connection state information by calling the return result of the connect () function and the return result of the call getsockopt () function, and generating trace data according to the kernel packet receiving function, the return result of the call connect () function and the return result of the call getsockopt () function, thereby being capable of locating fault reasons more accurately, saving fault investigation time and reducing system resource consumption.
Example III
Fig. 3 is a flowchart of a data generation method in the third embodiment of the present invention, where the present embodiment is applicable to the case of fault detection of a TCP four-layer network connection, the method may be performed by a data generation device in the sixth embodiment of the present invention, and the device may be implemented in a software and/or hardware manner, as shown in fig. 3, and the method is performed by a server agent, and specifically includes the following steps:
s310, acquiring a second execution time of the kernel package receiving function, second socket data and a second structural body.
The second structure body is a second sk_buff, a second execution time, second socket data and execution time of a kernel packet receiving function, socket data and sk_buff, which are acquired by the second structure body as a server.
Specifically, the manner of obtaining the second execution time, the second socket data, and the second structure of the kernel packet receiving function may be: the server agent obtains a kernel wrapping function based on a eBPF method, and further obtains second execution time, second socket data and second sk_buff of the kernel wrapping function.
S320, determining four-tuple information of the second package receiving party and the target client according to the state information of the second socket data.
The second package receiving party can be a client or a server. The target client is a client which fails to perform TCP three-way handshake establishment, and the four-tuple information of the target client is a source IP address, a target IP address, a source port number and a target port number based on a TCP protocol.
Specifically, the determining the four-tuple information of the second packet receiving party and the target client according to the state information of the second socket data may be: determining a second package receiving party according to the state information of the second socket data, wherein if the state information of the second socket data is LISTEN or SYN_RECV, the second package receiving party is a server; if the state information of the second socket data is SYN_SENT, the second packet receiving party is a client; and obtaining TCP four-tuple information sequence according to the state information of the second socket data, and selecting the client without the first handshake packet and the third handshake packet as a target client according to the TCP four-tuple information sequence, thereby determining the four-tuple information of the target client.
Optionally, determining the quadruple information of the target client according to the second socket data includes:
And if the target client side is determined to fail to generate the matched first handshake packet and the third handshake packet within the time threshold according to the second socket data, acquiring the four-tuple information of the target client side.
The time threshold can be set by oneself, the first handshake packet is the stored data after the first handshake of the TCP, and the third handshake packet is the stored data after the third handshake of the TCP.
Specifically, if it is determined, according to the second socket data, that the target client fails to generate the first handshake packet and the third handshake packet that are matched within the time threshold, a manner of acquiring the four-tuple information of the target client may be: if the first handshake packet and the third handshake packet of the TCP four-tuple information trigger matched in the time threshold do not exist, the TCP connection failure is indicated, the client with the TCP connection failure is determined to be the target client, and the four-tuple information of the target client is obtained according to the second socket data and the target client.
S330, acquiring the TCP zone bit in the second structural body.
The TCP flag bit comprises a SYN flag bit and an ACK flag bit.
Specifically, the manner of acquiring the TCP flag bit in the second structure body may be: the server agent acquires a TCP (transmission control protocol) flag bit (including a SYN flag bit and an ACK (acknowledgement) flag bit) and a TCP network four-tuple data tuple through the second sk_buff.
And S340, generating second data corresponding to the first event according to the second receiving party, the second execution time of the kernel receiving function and the TCP zone bit.
Specifically, the manner of generating the second data corresponding to the first event according to the second receiving party, the second execution time of the kernel receiving function and the TCP flag bit may be: and storing second data corresponding to the first event of the TCP zone bit in a user space memory of the server agent process according to the second execution time of the second packet receiving party and the kernel packet receiving function.
S350, fourth trace data is generated according to the second data corresponding to the first event and the four-tuple information of the target client.
The fourth trace data is trace data generated by associating the second data corresponding to the first event with the four-tuple information of the target client.
Specifically, the manner of generating the fourth trace data according to the second data corresponding to the first event and the quadruple information of the target client may be: and acquiring second data corresponding to the first event, acquiring four-tuple information of the target client, and generating fourth trace data by the second data corresponding to the first event in the memory of the server agent and the four-tuple information of the target client.
And S360, transmitting the fourth trace data to the back-end component.
Specifically, the manner of sending the fourth trace data to the back-end component may be: and the server agent sends the generated fourth trace data to the back-end component.
Optionally, the method further comprises:
And acquiring the full-connection queue information of the monitoring socket.
Specifically, the method for acquiring the full connection queue information of the monitoring socket may be: when the TCP three-way handshake is successful, socket of TCP connection request is in a full connection queue, an accept system of a user space of a server agent process calls a trigger kernel function inet_ csk _accept () function, TCP full connection queue information of the monitoring socket is obtained from the full connection queue, and a preset eBPF program is triggered to process and send to a user space memory of the agent process.
It should be noted that, in some network scenarios, when the service peak period is in, the TCP full-connection queue of the server is full, in this case, even if the client TCP is successfully established but the request is still unresponsive, the duration of this case is very short, and when the network tools such as tcpdump, ss, netstat and the like are manually adopted for investigation, the fault scenario does not exist, and at this time, the real-time monitoring of the TCP full-connection queue information is significant for both application fault removal and fault early warning.
According to the technical scheme, the second execution time of the kernel packet receiving function, the second socket data and the second structural body are obtained; determining four-tuple information of a second package receiving party and a target client according to the state information of the second socket data; acquiring a TCP (transmission control protocol) zone bit in the second structural body; generating second data corresponding to the first event according to the second receiving party, the second execution time of the kernel receiving function and the TCP zone bit; generating fourth trace data according to the second data corresponding to the first event and the four-tuple information of the target client; the fourth trace data is sent to the back-end component, so that the problems that system resources are consumed due to the fact that a packet grabbing tool is started for a long time to conduct fault analysis and the problem that the fault analysis time is increased due to the fact that manual analysis and network fault scene reproduction are difficult are solved, a server agent can generate trace data, fault reasons can be located more accurately, fault troubleshooting time is saved, and system resources consumption is reduced.
Example IV
Fig. 4 is a schematic structural diagram of a fault detection device according to a fourth embodiment of the present invention. The embodiment may be applicable to the case of fault detection of a TCP four-layer network connection, where the device may be implemented in a software and/or hardware manner, and the device may be integrated in any device that provides a function of fault detection, as shown in fig. 4, where the fault detection device specifically includes: a first receiving module 410 and a first determining module 420.
The first receiving module 410 is configured to receive trace data sent by the client agent and trace data sent by the server agent;
The first determining module 420 is configured to determine a fault detection result according to trace data sent by the client agent and trace data sent by the server agent.
Optionally, the first determining module is specifically configured to:
If the trace data sent by the client agent does not have the first data corresponding to the first event and the trace data sent by the server agent does not have the second data corresponding to the first event, determining that the first handshake process fails;
If the trace data sent by the client agent does not have the first data corresponding to the first event, and the trace data sent by the server agent only has the second data corresponding to the first event with one TCP (transmission control protocol) flag bit as the first flag bit, determining that the second handshake process fails;
If only one piece of first data corresponding to the first event with the TCP flag bit being the second flag bit exists in trace data sent by the client agent, and only one piece of second data corresponding to the first event with the TCP flag bit being the third flag bit exists in trace data sent by the server agent, the third handshake process is determined to fail.
The product can execute the method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.
Example five
Fig. 5 is a schematic structural diagram of a data generating device in a fifth embodiment of the present invention. The embodiment may be applicable to the case of fault detection of a TCP four-layer network connection, where the apparatus may be implemented in a software and/or hardware manner, and the apparatus may be integrated in any device that provides a function of data generation, as shown in fig. 5, where the data generation apparatus specifically includes: a first acquisition module 510, a second determination module 520, and a first generation module 530.
The first obtaining module 510 is configured to obtain a return result of calling the connection function;
A second determining module 520, configured to determine connection status information according to a return result of calling the connection function;
The first generating module 530 is configured to generate first trace data according to the return result of the call connection function if the connection status information is connection failure.
Optionally, the method further comprises:
the fourth acquisition module is used for acquiring a return result of calling the state acquisition function if the connection state information is in the process;
And the fourth generation module is used for generating second trace data according to the return result of the state acquisition function if the connection failure is determined according to the return result of the state acquisition function.
Optionally, the method further comprises:
the fifth acquisition module is used for acquiring the first execution time of the kernel package receiving function, the first socket data and the first structural body;
A fourth determining module, configured to determine status information of the first socket data according to the first socket data;
A fifth determining module, configured to determine a first packet receiving party according to the state information of the first socket data;
The fifth generation module is used for generating first data corresponding to a first event according to the first receiving party, the first execution time of the kernel receiving function, the first socket data and the first structure;
A sixth generation module, configured to generate third trace data according to the first trace data or the second trace data, where the first data corresponds to the first event;
and the second sending module is used for sending the third trace data to the back-end component.
The product can execute the method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.
Example six
Fig. 6 is a schematic structural diagram of a data generating device in a sixth embodiment of the present invention. The embodiment may be applicable to the case of fault detection of a TCP four-layer network connection, where the apparatus may be implemented in a software and/or hardware manner, and the apparatus may be integrated in any device that provides a function of data generation, as shown in fig. 6, where the data generation apparatus specifically includes: the second acquisition module 610, the third determination module 620, the third acquisition module 630, the second generation module 640, the third generation module 650, and the first transmission module 660.
The second obtaining module 610 is configured to obtain a second execution time of the kernel wrapping function, second socket data, and a second structure;
A third determining module 620, configured to determine four-tuple information of the second packet receiving party and the target client according to the state information of the second socket data;
a third obtaining module 630, configured to obtain a TCP flag bit in the second structure;
A second generating module 640, configured to generate second data corresponding to the first event according to the second receiving party, a second execution time of the kernel receiving function, and the TCP flag bit;
a third generating module 650, configured to generate fourth trace data according to the second data corresponding to the first event and the quadruple information of the target client;
a first sending module 660, configured to send the fourth trace data to a back-end component.
Optionally, the third determining module is specifically configured to:
And if the target client side is determined to fail to generate the matched first handshake packet and the third handshake packet within the time threshold according to the second socket data, acquiring the four-tuple information of the target client side.
The product can execute the method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.
Example seven
Fig. 7 is a schematic structural diagram of an electronic device in a seventh embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Electronic equipment may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.
As shown in fig. 7, the electronic device 10 includes at least one processor 11, and a memory, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, etc., communicatively connected to the at least one processor 11, in which the memory stores a computer program executable by the at least one processor, and the processor 11 may perform various appropriate actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from the storage unit 18 into the Random Access Memory (RAM) 13. In the RAM13, various programs and data required for the operation of the electronic device 10 may also be stored. The processor 11, the ROM12 and the RAM13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.
Various components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, etc.; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.
The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, digital Signal Processors (DSPs), and any suitable processor, controller, microcontroller, etc. The processor 11 performs the respective methods and processes described above, such as a fault detection method or a data generation method.
In some embodiments, the fault detection method or the data generation method may be implemented as a computer program tangibly embodied on a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM12 and/or the communication unit 19. When the computer program is loaded into the RAM13 and executed by the processor 11, one or more steps of the fault detection method or the data generation method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the fault detection method or the data generation method in any other suitable way (e.g., by means of firmware).
Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.
A computer program for carrying out methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be implemented. The computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which a user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the internet.
The computing system may include clients and servers. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service are overcome.
It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present invention may be performed in parallel, sequentially, or in a different order, so long as the desired results of the technical solution of the present invention are achieved, and the present invention is not limited herein.
The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.
Claims (10)
1. A fault detection method performed by a back-end component, the fault detection method comprising:
receiving trace data sent by a client agent and trace data sent by a server agent;
Determining a fault detection result according to trace data sent by the client agent and trace data sent by the server agent;
The determining a fault detection result according to trace data sent by the client agent and trace data sent by the server agent includes:
If the trace data sent by the client agent does not have the first data corresponding to the first event and the trace data sent by the server agent does not have the second data corresponding to the first event, determining that the first handshake process fails;
If the trace data sent by the client agent does not have the first data corresponding to the first event, and the trace data sent by the server agent only has the second data corresponding to the first event with one TCP (transmission control protocol) flag bit as the first flag bit, determining that the second handshake process fails;
If only one piece of first data corresponding to the first event with the TCP flag bit being the second flag bit exists in trace data sent by the client agent, and only one piece of second data corresponding to the first event with the TCP flag bit being the third flag bit exists in trace data sent by the server agent, the third handshake process is determined to fail.
2. A data generation method, performed by a client agent, the data generation method comprising:
Acquiring a return result of calling the connection function;
determining connection state information according to a return result of calling the connection function;
If the connection state information is connection failure, generating first trace data according to a return result of the call connection function;
The data generation method further comprises the following steps:
Acquiring a first execution time, first socket data and a first structure body of a kernel package receiving function;
Determining state information of the first socket data according to the first socket data;
Determining a first package receiving party according to the state information of the first socket data;
generating first data corresponding to a first event according to the first receiving party, the first execution time of the kernel receiving function, the first socket data and the first structure;
generating third trace data according to the first trace data or the second trace data and the first data corresponding to the first event;
and sending the third trace data to a back-end component.
3. The method as recited in claim 2, further comprising:
if the connection state information is in the process of processing, acquiring a return result of calling a state acquisition function;
And if the connection failure is determined according to the return result of the state acquisition function, generating second trace data according to the return result of the state acquisition function.
4. A data generation method, which is executed by a server agent, the data generation method comprising:
acquiring a second execution time, second socket data and a second structure body of a kernel package receiving function;
determining four-tuple information of a second package receiving party and a target client according to the state information of the second socket data;
acquiring a TCP (transmission control protocol) zone bit in the second structural body;
Generating second data corresponding to the first event according to the second receiving party, the second execution time of the kernel receiving function and the TCP zone bit;
generating fourth trace data according to the second data corresponding to the first event and the four-tuple information of the target client;
and sending the fourth trace data to a back-end component.
5. The method of claim 4, wherein determining the four-tuple information of the target client based on the second socket data comprises:
And if the target client side is determined to fail to generate the matched first handshake packet and the third handshake packet within the time threshold according to the second socket data, acquiring the four-tuple information of the target client side.
6. A fault detection device, comprising:
The first receiving module is used for receiving trace data sent by the client agent and trace data sent by the server agent;
the first determining module is used for determining a fault detection result according to trace data sent by the client agent and trace data sent by the server agent;
the first determining module is specifically configured to:
If the trace data sent by the client agent does not have the first data corresponding to the first event and the trace data sent by the server agent does not have the second data corresponding to the first event, determining that the first handshake process fails;
If the trace data sent by the client agent does not have the first data corresponding to the first event, and the trace data sent by the server agent only has the second data corresponding to the first event with one TCP (transmission control protocol) flag bit as the first flag bit, determining that the second handshake process fails;
If only one piece of first data corresponding to the first event with the TCP flag bit being the second flag bit exists in trace data sent by the client agent, and only one piece of second data corresponding to the first event with the TCP flag bit being the third flag bit exists in trace data sent by the server agent, the third handshake process is determined to fail.
7. A data generating apparatus, comprising:
the first acquisition module is used for acquiring a return result of calling the connection function;
The second determining module is used for determining connection state information according to a return result of calling the connection function;
The first generation module is used for generating first trace data according to the return result of the call connection function if the connection state information is connection failure;
The data generating device further includes:
the fifth acquisition module is used for acquiring the first execution time of the kernel package receiving function, the first socket data and the first structural body;
A fourth determining module, configured to determine status information of the first socket data according to the first socket data;
A fifth determining module, configured to determine a first packet receiving party according to the state information of the first socket data;
The fifth generation module is used for generating first data corresponding to a first event according to the first receiving party, the first execution time of the kernel receiving function, the first socket data and the first structure;
A sixth generation module, configured to generate third trace data according to the first trace data or the second trace data, where the first data corresponds to the first event;
and the second sending module is used for sending the third trace data to the back-end component.
8. A data generating apparatus, comprising:
the second acquisition module is used for acquiring second execution time of the kernel package receiving function, second socket data and a second structure body;
The third determining module is used for determining four-tuple information of the second package receiving party and the target client according to the state information of the second socket data;
A third obtaining module, configured to obtain a TCP flag bit in the second structure;
The second generation module is used for generating second data corresponding to the first event according to the second execution time of the second packet receiving party and the kernel packet receiving function and the TCP zone bit;
The third generation module is used for generating fourth trace data according to the second data corresponding to the first event and the four-tuple information of the target client;
and the first sending module is used for sending the fourth trace data to the back-end component.
9. An electronic device, the electronic device comprising:
At least one processor; and
A memory communicatively coupled to the at least one processor; wherein,
The memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the fault detection method of claim 1 or the data generation method of any one of claims 2-5.
10. A computer readable storage medium storing computer instructions for causing a processor to implement the fault detection method of claim 1 or the data generation method of any one of claims 2-5 when executed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211543086.3A CN115865734B (en) | 2022-12-02 | 2022-12-02 | Fault detection method, data generation method, device, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211543086.3A CN115865734B (en) | 2022-12-02 | 2022-12-02 | Fault detection method, data generation method, device, equipment and medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115865734A CN115865734A (en) | 2023-03-28 |
| CN115865734B true CN115865734B (en) | 2024-06-07 |
Family
ID=85669560
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211543086.3A Active CN115865734B (en) | 2022-12-02 | 2022-12-02 | Fault detection method, data generation method, device, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115865734B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117201292B (en) * | 2023-10-30 | 2024-02-23 | 智业软件股份有限公司 | Method capable of accurately positioning request call exception among micro services |
Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6134678A (en) * | 1997-05-13 | 2000-10-17 | 3Com Corporation | Method of detecting network errors |
| EP1610495A1 (en) * | 2004-06-25 | 2005-12-28 | Fujitsu Limited | Throughput calculation for fault analisys |
| CN101159747A (en) * | 2007-11-12 | 2008-04-09 | 中兴通讯股份有限公司 | TCP concurrency multilink based communication system and method therefor |
| CN101778019A (en) * | 2010-04-01 | 2010-07-14 | 杭州华三通信技术有限公司 | Heartbeat detection message sending method and equipment |
| WO2015039574A1 (en) * | 2013-09-18 | 2015-03-26 | 华为技术有限公司 | Network failure recovery method, controller and switch |
| KR20160080935A (en) * | 2014-12-30 | 2016-07-08 | 주식회사 이노피아테크 | Failover system and method for restoring a TCP session |
| WO2019011028A1 (en) * | 2017-07-11 | 2019-01-17 | 华为技术有限公司 | Method for restoring session, device and computer storage medium |
| CN110247806A (en) * | 2019-06-25 | 2019-09-17 | 杭州迪普科技股份有限公司 | Session failure processing method, device, electronic equipment |
| CN110290030A (en) * | 2019-08-12 | 2019-09-27 | 北京字节跳动网络技术有限公司 | Network state detection method, apparatus, electronic equipment and computer-readable medium |
| CN110430238A (en) * | 2019-07-05 | 2019-11-08 | 中国平安财产保险股份有限公司 | Long connection management method, apparatus, equipment and computer readable storage medium |
| CN112073234A (en) * | 2020-09-02 | 2020-12-11 | 腾讯科技（深圳）有限公司 | Fault detection method, device, system, equipment and storage medium |
| CN112311580A (en) * | 2019-08-01 | 2021-02-02 | 华为技术有限公司 | Message transmission path determining method, device and system and computer storage medium |
| CN112769651A (en) * | 2021-01-13 | 2021-05-07 | 杭州迪普科技股份有限公司 | TCP connection detection method and device and electronic equipment |
| CN114024834A (en) * | 2021-10-21 | 2022-02-08 | 济南浪潮数据技术有限公司 | Fault positioning method and device, electronic equipment and readable storage medium |
| CN114579342A (en) * | 2022-03-07 | 2022-06-03 | 中国农业银行股份有限公司 | Fault detection method and device, electronic equipment and storage medium |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP5003556B2 (en) * | 2008-03-28 | 2012-08-15 | 富士通株式会社 | Communication detection device, communication detection method, and communication detection program |
| US20220014422A1 (en) * | 2021-09-23 | 2022-01-13 | Maruti Gupta Hyde | Cross-layer automated fault tracking and anomaly detection |
-
2022
- 2022-12-02 CN CN202211543086.3A patent/CN115865734B/en active Active
Patent Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6134678A (en) * | 1997-05-13 | 2000-10-17 | 3Com Corporation | Method of detecting network errors |
| EP1610495A1 (en) * | 2004-06-25 | 2005-12-28 | Fujitsu Limited | Throughput calculation for fault analisys |
| CN101159747A (en) * | 2007-11-12 | 2008-04-09 | 中兴通讯股份有限公司 | TCP concurrency multilink based communication system and method therefor |
| CN101778019A (en) * | 2010-04-01 | 2010-07-14 | 杭州华三通信技术有限公司 | Heartbeat detection message sending method and equipment |
| WO2015039574A1 (en) * | 2013-09-18 | 2015-03-26 | 华为技术有限公司 | Network failure recovery method, controller and switch |
| KR20160080935A (en) * | 2014-12-30 | 2016-07-08 | 주식회사 이노피아테크 | Failover system and method for restoring a TCP session |
| WO2019011028A1 (en) * | 2017-07-11 | 2019-01-17 | 华为技术有限公司 | Method for restoring session, device and computer storage medium |
| CN110247806A (en) * | 2019-06-25 | 2019-09-17 | 杭州迪普科技股份有限公司 | Session failure processing method, device, electronic equipment |
| CN110430238A (en) * | 2019-07-05 | 2019-11-08 | 中国平安财产保险股份有限公司 | Long connection management method, apparatus, equipment and computer readable storage medium |
| CN112311580A (en) * | 2019-08-01 | 2021-02-02 | 华为技术有限公司 | Message transmission path determining method, device and system and computer storage medium |
| CN110290030A (en) * | 2019-08-12 | 2019-09-27 | 北京字节跳动网络技术有限公司 | Network state detection method, apparatus, electronic equipment and computer-readable medium |
| CN112073234A (en) * | 2020-09-02 | 2020-12-11 | 腾讯科技（深圳）有限公司 | Fault detection method, device, system, equipment and storage medium |
| CN112769651A (en) * | 2021-01-13 | 2021-05-07 | 杭州迪普科技股份有限公司 | TCP connection detection method and device and electronic equipment |
| CN114024834A (en) * | 2021-10-21 | 2022-02-08 | 济南浪潮数据技术有限公司 | Fault positioning method and device, electronic equipment and readable storage medium |
| CN114579342A (en) * | 2022-03-07 | 2022-06-03 | 中国农业银行股份有限公司 | Fault detection method and device, electronic equipment and storage medium |
Non-Patent Citations (3)
| Title |
|---|
| Detection of Syn Flooding Attacks using Linear Prediction Analysis;D. M. Divakaran, H. A. Murthy and T. A. Gonsalves;《2006 14th IEEE International Conference on Networks》;20070212;全文 * |
| 基于gRPC协议的监控调用链中组件性能指标研究;刘小磊，程伟华，戚林成;《自动化技术与应用》;20210825;全文 * |
| 网络异常检测与溯源方法研究;陈宁;《中国博士学位论文电子期刊网》;20111115;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115865734A (en) | 2023-03-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113726607B (en) | Network detection method and device, electronic equipment and storage medium | |
| CN110399178B (en) | Third-party service calling method and device, electronic equipment and storage medium | |
| CN115865734B (en) | Fault detection method, data generation method, device, equipment and medium | |
| CN117176802B (en) | Full-link monitoring method and device for service request, electronic equipment and medium | |
| CN116645082A (en) | System inspection method, device, equipment and storage medium | |
| CN108667649B (en) | A kind of malfunction elimination method, apparatus and server | |
| CN116561179A (en) | Data query method, device, equipment and program product | |
| CN113596170A (en) | Load balancing equipment-based shutdown processing method, device, medium and equipment | |
| CN114553944A (en) | Early warning message pushing method and system | |
| CN117251769B (en) | Abnormal data identification method, device, equipment and medium based on monitoring component | |
| CN116016265B (en) | Message all-link monitoring method, device, system, equipment and storage medium | |
| CN116132509A (en) | Railway safety computer platform communication method, device, equipment and medium | |
| CN116208554A (en) | FPGA-based flow table processing method, device, equipment and storage medium | |
| CN116781572A (en) | Service availability detection method, device, equipment and storage medium | |
| CN117596047A (en) | Request processing method, request processing device, electronic equipment and storage medium | |
| CN117251359A (en) | Extension point debugging method, device, system, equipment and storage medium | |
| CN116319420A (en) | Network detection method, device, electronic equipment, storage medium and program product | |
| CN116633881A (en) | Bandwidth control method, device, equipment and medium | |
| CN117459373A (en) | Network diagnosis method, device and storage medium | |
| CN117319379A (en) | Unidirectional file transmission method, unidirectional file transmission device, unidirectional file transmission equipment and unidirectional file transmission medium | |
| CN116339745A (en) | Method, device, equipment and storage medium for analyzing communication data between equipment | |
| CN116126409A (en) | Method, device, equipment and medium for acquiring and modifying system configuration information | |
| CN117200945A (en) | Data monitoring method and device, electronic equipment and storage medium | |
| CN117539719A (en) | Application operation monitoring method, device, equipment and medium | |
| CN117880343A (en) | Data processing method and server |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |