WO2016180167A1

WO2016180167A1 - Method, device and system for associating events between computing devices

Info

Publication number: WO2016180167A1
Application number: PCT/CN2016/079551
Authority: WO
Inventors: 任震宇
Original assignee: 阿里巴巴集团控股有限公司; 任震宇
Priority date: 2015-05-08
Filing date: 2016-04-18
Publication date: 2016-11-17
Also published as: CN106201942A; CN106201942B

Abstract

Provided are a method, device and system for associating events between computing devices. The method and device comprises: recording, by a first device (1), first identification information of a first event when transmitting data from the first device (1) to a second device (2); recording, by the second device (2), second identification information of a second event, wherein the first identification information and the second identification information are equivalent because the two are characteristic information of the same data packet transmitted from the first device (1) to the second device (2); and acquiring, by a third device (3), the first event and corresponding first identification information from the first device (1), and acquiring the second event associated with the first event according to the first identification information of the first event, so as to associate the first event and the second event in different devices. The system associates events in different devices such as the first device (1) and the second device (2) via the third device (3), thereby realizing event collection after a plurality of associated events are associated, and outputting to a user a result of the event association.

Description

将计算机设备间事件相关联的方法、设备及***Method, device and system for associating events between computer devices

技术领域Technical field

本申请涉及计算机技术领域，尤其涉及一种用于将计算机设备间事件相关联的技术。The present application relates to the field of computer technology, and in particular, to a technique for associating events between computer devices.

背景技术Background technique

随着计算机技术，尤其是分布式计算的发展。第一计算机程序向第二计算机程序或数据源请求和利用资源、或者第一计算机程序发送消息给第二计算机程序都是很常见的。经常地，第二计算机程序或数据源可能在与第一计算机程序分开的计算机***上执行，因此这两个程序之间通过计算机网络的通信可能是必要的。因而，计算机网络内对单个事务的处理可能需要分布在整个网络上的资源之间的大量通信或交互。为了管理这些计算机网络，尤其是调查问题、分析性能的需要，分布式***或者部署在计算机集群上的服务***，经常会对发生在多台服务器上的非独立事件进行关联。With the development of computer technology, especially distributed computing. It is common for a first computer program to request and utilize a resource to a second computer program or data source, or to send a message to a second computer program by a first computer program. Frequently, the second computer program or data source may be executed on a separate computer system from the first computer program, so communication between the two programs over a computer network may be necessary. Thus, processing a single transaction within a computer network may require a large amount of communication or interaction between resources distributed throughout the network. In order to manage these computer networks, especially to investigate problems and analyze performance needs, distributed systems or service systems deployed on computer clusters often associate non-independent events that occur on multiple servers.

一般来说，发生在同一台计算机上的前后两个事件比较容易关联，而通过网络传输发生在不同计算机上的前后两个事件，因为执行事件的上下文环境完全不同，所以较难关联。传统的关联方法是修改网络通讯库，让发送服务器可以在发送的网络数据包中加入全局唯一性ID并将这个ID作为事件A的字段记录到本地日志中，接收服务器收到网络数据包后提取出ID，将其作为事件B的字段记录到本地日志。当要关联事件A、B时，分析器会用全局唯一性ID作为key，从事件总集合中找到包含该key的事件A和B，完成关联。In general, the two events occurring on the same computer are relatively easy to associate, and the two events occurring on different computers are transmitted over the network. Because the context of the execution event is completely different, it is difficult to associate. The traditional association method is to modify the network communication library, so that the sending server can add the global unique ID in the sent network data packet and record the ID as the field of the event A in the local log, and the receiving server extracts the network data packet. The ID is extracted and recorded as a field of Event B to the local log. When the events A and B are to be associated, the analyzer uses the global unique ID as the key, and finds the events A and B containing the key from the total set of events to complete the association.

现有的计算机间的事件关联存在如下问题：(1)需要修改网络通讯库，并在网络数据包中加入全局唯一性ID作为事件关联的key。有些网络通讯库由于种种原因，比如版权、闭源等，是不能被修改的。对于采用了这种网络通讯库的服务软件，就无法对发生在多台计算机上的通讯事件进行关联。(2) 全局唯一性ID的产生增加了一定的处理器资源，全局唯一性ID的传输，增加了网络数据流量。The existing event correlation between computers has the following problems: (1) The network communication library needs to be modified, and a global unique ID is added to the network data packet as the key associated with the event. Some network communication libraries cannot be modified for various reasons, such as copyright and closed source. For service software that uses such a network communication library, it is impossible to correlate communication events occurring on multiple computers. (2) The generation of the global unique ID increases the certain processor resources, and the transmission of the global unique ID increases the network data traffic.

发明内容Summary of the invention

本申请的一个目的是提供一种用于将计算机设备间事件相关联的方法、设备及***。It is an object of the present application to provide a method, apparatus and system for associating events between computer devices.

根据本申请的一个方面，提供了一种在第一设备端将计算设备间事件相关联的方法，其中，该方法包括：According to an aspect of the present application, a method for associating inter-device computing events at a first device end is provided, wherein the method includes:

获取待通过通信协议发送至第二设备的数据包；Obtaining a data packet to be sent to the second device by using a communication protocol;

将所述数据包中关于所述通信协议的字段信息记为第一事件的第一标识信息，其中，所述第一事件包括通过所述通信协议将所述数据包发送至所述第二设备；Recording, in the data packet, field information about the communication protocol as first identification information of a first event, where the first event includes sending the data packet to the second device by using the communication protocol ;

通过所述通信协议将所述数据包发送至所述第二设备。The data packet is transmitted to the second device by the communication protocol.

根据本申请的另一个方面，提供了一种在第二设备端将计算设备间事件相关联的方法，其中，该方法包括：According to another aspect of the present application, a method for associating inter-device computing events at a second device end is provided, wherein the method includes:

接收第一设备通过通信协议所发送的数据包；Receiving a data packet sent by the first device through a communication protocol;

将所述数据包中关于所述通信协议的字段信息记为第二事件的第二标识信息，其中，所述第二事件包括接收所述第一设备通过所述通信协议发送的所述数据包。Recording, in the data packet, field information about the communication protocol as second identifier information of the second event, where the second event includes receiving the data packet sent by the first device by using the communication protocol .

根据本申请的另一个方面，提供了一种在第三设备端将计算设备间事件相关联的方法，其中，该方法包括：According to another aspect of the present application, a method for associating inter-device computing events at a third device end is provided, wherein the method includes:

从第一设备获取第一事件及对应的第一标识信息；Acquiring the first event and the corresponding first identification information from the first device;

从第二设备获取与所述第一事件相关联的第二事件，其中，所述第一事件的第一标识信息与所述第二事件的第二标识信息相等且对应相同的通信协议。And acquiring, by the second device, a second event associated with the first event, where the first identification information of the first event is equal to the second identification information of the second event and corresponds to the same communication protocol.

根据本申请的另一个方面，提供了一种将计算设备间事件相关联的第一设备，其中，该设备包括：In accordance with another aspect of the present application, a first is provided for associating computing device events Equipment, wherein the equipment includes:

第一装置，用于获取待通过通信协议发送至第二设备的数据包；a first device, configured to acquire a data packet to be sent to the second device by using a communication protocol;

第三装置，用于将所述数据包中关于所述通信协议的字段信息记为第一事件的第一标识信息，其中，所述第一事件包括通过所述通信协议将所述数据包发送至所述第二设备；a third device, configured to record, in the data packet, field information about the communication protocol as first identifier information of a first event, where the first event includes sending the data packet by using the communication protocol To the second device;

第五装置，用于通过所述通信协议将所述数据包发送至所述第二设备。And a fifth device, configured to send the data packet to the second device by using the communication protocol.

根据本申请的另一个方面，提供了一种将计算设备间事件相关联的第二设备，其中，该设备包括：According to another aspect of the present application, a second device is provided for associating computing inter-device events, wherein the device comprises:

第二装置，用于接收第一设备通过通信协议所发送的数据包；a second device, configured to receive a data packet sent by the first device by using a communication protocol;

第四装置，用于将所述数据包中关于所述通信协议的字段信息记为第二事件的第二标识信息，其中，所述第二事件包括接收所述第一设备通过所述通信协议发送的所述数据包。a fourth device, configured to record, in the data packet, field information about the communication protocol as second identifier information of the second event, where the second event includes receiving, by the first device, the communication protocol The data packet sent.

根据本申请的另一个方面，提供了一种将计算设备间事件相关联的第三设备，其中，该设备包括：According to another aspect of the present application, a third device is provided for associating computing device-to-device events, wherein the device comprises:

第十装置，用于从第一设备获取第一事件及对应的第一标识信息；a tenth device, configured to acquire a first event and corresponding first identification information from the first device;

第十一装置，用于从第二设备获取与所述第一事件相关联的第二事件，其中，所述第一事件的第一标识信息与所述第二事件的第二标识信息相等且对应相同的通信协议。An eleventh device, configured to acquire, from the second device, a second event associated with the first event, where the first identifier information of the first event is equal to the second identifier information of the second event Corresponds to the same communication protocol.

根据本申请的另一个方面，提供了一种将计算设备间事件相关联的***，其中，该***包括：所述的第一设备及所述的第二设备及所述的第三设备。In accordance with another aspect of the present application, a system for associating computing inter-device events is provided, wherein the system includes: the first device and the second device and the third device.

与现有技术相比，本申请所述的用于将计算机设备间事件相关联的方法及设备，在从第一设备向第二设备传输数据时，第一设备记录其中第一事件的第一标识信息，第二设备记录其中第二事件的第二标识信息，由于第一标识信息与第二标识信息为第一设备传输至第二设备的同一个数据包的特征信息，故二者相等。由于第一事件的第一标识信息与第二事件的第二标识信息相等且对应相同的通信协议，第三设备从第一设备获取第一事件及对应的第一标识信息，依据第一事件的第一标识信息获取与所述第一事件相关联的第二事件，便可以将位于不同设备上的第一事件与第二事件进行关联。本申请所述的用于将计算机设备间事件相关联的***包括前述第一设备、第二设备及第三设备。采用本申请的将计算机设备间事件相关联的方法及设备，可以在不修改网络通讯库，不改变网络数据包内容，不使用全局唯一性ID的前提下，对发送在多台计算机上的事件进行关联。一方面，对于不能修改网络通讯库的服务软件来说，仍然可以进行事件关联。另一方面，也避免了代价较大的全局唯一性ID的产生，节省了计算资源。Compared with the prior art, the method and device for associating events between computer devices according to the present application, when transmitting data from the first device to the second device, the first device records the first of the first events therein And the second device records the second identifier information of the second event. The first identifier information and the second identifier information are the same information of the same data packet transmitted by the first device to the second device, so the two are equal. The third device acquires the first event and the corresponding first from the first device, because the first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. The first event associated with the first event is associated with the second event according to the first identification information of the first event, and the first event located on the different device is associated with the second event. The system for associating events between computer devices described herein includes the aforementioned first device, second device, and third device. The method and device for associating events between computer devices according to the present application can send events on multiple computers without modifying the network communication library, changing the content of the network data packet, and using the global unique ID. Make an association. On the one hand, for service software that cannot modify the network communication library, event correlation can still be performed. On the other hand, the generation of a costly global unique ID is also avoided, saving computing resources.

附图说明DRAWINGS

图1示出了本申请用于将计算设备间事件相关联的第一设备一实施例的原理框图；1 shows a functional block diagram of an embodiment of a first device for associating computing device-to-device events;

图2示出了本申请用于将计算设备间事件相关联的第二设备一实施例的原理框图；2 shows a functional block diagram of an embodiment of a second device for associating computing device-to-device events in the present application;

图3示出了本申请用于将计算设备间事件相关联的第三设备一实施例的原理框图；3 shows a functional block diagram of an embodiment of a third device for associating computing device-to-device events with the present application;

图4示出了本申请用于将计算设备间事件相关联的第三设备中第十一装置一实施例的原理框图；4 is a schematic block diagram showing an embodiment of an eleventh device in a third device for associating computing device-to-device events in the present application;

图5示出了本申请用于将计算设备间事件相关联的***一实施例的原理框图；FIG. 5 illustrates a functional block diagram of an embodiment of a system for associating computing device-to-device events;

图6示出了本申请将计算设备间事件相关联的方法一实施例的流程图；6 shows a flow chart of an embodiment of a method for associating computing device events between the present application;

图7示出了本申请将计算设备间事件相关联的方法又一实施例的流程图。7 shows a flow diagram of yet another embodiment of a method of correlating computing inter-device events in the present application.

附图中相同或相似的附图标记代表相同或相似的部件。 The same or similar reference numerals in the drawings denote the same or similar components.

具体实施方式detailed description

在本申请一个典型的配置中，终端、服务网络的设备和可信方均包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。In a typical configuration of the present application, the terminal, the device of the service network, and the trusted party each include one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium.

计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括非暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, A magnetic tape cartridge, magnetic tape storage or other magnetic storage device or any other non-transportable medium that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.

为更进一步阐述本申请所采取的技术手段及取得的效果，下面结合附图及较佳实施例，对本申请的技术方案，进行清楚和完整的描述。The technical solutions of the present application will be clearly and completely described in the following with reference to the accompanying drawings and preferred embodiments.

如图1所示，展示了本申请所提供的用于将计算设备间事件相关联的***的原理框图，该***包括第一设备1、第二设备2及第三设备3。As shown in FIG. 1, a block diagram of a system for correlating computing device events provided by the present application is shown, the system including a first device 1, a second device 2, and a third device 3.

在该实施例中，当第一设备1向第二设备2通过通信协议传输数据时，第一设备1记录其中第一事件的第一标识信息，第二设备2记录其中第二事件的第二标识信息，由于第一标识信息与第二标识信息为第一设备1传输至第二设备2的同一个数据包的特征信息，故二者对应相同的通信协议并且内容相等。由于第一事件的第一标识信息与第二事件的第二标识信息相等且对应相同的通信协议，第三设备3从第一设备1获取第一事件及对应的第一标识信息，依据第一事件的第一标识信息内容，在第二设备2上查询与第一标识信息的相等的第二标识信息，并对应至第二标识信息的第二事件，从而将第一事件与第二事件进行关联，也即将位于不同设备上的事件进行关联。同时在该***的第一设备1、第二设备2内部也可进行内部事件的关联，通过第三设备3将第一设备1、第二设备2等不同设备上的事件进行关联，从而实现包括多个关联事件进行关联后的事件集合，并向用户输出事件关联后的结果，以备用户进一步性能测试、问题分析等使用。In this embodiment, when the first device 1 transmits data to the second device 2 through the communication protocol, the first device 1 records the first identification information of the first event, and the second device 2 records the second of the second event. The identification information, since the first identification information and the second identification information are characteristic information of the same data packet transmitted by the first device 1 to the second device 2, the two correspond to the same communication protocol and the contents are equal. The first identification information of the first event is equal to the second identification information of the second event and The third device 3 acquires the first event and the corresponding first identification information from the first device 1 according to the same communication protocol, and queries and searches for the first identification information on the second device 2 according to the content of the first identification information of the first event. The equal second identification information and corresponding to the second event of the second identification information, thereby associating the first event with the second event, and also associating the events on different devices. At the same time, the internal device can be associated with the first device 1 and the second device 2 of the system, and the events on the different devices, such as the first device 1 and the second device 2, are associated by the third device 3, thereby implementing A plurality of associated events are associated with the event collection, and the result of the event correlation is output to the user for use in further performance testing, problem analysis, and the like.

如图2所示，展示了本申请所提供的用于将计算设备间事件相关联的第一设备1的原理框图，该设备包括第一装置11、第三装置12及第五装置13。其中，第一装置11获取待通过通信协议发送至第二设备2的数据包。第三装置12将数据包中关于通信协议的字段信息记为第一事件的第一标识信息，其中，第一事件包括通过通信协议将数据包发送至第二设备2。第五装置13通过通信协议将数据包发送至第二设备2。As shown in FIG. 2, a block diagram of a first device 1 for correlating inter-computer computing events provided by the present application is shown, the device including a first device 11, a third device 12, and a fifth device 13. The first device 11 acquires a data packet to be transmitted to the second device 2 through a communication protocol. The third device 12 records the field information about the communication protocol in the data packet as the first identification information of the first event, wherein the first event comprises transmitting the data packet to the second device 2 through the communication protocol. The fifth device 13 transmits the data packet to the second device 2 through the communication protocol.

在该实施例中，第一设备1通过第一装置11获取待通过通信协议发送至第二设备2的数据包，具体地，在用户的操作需要进行网络传输数据时，便产生数据传输请求，第一装置11可直接获取这些需要传输的数据，然后将这些数据根据网络传输协议的要求，进行数据包或者数据段等处理，以便进行数据传输。第一装置11也可以直接获取处理后的数据包或者数据段等。其中数据包或者数据段处理具体可以指，对待发送的数据流根据网络传输协议要求的传输单元大小、传输规则等要求进行数据分包或者分段处理，以获得适合传输的数据包。例如，TCP网络传输协议传输数据时，需要将待传输的数据流分割成适当长度的报文段，最大传输段大小通常受该计算机连接的网络的数据链路层的最大传送单元限制。然后TCP把数据包传给IP层，由IP层来通过网络将数据包传送给接收端实体的TCP层。当然，具体的处理方式不做限制，只要满足传输协议的要求即可。第三装置12将数据包中关于通信协议的字段信息记为第一事件的第一标识信息，具体地，数据包作为通过通信协议进行网络传输的传输单元，其携带有使数据接收设备识别数据包的相关信息。例如，与通信协议相关的信息，数据包本身的大小信息等能够唯一标识该数据包的信息。具体地，关于通信协议的字段信息一般包括：数据包发送设备与接收设备的地址信息、发送设备与接收设备的端口号信息、数据包的序列号等能够唯一标识该数据包的信息。以TCP传输协议为例，其中数据包中的关于通信协议的字段信息一般包括：第一个字节的序列号(Sequence Number)、确认序列号(Acknowledgment Number)、发送设备与接收设备的地址(IP地址)、发送设备与接收设备的端口号等。将数据包中关于通信协议的字段信息进行记录。具体地，可通过函数记录，也可通过其它方式记录，通常记录在第一事件的日志中。当然，具体的记录方式以及记录位置也不做限制。其中，第一事件包括通过通信协议将数据包发送至第二设备2，此处，第一事件发生在第一设备1中，可表示第一设备1通过网络通信协议向第二设备2传输一个数据包，第一事件的完成，包括数据包从第一设备1传输至第二设备2。第五装置13通过通信协议将数据包发送至第二设备2，具体地，第五装置13可通过满足要求的通信协议将数据包发送至第二设备2，具体的通信协议不做限制，例如可以为TCP协议，也可为其它通信协议。In this embodiment, the first device 1 acquires a data packet to be sent to the second device 2 through the communication protocol by using the first device 11, and specifically, when the user needs to perform network transmission of data, a data transmission request is generated. The first device 11 can directly acquire the data that needs to be transmitted, and then process the data according to the requirements of the network transmission protocol, such as data packets or data segments, for data transmission. The first device 11 can also directly acquire the processed data packet or data segment and the like. The data packet or data segment processing may specifically refer to that the data stream to be sent is subjected to data packetization or segmentation processing according to the transmission unit size and transmission rules required by the network transmission protocol to obtain a data packet suitable for transmission. For example, when the TCP network transmission protocol transmits data, the data stream to be transmitted needs to be segmented into segments of appropriate length, and the maximum transmission segment size is usually limited by the maximum transmission unit of the data link layer of the network to which the computer is connected. The TCP then passes the packet to the IP layer, which transmits the packet over the network to the TCP layer of the receiving entity. Of course, the specific processing method is not limited, as long as the requirements of the transmission protocol are met. The third device 12 will be in the data packet about the communication protocol The field information of the discussion is recorded as the first identification information of the first event. Specifically, the data packet serves as a transmission unit that performs network transmission through the communication protocol, and carries related information that causes the data receiving device to identify the data packet. For example, information related to a communication protocol, size information of a packet itself, and the like can uniquely identify information of the packet. Specifically, the field information about the communication protocol generally includes: address information of the data packet transmitting device and the receiving device, port number information of the sending device and the receiving device, a serial number of the data packet, and the like, which can uniquely identify the data packet. Taking the TCP transmission protocol as an example, the field information about the communication protocol in the data packet generally includes: a sequence number of the first byte, an Acknowledgment Number, and an address of the sending device and the receiving device ( IP address), the port number of the sending device and the receiving device, and so on. Record the field information about the communication protocol in the data packet. Specifically, it can be recorded by function or by other means, usually recorded in the log of the first event. Of course, the specific recording method and recording position are not limited. The first event includes sending the data packet to the second device 2 through a communication protocol, where the first event occurs in the first device 1, and may indicate that the first device 1 transmits one to the second device 2 through the network communication protocol. The data packet, the completion of the first event, includes the transmission of the data packet from the first device 1 to the second device 2. The fifth device 13 transmits the data packet to the second device 2 through the communication protocol. Specifically, the fifth device 13 can transmit the data packet to the second device 2 by satisfying the required communication protocol, and the specific communication protocol is not limited, for example, It can be a TCP protocol or other communication protocol.

参考图2所示，优选地，该设备还包括：Referring to FIG. 2, preferably, the device further includes:

第七装置14，用于在第一设备1的内核中***用于记录第一事件的第一标识信息的第一模块；其中，第三装置12用于：The seventh device 14 is configured to insert, in the kernel of the first device 1, a first module for recording first identification information of the first event; wherein the third device 12 is configured to:

执行第一模块，以记录第一事件的第一标识信息，其中，第一事件包括通过通信协议将数据包发送至第二设备2。Executing a first module to record first identification information of the first event, wherein the first event comprises transmitting the data packet to the second device 2 by using a communication protocol.

在该实施例中，第七装置14在第一设备1的内核中***用于记录第一事件的第一标识信息的第一模块，具体地，第一设备1具有内核与用户空间时，若要与其它设备进行数据传输，便需要将用户空间的数据包传输至内核中，通过内核将数据包传输至其它设备的内核(若有)中，来完成数据在设备间的传输。其中的第一模块用于记录第一事件的第一标识信息，第一模块可以为函数、代码等运行单元，只要能够将第一事件的第一标识信息进行记录便满足要求。第一设备1的内核设置有应用程序编程接口，用户在第一设备1应用层需要发送数据包时，需要通过执行对应接口的发包模块，才可以将数据包从第一设备1的应用层传至其内核中。具体地，第一模块可以设置在发包模块中，也可设置在内核的发包模块外，发包模块可为发包函数，也可为实现发送数据包请求的其它运行单元。第三装置12执行第一模块，以记录第一事件的第一标识信息，具体地，第一事件的第一标识信息通过第一模块的运行进行记录。其中，第一模块的运行需要发包模块的触发。第一模块可以通过预处理，预先设置其与发包模块的关系，例如，第一模块可以预先嵌入发包模块内的位置，也可设置在发包模块外面，只要运行发包模块能够触发第一模块运行即可。例如，第一模块预先嵌入发包模块运行过程中的某具***置，在发包模块运行至此处时，便触发第一模块，运行第一模块将第一事件的第一标识信息进行记录。In this embodiment, the seventh device 14 inserts a first module for recording first identification information of the first event in the kernel of the first device 1, in particular, when the first device 1 has a kernel and a user space, To transfer data with other devices, you need to transfer the user space data packets to the kernel, and transfer the data packets to the kernel (if any) of other devices through the kernel to complete the data between the devices. Transmission. The first module is configured to record the first identification information of the first event, and the first module may be an operation unit such as a function or a code, as long as the first identification information of the first event can be recorded to meet the requirement. The kernel of the first device 1 is provided with an application programming interface. When the application layer of the first device 1 needs to send a data packet, the user needs to execute the packet sending module of the corresponding interface, so that the data packet can be transmitted from the application layer of the first device 1. Into its kernel. Specifically, the first module may be disposed in the sending module, or may be disposed outside the sending module of the kernel, and the sending module may be a sending function, or may be another running unit that implements sending a data packet request. The third device 12 executes the first module to record the first identification information of the first event. Specifically, the first identification information of the first event is recorded by the operation of the first module. The operation of the first module requires the triggering of the sending module. The first module may pre-set its relationship with the delivery module by pre-processing. For example, the first module may be pre-embedded in the location within the delivery module, or may be disposed outside the delivery module, as long as the running delivery module can trigger the operation of the first module. can. For example, the first module is pre-embedded in a specific location during the running process of the delivery module, and when the delivery module runs to here, the first module is triggered, and the first module is operated to record the first identification information of the first event.

参考图2所示，更优选地，第三装置12用于当接收到数据包的发送请求时，执行第一模块，以记录第一事件的第一标识信息，其中，第一事件包括通过通信协议将数据包发送至第二设备2。Referring to FIG. 2, more preferably, the third device 12 is configured to, when receiving a sending request of the data packet, execute the first module to record first identification information of the first event, where the first event includes The protocol sends the data packet to the second device 2.

在该实施例中，第三装置12用于当接收到数据包的发送请求时，执行第一模块，以记录第一事件的第一标识信息。具体地，第一设备1具有内核与用户空间时，若要与其它设备进行数据传输，便需要通过将用户空间的数据包传输至内核中，通过内核将数据包传输至其它设备的内核(若有)中，来完成数据在设备间的传输。第一设备1的内核设置有应用程序编程接口，用户在第一设备1应用层需要发送数据包时，需要通过执行对应接口的发包模块，才可以将数据包从第一设备1的应用层传至其内核中。其中数据包的发送请求可以为发包模块的运行请求，也可为发包模块运行的同时产生的请求等，只要是来自用户空间的数据发送请求，具体的请求发出方式不做限制，发送时间也不做限制，只要满足第三装置12能够执行第一模块，以记录下第一事件的第一标识信息即可。可通过如下具体方式实现对执行第一模块的触发，第一模块可以设置在发包模块中，也可设置在内核的发包模块外，发包模块可为发包函数，也可为实现发送数据包请求的其它运行单元。第三装置12执行第一模块，以记录第一事件的第一标识信息，具体地，第一事件的第一标识信息通过第一模块的运行进行记录。其中，第一模块的运行需要发包模块的触发。第一模块可以通过预处理，预先设置其与发包模块的关系，例如，第一模块可以预先嵌入发包模块内的位置，也可设置在发包模块外面，只要运行发包模块能够触发第一模块运行即可。例如，第一模块预先嵌入发包模块运行过程中的某具***置，在发包模块运行至此处时，便触发第一模块，运行第一模块将第一事件的第一标识信息进行记录。In this embodiment, the third device 12 is configured to execute the first module to record the first identification information of the first event when receiving the transmission request of the data packet. Specifically, when the first device 1 has a kernel and a user space, if data transmission is to be performed with other devices, the data packet of the user space is transmitted to the kernel, and the data packet is transmitted to the kernel of the other device through the kernel (if There is) to complete the transfer of data between devices. The kernel of the first device 1 is provided with an application programming interface. When the application layer of the first device 1 needs to send a data packet, the user needs to execute the packet sending module of the corresponding interface, so that the data packet can be transmitted from the application layer of the first device 1. Into its kernel. The sending request of the data packet may be a running request of the sending module, or a request generated by the sending module, and the like, as long as the data is sent from the user space, the specific request sending manner is not limited. The sending time is also not limited as long as the third device 12 can be executed to execute the first module to record the first identification information of the first event. The triggering of executing the first module may be implemented in the following specific manner. The first module may be set in the sending module, or may be set outside the sending module of the kernel, and the sending module may be a sending function, or may be configured to send a data packet request. Other operating units. The third device 12 executes the first module to record the first identification information of the first event. Specifically, the first identification information of the first event is recorded by the operation of the first module. The operation of the first module requires the triggering of the sending module. The first module may pre-set its relationship with the delivery module by pre-processing. For example, the first module may be pre-embedded in the location within the delivery module, or may be disposed outside the delivery module, as long as the running delivery module can trigger the operation of the first module. can. For example, the first module is pre-embedded in a specific location during the running process of the delivery module, and when the delivery module runs to here, the first module is triggered, and the first module is operated to record the first identification information of the first event.

如图3所示，展示了本申请所提供的用于将计算设备间事件相关联的第二设备2的原理框图，该设备包括第二装置21及第四装置22。其中，第二装置21接收第一设备1通过通信协议所发送的数据包。第四装置22将数据包中关于通信协议的字段信息记为第二事件的第二标识信息，其中，第二事件包括接收第一设备1通过通信协议发送的数据包。As shown in FIG. 3, a block diagram of a second device 2 for correlating inter-computer computing events provided by the present application is shown, the device including a second device 21 and a fourth device 22. The second device 21 receives the data packet sent by the first device 1 through the communication protocol. The fourth device 22 records the field information about the communication protocol in the data packet as the second identification information of the second event, wherein the second event includes receiving the data packet sent by the first device 1 through the communication protocol.

在该实施例中，第二设备2通过第二装置21接收第一设备1通过通信协议所发送的数据包，具体地，第二装置21根据通信协议的数据传输规则接收符合要求的数据包，例如，若通过TCP传输协议进行的数据传输，需要满足TCP协议的传输格式，传输策略等。第四装置22将数据包中关于通信协议的字段信息记为第二事件的第二标识信息，具体地，数据包作为通过通信协议进行网络传输的传输单元，其携带有使数据接收设备识别数据包的相关信息。例如，与通信协议相关的信息，数据包本身的大小信息等能够唯一标识该数据包的信息。具体地，关于通信协议的字段信息一般包括：数据包发送设备与接收设备的地址信息、发送设备与接收设备的端口号信息、数据包的序列号等能够唯一标识该数据包的信息。以TCP传输协议为例，其中数据包中的关于通信协议的字段信息一般包括：第一个字节的序列号(Sequence Number)、确认序列号(Acknowledgment Number)、发送设备与接收设备的地址(IP地址)、发送设备与接收设备的端口号等。将数据包中关于通信协议的字段信息进行记录，并作为第二事件的第二标识信息。具体地，可通过函数记录，也可通过其它方式记录，通常记录在第二事件的日志中。当然，具体的记录方式以及记录位置也不做限制。其中，第二事件包括接收第一设备1通过通信协议发送的数据包，此处，第二事件发生在第二设备2中，可表示第二设备2接收了第一设备1通过网络通信协议所传输的一个数据包，第二事件的完成，包括第二设备2接收了来自第一设备1的一个数据包。In this embodiment, the second device 2 receives, by the second device 21, the data packet sent by the first device 1 through the communication protocol. Specifically, the second device 21 receives the data packet that meets the requirements according to the data transmission rule of the communication protocol. For example, if data transmission is performed by the TCP transmission protocol, it is necessary to satisfy the transmission format, transmission strategy, and the like of the TCP protocol. The fourth device 22 records the field information about the communication protocol in the data packet as the second identification information of the second event, specifically, the data packet acts as a transmission unit for performing network transmission through the communication protocol, and carries the data receiving device to identify the data. Information about the package. For example, information related to a communication protocol, size information of a packet itself, and the like can uniquely identify information of the packet. Specifically, the field information about the communication protocol generally includes: address information of the data packet transmitting device and the receiving device, port number information of the sending device and the receiving device, a serial number of the data packet, and the like, which can uniquely identify the data packet. Take the TCP transport protocol as an example, where the data packet The field information about the communication protocol generally includes: a sequence number of the first byte, an Acknowledgment Number, an address of the transmitting device and the receiving device (IP address), and a port number of the transmitting device and the receiving device. Wait. The field information about the communication protocol in the data packet is recorded and used as the second identification information of the second event. Specifically, it can be recorded by function or by other means, and is usually recorded in the log of the second event. Of course, the specific recording method and recording position are not limited. The second event includes receiving a data packet sent by the first device 1 through a communication protocol. Here, the second event occurs in the second device 2, which may indicate that the second device 2 receives the first device 1 through a network communication protocol. A data packet transmitted, the completion of the second event, including the second device 2 receiving a data packet from the first device 1.

如图3所示，展示了本申请所提供的用于将计算设备间事件相关联的第二设备2的原理框图，该设备还包括第六装置23。其中，第六装置23将数据包发送至第二设备2中的对应目标应用。As shown in FIG. 3, a block diagram of a second device 2 for correlating inter-computer computing events provided by the present application is shown, the device further including a sixth device 23. The sixth device 23 sends the data packet to the corresponding target application in the second device 2.

在该实施例中，由于数据包的传输需求来自于用户操作应用程序的需求，相应地，第一设备1根据用户操作应用程序时的需要，将数据包传输至第二设备2，第二设备2接收到该数据包后，需要将数据包内容发送至第二设备2中的对应目标应用。具体地，可通过第二设备2用户空间的目标应用程序从第二设备2的内核里读出数据包，完成整个数据的单向传输过程。当然，将数据包发送至第二设备2中的目标应用的具体方式不做限制，只要满足需求即可，例如若第二设备2没有内核，那么数据包发送至目标应用程序的方式便会不同。In this embodiment, since the transmission requirement of the data packet comes from the requirement of the user operating the application, accordingly, the first device 1 transmits the data packet to the second device 2 according to the needs of the user when operating the application, and the second device 2 After receiving the data packet, the content of the data packet needs to be sent to the corresponding target application in the second device 2. Specifically, the data packet can be read from the kernel of the second device 2 through the target application of the user space of the second device 2, and the one-way transmission process of the entire data is completed. Certainly, the specific manner of sending the data packet to the target application in the second device 2 is not limited as long as the requirement is met. For example, if the second device 2 does not have a kernel, the manner in which the data packet is sent to the target application is different. .

参考图3所示，优选地，该设备还包括：Referring to FIG. 3, preferably, the device further includes:

第八装置24，用于在第二设备2的内核中***用于记录第二事件的第二标识信息的第二模块；其中，第四装置22用于：The eighth device 24 is configured to insert, in the kernel of the second device 2, a second module for recording second identification information of the second event; wherein the fourth device 22 is configured to:

执行第二模块，以记录第二事件的第二标识信息，其中，第二事件包括接收第一设备1通过通信协议发送的数据包。Executing a second module to record second identification information of the second event, wherein the second event comprises receiving a data packet sent by the first device 1 by using a communication protocol.

在该实施例中，第八装置24在第二设备2的内核中***用于记录第二事件的第二标识信息的第二模块。其中的第二模块用于记录第二事件的第二标识信息，第二模块可以为函数、代码等运行单元，只要能够将第二事件的第二标识信息进行记录便满足要求。具体地，第二设备2具有内核与用户空间时，若要与其它设备进行数据传输，第二设备2的内核接收到的来自第一设备1内核的数据包，还需要发送至用户空间，以实现数据包的互动传输。其中的第二模块用于记录第二事件的第二标识信息，第二模块可以为函数、代码等运行单元，只要能够将第二事件的第二标识信息进行记录便满足要求。In this embodiment, the eighth device 24 is inserted in the kernel of the second device 2 for recording the second thing. The second module of the second identification information of the piece. The second module is configured to record the second identification information of the second event, and the second module may be an operation unit such as a function or a code, as long as the second identification information of the second event can be recorded. Specifically, when the second device 2 has a kernel and a user space, if data transmission is to be performed with other devices, the data packet received by the kernel of the second device 2 from the core of the first device 1 needs to be sent to the user space to Realize the interactive transmission of data packets. The second module is configured to record the second identification information of the second event, and the second module may be an operation unit such as a function or a code, as long as the second identification information of the second event can be recorded.

继续在该实施例中，第二设备2的内核设置有应用程序编程接口，用户在第二设备2接收到来自第一设备1的数据包时，需要通过执行对应接口的收包模块，才可以将数据包从第二设备2的内核传至其用户空间。具体地，第二模块可以设置在收包模块中，也可设置在内核的收包模块外，收包模块可为收包函数，也可为实现接收数据包请求的其它运行单元。第四装置22执行第二模块，以记录第二事件的第二标识信息，具体地，第二事件的第二标识信息通过第二模块的运行进行记录。其中，第二模块的运行需要收包模块的触发。第二模块可以通过预处理，预先设置其与收包模块的关系，例如，第二模块可以预先嵌入收包模块内的位置，也可设置在收包模块外面，只要运行收包模块能够触发第二模块运行即可。例如，第二模块预先嵌入收包模块运行过程中的某具***置，在收包模块运行至此处时，便触发第二模块，运行第二模块将第二事件的第二标识信息进行记录。Continuing in this embodiment, the kernel of the second device 2 is provided with an application programming interface. When the second device 2 receives the data packet from the first device 1, the user needs to execute the receiving module of the corresponding interface. The packet is passed from the core of the second device 2 to its user space. Specifically, the second module may be disposed in the receiving module, or may be disposed outside the receiving module of the kernel, and the receiving module may be a receiving function, or may be another operating unit that implements receiving the data packet request. The fourth device 22 executes the second module to record the second identification information of the second event. Specifically, the second identification information of the second event is recorded by the operation of the second module. The operation of the second module requires the triggering of the receiving module. The second module can pre-set the relationship between the second module and the receiving module. For example, the second module can be embedded in the location of the receiving module in advance, or can be set outside the receiving module, as long as the running receiving module can trigger the first The second module can be run. For example, the second module is pre-embedded in a specific location during the operation of the receiving module. When the receiving module runs here, the second module is triggered, and the second module is operated to record the second identification information of the second event.

参考图3所示，更优选地，第四装置22用于：Referring to Figure 3, more preferably, the fourth device 22 is for:

在接收到数据包时，执行第二模块，以记录第二事件的第二标识信息，其中，第二事件包括接收第一设备1通过通信协议发送的数据包。Upon receiving the data packet, the second module is executed to record the second identification information of the second event, wherein the second event comprises receiving the data packet sent by the first device 1 through the communication protocol.

在该实施例中，第四装置22用于在接收到数据包时，执行第二模块，以记录第二事件的第二标识信息。具体地，第二设备2具有内核与用户空间时，若要与其它设备进行数据传输，第二设备2的内核接收到的来自第一设备1内核的数据包，还需要发送至用户空间，以实现数据包的互动传输。第二设备2的内核设置有应用程序编程接口，用户在第二设备2内核接收到来自第一设备1内核的数据包时，需要通过执行对应接口的收包模块，才可以将数据包从第二设备2的内核传至其用户空间中。其中接收数据包的请求可以为收包模块的运行请求，也可为收包模块运行的同时产生的请求等，只要是来自第二设备2内核的数据接收请求，具体的请求发出方式不做限制，发送时间也不做限制，只要满足第四装置22能够执行第二模块，以记录下第二事件的第二标识信息即可。可通过如下具体方式实现对执行第二模块的触发，第二模块可以设置在收包模块中，也可设置在内核的收包模块外，收包模块可为收包函数，也可为实现接收数据包请求的其它运行单元。第四装置22执行第二模块，以记录第二事件的第二标识信息，具体地，第二事件的第二标识信息通过第二模块的运行进行记录。其中，第二模块的运行需要收包模块的触发。第二模块可以通过预处理，预先设置其与收包模块的关系，例如，第二模块可以预先嵌入收包模块内的位置，也可设置在收包模块外面，只要运行收包模块能够触发第二模块运行即可。例如，第二模块预先嵌入收包模块运行过程中的某具***置，在收包模块运行至此处时，便触发第二模块，运行第二模块将第二事件的第二标识信息进行记录。In this embodiment, the fourth device 22 is configured to execute the second module to record the second identification information of the second event when the data packet is received. Specifically, when the second device 2 has a kernel and a user space, if data transmission is to be performed with other devices, the data packet received by the kernel of the second device 2 from the core of the first device 1 needs to be sent to the user space to Realize the interactive transmission of data packets. Second setting The kernel of the standby 2 is provided with an application programming interface. When the user receives the data packet from the core of the first device 1 in the second device 2 core, the user needs to execute the receiving module of the corresponding interface, so that the data packet can be sent from the second device. The kernel of 2 is passed to its user space. The request for receiving the data packet may be a running request of the receiving module, or a request generated by the receiving module, and the like, as long as the data receiving request is from the core of the second device 2, the specific request sending manner is not limited. The sending time is also not limited as long as the fourth device 22 can be executed to execute the second module to record the second identification information of the second event. The triggering of executing the second module may be implemented in the following specific manner. The second module may be set in the receiving module, or may be disposed outside the receiving module of the kernel, and the receiving module may be a receiving function or receiving Other runtime units for packet requests. The fourth device 22 executes the second module to record the second identification information of the second event. Specifically, the second identification information of the second event is recorded by the operation of the second module. The operation of the second module requires the triggering of the receiving module. The second module can pre-set the relationship between the second module and the receiving module. For example, the second module can be embedded in the location of the receiving module in advance, or can be set outside the receiving module, as long as the running receiving module can trigger the first The second module can be run. For example, the second module is pre-embedded in a specific location during the operation of the receiving module. When the receiving module runs here, the second module is triggered, and the second module is operated to record the second identification information of the second event.

如图4所示，展示了本申请所提供的用于将计算设备间事件相关联的第三设备3的原理框图，该设备包括第十装置31及第十一装置32。其中，第十装置31从第一设备1获取第一事件及对应的第一标识信息。第十一装置32从第二设备2获取与第一事件相关联的第二事件，其中，第一事件的第一标识信息与第二事件的第二标识信息相等且对应相同的通信协议。As shown in FIG. 4, a block diagram of a third device 3 for correlating inter-computer computing events provided by the present application is shown, the device including a tenth device 31 and an eleventh device 32. The tenth device 31 acquires the first event and the corresponding first identification information from the first device 1. The eleventh device 32 acquires a second event associated with the first event from the second device 2, wherein the first identification information of the first event is equal to the second identification information of the second event and corresponds to the same communication protocol.

在该实施例中，第三设备3用于对前述第一事件及第二事件进行关联，第三双设备可设置在第一设备1中，也可设置在第二设备2中，也可单独设置。第十装置31从第一设备1获取第一事件及对应的第一标识信息，具体地，第十装置31可在第一设备1上查找到需要关联的第一事件的第一标识信息，例如，可在第一设备1上的事件日志上查找第一事件对应的第一标识信息。一般第一设备1的事件日志记录在第一设备1的存储器或者磁盘等中，直接去相应的存储位置查找读取即可。第三设备3在第一设备1上查找第一事件对应的第一标识信息的具体时间，可以为实时查找，也可以为间隔一定的预设时间进行查找，也可以根据用户的需求，在用户需要对第一设备1、第二设备2等组成的***的性能进行分析或者测试时进行查找，具体查找时间不做限制。第十一装置32从第二设备2获取与第一事件相关联的第二事件，具体地，第十一装置32依据第一事件的第一标识信息，在第二设备2上查找到与第一标识信息相等的第二标识信息，并对应至第二事件，例如，可在第二设备2上的事件日志上查找与第一标识信息相等的第二标识信息。一般第二设备2中的事件日志记录在第二设备2的存储器或者磁盘等中，直接去相应的存储位置查找读取即可。通过查找到的第二标识信息，进一步找到其对应的第二事件，并获取第二事件，此时第一事件与第二事件相关联。第一事件的第一标识信息与第二事件的第二标识信息相等且对应相同的通信协议，具体地，由于第一事件为第一设备1向第二设备2发送一个数据包，第二事件为第二设备2接收第一设备1所发送的数据包，第一事件的第一标识信息与第二事件的第二标识信息，为同一个数据包的与通信协议相关的信息，故第一标识信息与第二标识信息相等并且对应相同的通信协议。In this embodiment, the third device 3 is configured to associate the foregoing first event and the second event, and the third dual device may be disposed in the first device 1, or may be disposed in the second device 2, or may be separately Settings. The tenth device 31 acquires the first event and the corresponding first identification information from the first device 1, and specifically, the tenth device 31 can find the first identification information of the first event that needs to be associated on the first device 1, for example The first identifier information corresponding to the first event may be searched on the event log on the first device 1. Generally, the event log of the first device 1 is recorded in the memory or the disk of the first device 1, and can be directly read and read by the corresponding storage location. The specific time for the third device 3 to search for the first identifier information corresponding to the first event on the first device 1 may be a real-time search, or may be searched for a preset time interval, or may be performed according to the user's needs. The performance of the system composed of the first device 1, the second device 2, and the like needs to be analyzed or tested, and the specific search time is not limited. The eleventh device 32 acquires the second event associated with the first event from the second device 2, specifically, the eleventh device 32 finds the second device 2 according to the first identification information of the first event. A second identification information with the same information is identified, and corresponding to the second event. For example, the second identification information equal to the first identification information may be searched for on the event log on the second device 2. Generally, the event log in the second device 2 is recorded in the memory or the disk of the second device 2, and can be directly read to the corresponding storage location for reading. The second identifier is further found by the found second identifier information, and the second event is obtained, and the first event is associated with the second event. The first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. Specifically, because the first event is that the first device 1 sends a data packet to the second device 2, the second event Receiving, by the second device 2, the data packet sent by the first device 1, the first identifier information of the first event and the second identifier information of the second event are information related to the communication protocol of the same data packet, so the first The identification information is equal to the second identification information and corresponds to the same communication protocol.

继续在该实施例中，第十装置31也可从第二设备2中获取第二事件及对应的第二标识信息，然后第十一装置32从第一设备1获取与第二事件相关联的第一事件，其中第二事件的第二标识信息与第一事件的第一标识信息相等且对应相同的通信协议。其具体的实现方式，与该实施例前部分的实质原理相同，在此不再赘述。Continuing in this embodiment, the tenth device 31 can also obtain the second event and the corresponding second identification information from the second device 2, and then the eleventh device 32 acquires the second event associated with the second event from the first device 1. The first event, wherein the second identification information of the second event is equal to the first identification information of the first event and corresponds to the same communication protocol. The specific implementation of the previous embodiment is the same as that of the previous part of the embodiment, and details are not described herein again.

如图5所示，展示了本申请所提供的用于将计算设备间事件相关联的第三设备3中第十一装置32的原理框图，第十一装置32包括第十一一单元321及第十一二单元322。其中，第十一一单元321根据第一事件的第一标识信息，在第二设备2中查找与第一标识信息相等且对应相同的通信协议的标识信息，其中，查找到的标识信息为第二标识消息。第十一二单元322获取第二标识信息对应的第二事件。As shown in FIG. 5, a schematic block diagram of an eleventh device 32 in a third device 3 for correlating inter-computer computing events provided by the present application is shown. The eleventh device 32 includes an eleventh unit 321 and The eleventh two-unit 322. The eleventh unit 321 searches, in the second device 2, the identification information of the communication protocol that is equal to the first identification information and corresponds to the same according to the first identification information of the first event. Information, wherein the found identification information is a second identification message. The eleventh unit 322 obtains the second event corresponding to the second identifier information.

在该实施例中，第十一一单元321根据第一事件的第一标识信息，在第二设备2中查找与第一标识信息相等且对应相同的通信协议的标识信息，其中，查找到的标识信息为第二标识消息。一般地，事件的标识信息记录在事件的日志中，第十一一单元321根据第一标识信息的具体内容，在第二设备2的事件日志中查找具有相等内容的标识信息，查找到的标识信息即为第二标识信息，本领域的技术人员应当能够理解，此处的具体查找方式不做限制。第十一二单元322获取第二标识信息对应的第二事件，具体地，第十一二单元322通过第二标识信息可获取第二事件的处理过程情况、处理时间、处理结果等与第二事件相关的信息。可通过运行相关函数进行读取的方式，也可通过比较判断的方式等等进行获取，本领域的技术人员应当能够理解，此处的具体获取第二事件的方式并不做限制。In this embodiment, the eleventh unit 321 searches, in the second device 2, the identifier information of the communication protocol that is equal to the first identifier information and corresponds to the same, according to the first identifier information of the first event, where the identifier information is found. The identification information is a second identification message. Generally, the identifier information of the event is recorded in the log of the event, and the eleventh unit 321 searches for the identifier information with the equal content in the event log of the second device 2 according to the specific content of the first identifier information, and the identifier that is found is found. The information is the second identification information, and those skilled in the art should be able to understand that the specific search manner herein is not limited. The eleventh unit 322 obtains the second event corresponding to the second identifier information. Specifically, the eleventh and second units 322 can obtain the processing status, the processing time, the processing result, and the like of the second event by using the second identifier information. Event related information. It can be obtained by running the correlation function, or by comparing the judgment manner, etc., and those skilled in the art should be able to understand that the specific manner of obtaining the second event herein is not limited.

优选地，第一标识信息与第二标识信息的记录时间满足预定的时间间隔阈值。Preferably, the recording time of the first identification information and the second identification information meets a predetermined time interval threshold.

在该实施例中，主要针对依据第一标识信息在第二设备2中查到了与第一标识信息相等并且对应相同的通信协议的多个标识信息的情况。此时还需要从这些标识信息中找到与第一标识信息对应的第二标识信息，具体地，需要借助标识信息的记录时间实现，即在第二设备2上查到的与第一标识信息相等并且对应相同的通信协议的多个标识信息中，查找记录时间与第一标识信息的记录时间满足预设阈值间隔的标识信息，为第二标识信息。例如，预设时间间隔阈值为0-500毫秒，也即记录第一标识信息与第二标识信息的时间点间隔要在500毫秒范围内。在第二设备2上查找到3个与第一标识信息相等并且对应相同的通信协议的标识信息，其中，3个标识信息的记录时间与第一标识信息的记录时间间隔分别为1分钟、100毫秒、10分钟，很明显时间间隔为100毫秒的标识信息为第二标识信息。时间间隔阈值根据需要进行设定。In this embodiment, it is mainly for the case where a plurality of pieces of identification information of the communication protocol equal to the first identification information and corresponding to the same identity information are found in the second device 2 according to the first identification information. In this case, the second identification information corresponding to the first identification information needs to be found from the identification information. Specifically, the recording time of the identification information needs to be implemented, that is, the first identification information is found on the second device 2. And the identifier information that meets the preset threshold interval, and is the second identifier information, in the plurality of pieces of the identification information corresponding to the same communication protocol. For example, the preset time interval threshold is 0-500 milliseconds, that is, the time point interval for recording the first identification information and the second identification information is within a range of 500 milliseconds. The third device 2 finds three pieces of identification information that are equal to the first identification information and correspond to the same communication protocol, wherein the recording time interval of the three identification information and the recording time interval of the first identification information are 1 minute and 100, respectively. In milliseconds and 10 minutes, it is obvious that the identification information with a time interval of 100 milliseconds is the second identification information. Time interval threshold as needed Line settings.

继续在该实施例中，第一标识信息与第二标识信息的记录时间满足预定的时间间隔阈值，还可以在找到的与第一标识信息相等并且对应相同的通信协议的多个标识信息中，排除明显不符合成为第二标识信息的情况，例如，仍预设时间间隔阈值为0-500毫秒，在第二设备2上查找到3个与第一标识信息相等并且对应相同的通信协议的标识信息，其中，3个标识信息的记录时间与第一标识信息的记录时间间隔分别为60毫秒、400毫秒、10分钟，此时时间间隔为10分钟的标识信息明显不符合要求，而剩下的时间间隔为60毫秒及400毫秒的标识信息可通过时间间隔最接近的方式筛选出第二标识信息，也可借助其他方式实现进一步的筛选。再例如，仍预设时间间隔阈值为0-500毫秒，在第二设备2上查找到1个与第一标识信息相等并且对应相同的通信协议的标识信息，其中，该标识信息的记录时间与第一标识信息的记录时间间隔为20分钟，该标识信息明显不符合要求，则可认为在第二设备2上未找到符合要求的第二标识信息。Continuing in this embodiment, the recording time of the first identification information and the second identification information meets a predetermined time interval threshold, and may also be found in the plurality of identification information of the communication protocol that is equal to the first identification information and corresponds to the same communication protocol. Excluding the case that the second identification information is obviously not met, for example, the preset time interval threshold is 0-500 milliseconds, and the identifiers of the communication protocols that are equal to the first identification information and corresponding to the same are found on the second device 2. The information, wherein the recording time of the three identification information and the recording time interval of the first identification information are respectively 60 milliseconds, 400 milliseconds, and 10 minutes, and the identification information of the time interval of 10 minutes obviously does not meet the requirement, and the remaining The identification information with a time interval of 60 milliseconds and 400 milliseconds can filter the second identification information in the closest manner to the time interval, and further screening can be implemented by other means. For example, the preset time interval threshold is 0-500 milliseconds, and the identifier information of the communication protocol equal to the first identification information and corresponding to the same is found on the second device 2, wherein the recording time of the identification information is If the recording time interval of the first identification information is 20 minutes, and the identification information obviously does not meet the requirement, it may be considered that the second identification information that meets the requirement is not found on the second device 2.

另外，需要指出的是，在该实施例中的所有时间点值及时间间隔阈值等，均是在第一设备1与第二设备2所在***的所有设备时间同步的情况下进行的记录、比较等。具体***内部设备间的时间同步方法不做限制。In addition, it should be noted that all time point values and time interval thresholds and the like in this embodiment are recorded and compared in the case where all the devices of the system in which the first device 1 and the second device 2 are located are synchronized. Wait. The time synchronization method between the internal devices of the specific system is not limited.

如图4所示，展示了本申请所提供的用于将计算设备间事件相关联的第三设备3的原理框图，该设备还包括：As shown in FIG. 4, a schematic block diagram of a third device 3 for associating computing device-to-device events provided by the present application is shown, the device further comprising:

第十二装置33，用于将第二设备2上的第三事件与第一事件相关联，其中，第三事件与第二事件相关联。The twelfth device 33 is configured to associate the third event on the second device 2 with the first event, wherein the third event is associated with the second event.

在该实施例中，主要针对事件在同一个设备内部进行关联的情况，第三事件与第二事件均发生在第二设备2上，第二事件与第三事件的关联为同一设备内部的关联，具体地，可通过线程ID等方式进行关联，本领域的技术人员应当能够理解设备内部事件关联的方式并不做具体限制。其中第一设备1上的第一事件与第二设备2上的第三事件进行关联，是通过第一事件与第二事件关联、第二事件与第三事件关联后，第一事件通过第二事件与第三事件进行关联。尤其是在分布式***中，需要关联的事件位于很多台设备上，要将很多个相关联的事件关联起来，就即需要设备内部事件的关联，又需要设备间事件的关联，以实现最终所有相关联事件的关联。具体地，第十二装置33将第二设备2上的第三事件与第一设备1上的第一事件相关联，首先，需要通过线程ID将第二设备2上第三事件与第二事件进行关联，再通过前述第一事件与第二事件进行关联的方式，将第二事件与第一事件进行关联，最终实现第一事件、第二事件、第三事件的关联。In this embodiment, mainly for the case that the event is associated within the same device, the third event and the second event both occur on the second device 2, and the association between the second event and the third event is an internal association of the same device. Specifically, the association may be performed by means of a thread ID or the like, and those skilled in the art should be able to understand that the manner in which the internal event of the device is associated is not specifically limited. The first event on the first device 1 is associated with the third event on the second device 2, and is the first event and the second event. After the event association, the second event is associated with the third event, the first event is associated with the third event by the second event. Especially in a distributed system, the events that need to be associated are located on many devices. To associate a large number of related events, the association between the internal events of the device is required, and the association of events between devices is required to achieve the final The association of associated events. Specifically, the twelfth device 33 associates the third event on the second device 2 with the first event on the first device 1. First, the third event and the second event on the second device 2 need to be passed through the thread ID. The association is performed, and the second event is associated with the first event by using the foregoing first event to be associated with the second event, and finally the association of the first event, the second event, and the third event is implemented.

如图4所示，展示了本申请所提供的用于将计算设备间事件相关联的第三设备3的原理框图，该设备还包括第十三装置34。其中，第十三装置34将关联所得的事件集合输出给用户，其中，事件集合包括第一事件及与第一事件相关联的事件。As shown in FIG. 4, a functional block diagram of a third device 3 for correlating inter-computer computing events provided by the present application is shown, the device further including a thirteenth device 34. The thirteenth device 34 outputs the associated event collection to the user, wherein the event set includes the first event and an event associated with the first event.

在该实施例中，第十三装置34将关联所得的事件集合输出给用户，具体地，将关联事件关联后的结果输出给用户，例如，当一个分布式***总是运行缓慢，用户需要对该***进行性能测试或者查找问题的原因，若该分布式***包括三个设备A、B、C，数据需要在此三个设备上进行传输，在A设备上发生了第一事件，在B设备上发生了第二事件及第三事件，在C设备上发生了第***，第一事件至第***为关联事件，那么第十三装置34根据用户需要查找该***运行缓慢的原因时，需要分别查找第一事件的数据包发送时空信息，例如发送时间点、发送位置，第二事件接收第一事件发送的数据包的时空信息，以此类推。若发现其中有的事件的发送\接收数据包的时空信息不符合预设的阈值，那么可以判断出，***中执行该事件的设备出现了问题，还可以根据读取的相关具体信息，进一步分析问题的原因。In this embodiment, the thirteenth device 34 outputs the associated event set to the user, specifically, the result of associating the associated event to the user, for example, when a distributed system is always running slowly, the user needs to The system performs performance testing or finds the cause of the problem. If the distributed system includes three devices A, B, and C, data needs to be transmitted on the three devices, and the first event occurs on the A device. The second event and the third event occur, and a fourth event occurs on the C device. The first event to the fourth event are associated events, and then the thirteenth device 34 searches for the reason why the system is slow according to the user needs. It is necessary to separately search for the spatio-temporal information of the first event, such as the sending time point and the sending position, the second event receiving the spatio-temporal information of the data packet sent by the first event, and so on. If it is found that the spatio-temporal information of the sending/receiving data packet of the event does not meet the preset threshold, it can be determined that there is a problem in the device that executes the event in the system, and further analysis can be performed according to the specific information read. The cause of the problem.

与现有技术相比，本申请的用于将计算机设备间事件相关联的设备，在从第一设备1向第二设备2传输数据时，第一设备1记录其中第一事件的第一标识信息，第二设备2记录其中第二事件的第二标识信息，由于第一标识信息与第二标识信息为第一设备1传输至第二设备2的同一个数据包的特征信息，故二者相等。由于第一事件的第一标识信息与第二事件的第二标识信息相等且对应相同的通信协议，第三设备3从第一设备1获取第一事件及对应的第一标识信息，依据第一事件的第一标识信息获取与第一事件相关联的第二事件，便可以将位于不同设备上的第一事件与第二事件进行关联。本申请的用于将计算机设备间事件相关联的***包括前述第一设备1、第二设备2及第三设备3。采用本申请的将计算机设备间事件相关联的方法及设备，可以在不修改网络通讯库，不改变网络数据包内容，不使用全局唯一性ID的前提下，对发送在多台计算机上的事件进行关联。一方面，对于不能修改网络通讯库的服务软件来说，仍然可以进行事件关联。另一方面，也避免了代价较大的全局唯一性ID的产生，节省了计算资源。Compared with the prior art, the device for associating events between computer devices of the present application, when transmitting data from the first device 1 to the second device 2, the first device 1 records the first identifier of the first event therein. Information, the second device 2 records the second identification information of the second event, due to the first identifier The information and the second identification information are characteristic information of the same data packet transmitted by the first device 1 to the second device 2, so the two are equal. The third device 3 acquires the first event and the corresponding first identification information from the first device 1 according to the first information, because the first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. The first identification information of the event acquires the second event associated with the first event, and the first event located on the different device can be associated with the second event. The system for associating events between computer devices of the present application includes the aforementioned first device 1, second device 2, and third device 3. The method and device for associating events between computer devices according to the present application can send events on multiple computers without modifying the network communication library, changing the content of the network data packet, and using the global unique ID. Make an association. On the one hand, for service software that cannot modify the network communication library, event correlation can still be performed. On the other hand, the generation of a costly global unique ID is also avoided, saving computing resources.

如图6所示，展示了本申请所提供的将计算设备间事件相关联的方法，其中，在第一设备端将计算设备间事件相关联的方法包括：As shown in FIG. 6, a method for associating computing inter-device events provided by the present application is shown, wherein the method for associating inter-device computing events on the first device side includes:

S1，获取待通过通信协议发送至第二设备的数据包。S1. Obtain a data packet to be sent to the second device by using a communication protocol.

S2，将数据包中关于通信协议的字段信息记为第一事件的第一标识信息，其中，第一事件包括通过通信协议将数据包发送至第二设备。S2. Record field information about the communication protocol in the data packet as the first identification information of the first event, where the first event includes sending the data packet to the second device by using a communication protocol.

S3，通过通信协议将数据包发送至第二设备。S3. Send the data packet to the second device by using a communication protocol.

在该实施例中，第一设备获取待通过通信协议发送至第二设备的数据包，具体地，在用户的操作需要进行网络传输数据时，便产生数据传输请求，可直接获取这些需要传输的数据，然后将这些数据根据网络传输协议的要求，进行数据包或者数据段等处理，以便进行数据传输。也可以直接获取处理后的数据包或者数据段等。其中数据包或者数据段处理具体可以指，对待发送的数据流根据网络传输协议要求的传输单元大小、传输规则等要求进行数据分包或者分段处理，以获得适合传输的数据包。例如，TCP网络传输协议传输数据时，需要将待传输的数据流分割成适当长度的报文段，最大传输段大小通常受该计算机连接的网络的数据链路层的最大传送单元限制。然后TCP 把数据包传给IP层，由IP层来通过网络将数据包传送给接收端实体的TCP层。当然，具体的处理方式不做限制，只要满足传输协议的要求即可。将数据包中关于通信协议的字段信息记为第一事件的第一标识信息，具体地，数据包作为通过通信协议进行网络传输的传输单元，其携带有使数据接收设备识别数据包的相关信息。例如，与通信协议相关的信息，数据包本身的大小信息等能够唯一标识该数据包的信息。具体地，关于通信协议的字段信息一般包括：数据包发送设备与接收设备的地址信息、发送设备与接收设备的端口号信息、数据包的序列号等能够唯一标识该数据包的信息。以TCP传输协议为例，其中数据包中的关于通信协议的字段信息一般包括：第一个字节的序列号(Sequence Number)、确认序列号(Acknowledgment Number)、发送设备与接收设备的地址(IP地址)、发送设备与接收设备的端口号等。将数据包中关于通信协议的字段信息进行记录。具体地，可通过函数记录，也可通过其它方式记录，通常记录在第一事件的日志中。当然，具体的记录方式以及记录位置也不做限制。其中，第一事件包括通过通信协议将数据包发送至第二设备，此处，第一事件发生在第一设备中，可表示第一设备通过网络通信协议向第二设备传输一个数据包，第一事件的完成，包括数据包从第一设备传输至第二设备。通过通信协议将数据包发送至第二设备，具体地，可通过满足要求的通信协议将数据包发送至第二设备，具体的通信协议不做限制，例如可以为TCP协议，也可为其它通信协议。In this embodiment, the first device acquires a data packet to be sent to the second device by using a communication protocol, and specifically, when the operation of the user needs to perform data transmission on the network, a data transmission request is generated, and the data transmission request may be directly obtained. The data is then processed according to the requirements of the network transmission protocol, such as data packets or data segments, for data transmission. It is also possible to directly obtain the processed data packet or data segment. The data packet or data segment processing may specifically refer to that the data stream to be sent is subjected to data packetization or segmentation processing according to the transmission unit size and transmission rules required by the network transmission protocol to obtain a data packet suitable for transmission. For example, when the TCP network transmission protocol transmits data, the data stream to be transmitted needs to be segmented into segments of appropriate length, and the maximum transmission segment size is usually limited by the maximum transmission unit of the data link layer of the network to which the computer is connected. Then TCP The data packet is transmitted to the IP layer, and the IP layer transmits the data packet to the TCP layer of the receiving entity through the network. Of course, the specific processing method is not limited, as long as the requirements of the transmission protocol are met. Recording the field information about the communication protocol in the data packet as the first identification information of the first event, specifically, the data packet is a transmission unit that performs network transmission by using a communication protocol, and carries information related to enabling the data receiving device to identify the data packet. . For example, information related to a communication protocol, size information of a packet itself, and the like can uniquely identify information of the packet. Specifically, the field information about the communication protocol generally includes: address information of the data packet transmitting device and the receiving device, port number information of the sending device and the receiving device, a serial number of the data packet, and the like, which can uniquely identify the data packet. Taking the TCP transmission protocol as an example, the field information about the communication protocol in the data packet generally includes: a sequence number of the first byte, an Acknowledgment Number, and an address of the sending device and the receiving device ( IP address), the port number of the sending device and the receiving device, and so on. Record the field information about the communication protocol in the data packet. Specifically, it can be recorded by function or by other means, usually recorded in the log of the first event. Of course, the specific recording method and recording position are not limited. The first event includes sending the data packet to the second device by using a communication protocol, where the first event occurs in the first device, and the first device may transmit a data packet to the second device by using the network communication protocol, where The completion of an event, including the transmission of the data packet from the first device to the second device. The data packet is sent to the second device by using a communication protocol. Specifically, the data packet can be sent to the second device by satisfying the required communication protocol, and the specific communication protocol is not limited, and may be, for example, a TCP protocol or other communication. protocol.

参考图6所示，优选地，在第一设备端将计算设备间事件相关联的方法还包括：Referring to FIG. 6, preferably, the method for associating inter-device computing events on the first device side further includes:

在第一设备的内核中***用于记录第一事件的第一标识信息的第一模块；Inserting, in a kernel of the first device, a first module for recording first identification information of the first event;

其中，将数据包中关于通信协议的字段信息记为第一事件的第一标识信息包括：The first identifier information that records the field information about the communication protocol in the data packet as the first event includes:

执行第一模块，以记录第一事件的第一标识信息，其中，第一事件包括通过通信协议将数据包发送至第二设备。Executing a first module to record first identification information of the first event, where the first event includes The data packet is transmitted to the second device through a communication protocol.

在该实施例中，在第一设备的内核中***用于记录第一事件的第一标识信息的第一模块，具体地，第一设备具有内核与用户空间时，若要与其它设备进行数据传输，便需要将用户空间的数据包传输至内核中，通过内核将数据包传输至其它设备的内核(若有)中，来完成数据在设备间的传输。其中的第一模块用于记录第一事件的第一标识信息，第一模块可以为函数、代码等运行单元，只要能够将第一事件的第一标识信息进行记录便满足要求。第一设备的内核设置有应用程序编程接口，用户在第一设备应用层需要发送数据包时，需要通过执行对应接口的发包模块，才可以将数据包从第一设备的应用层传至其内核中。具体地，第一模块可以设置在发包模块中，也可设置在内核的发包模块外，发包模块可为发包函数，也可为实现发送数据包请求的其它运行单元。执行第一模块，以记录第一事件的第一标识信息，具体地，第一事件的第一标识信息通过第一模块的运行进行记录。其中，第一模块的运行需要发包模块的触发。第一模块可以通过预处理，预先设置其与发包模块的关系，例如，第一模块可以预先嵌入发包模块内的位置，也可设置在发包模块外面，只要运行发包模块能够触发第一模块运行即可。例如，第一模块预先嵌入发包模块运行过程中的某具***置，在发包模块运行至此处时，便触发第一模块，运行第一模块将第一事件的第一标识信息进行记录。In this embodiment, a first module for recording first identification information of the first event is inserted in a kernel of the first device. Specifically, when the first device has a kernel and a user space, data is to be performed with other devices. For transmission, the data packet of the user space needs to be transmitted to the kernel, and the data packet is transmitted to the kernel (if any) of the other device through the kernel to complete the transmission of data between the devices. The first module is configured to record the first identification information of the first event, and the first module may be an operation unit such as a function or a code, as long as the first identification information of the first event can be recorded to meet the requirement. The kernel of the first device is provided with an application programming interface. When the first device application layer needs to send a data packet, the user needs to execute the corresponding module of the corresponding interface to transmit the data packet from the application layer of the first device to the kernel. in. Specifically, the first module may be disposed in the sending module, or may be disposed outside the sending module of the kernel, and the sending module may be a sending function, or may be another running unit that implements sending a data packet request. The first module is executed to record the first identification information of the first event. Specifically, the first identification information of the first event is recorded by running the first module. The operation of the first module requires the triggering of the sending module. The first module may pre-set its relationship with the delivery module by pre-processing. For example, the first module may be pre-embedded in the location within the delivery module, or may be disposed outside the delivery module, as long as the running delivery module can trigger the operation of the first module. can. For example, the first module is pre-embedded in a specific location during the running process of the delivery module, and when the delivery module runs to here, the first module is triggered, and the first module is operated to record the first identification information of the first event.

参考图6所示，更优选地，S2中将数据包中关于通信协议的字段信息记为第一事件的第一标识信息包括：Referring to FIG. 6 , more preferably, the first identification information that records the field information about the communication protocol in the data packet as the first event in S2 includes:

当接收到数据包的发送请求时，执行第一模块，以记录第一事件的第一标识信息，其中，第一事件包括通过通信协议将数据包发送至第二设备。When receiving the sending request of the data packet, the first module is executed to record the first identification information of the first event, wherein the first event comprises sending the data packet to the second device by using a communication protocol.

在该实施例中，当接收到数据包的发送请求时，执行第一模块，以记录第一事件的第一标识信息。具体地，第一设备具有内核与用户空间时，若要与其它设备进行数据传输，便需要通过将用户空间的数据包传输至内核中，通过内核将数据包传输至其它设备的内核(若有)中，来完成数据在设备间的传输。第一设备的内核设置有应用程序编程接口，用户在第一设备应用层需要发送数据包时，需要通过执行对应接口的发包模块，才可以将数据包从第一设备的应用层传至其内核中。其中数据包的发送请求可以为发包模块的运行请求，也可为发包模块运行的同时产生的请求等，只要是来自用户空间的数据发送请求，具体的请求发出方式不做限制，发送时间也不做限制，只要满足能够执行第一模块，以记录下第一事件的第一标识信息即可。可通过如下具体方式实现对执行第一模块的触发，第一模块可以设置在发包模块中，也可设置在内核的发包模块外，发包模块可为发包函数，也可为实现发送数据包请求的其它运行单元。执行第一模块，以记录第一事件的第一标识信息，具体地，第一事件的第一标识信息通过第一模块的运行进行记录。其中，第一模块的运行需要发包模块的触发。第一模块可以通过预处理，预先设置其与发包模块的关系，例如，第一模块可以预先嵌入发包模块内的位置，也可设置在发包模块外面，只要运行发包模块能够触发第一模块运行即可。例如，第一模块预先嵌入发包模块运行过程中的某具***置，在发包模块运行至此处时，便触发第一模块，运行第一模块将第一事件的第一标识信息进行记录。In this embodiment, when receiving the transmission request of the data packet, the first module is executed to record the first identification information of the first event. Specifically, when the first device has a kernel and a user space, if data transmission is to be performed with other devices, the data packet of the user space is transmitted to the kernel, and the data packet is transmitted to the kernel of the other device through the kernel (if any) ), to complete the data between devices Transmission. The kernel of the first device is provided with an application programming interface. When the first device application layer needs to send a data packet, the user needs to execute the corresponding module of the corresponding interface to transmit the data packet from the application layer of the first device to the kernel. in. The sending request of the data packet may be a running request of the sending module, or a request generated by the sending module, and the like, as long as it is a data sending request from the user space, the specific request sending manner is not limited, and the sending time is not A limitation is made as long as the first module capable of executing the first module is recorded to record the first identification information of the first event. The triggering of executing the first module may be implemented in the following specific manner. The first module may be set in the sending module, or may be set outside the sending module of the kernel, and the sending module may be a sending function, or may be configured to send a data packet request. Other operating units. The first module is executed to record the first identification information of the first event. Specifically, the first identification information of the first event is recorded by running the first module. The operation of the first module requires the triggering of the sending module. The first module may pre-set its relationship with the delivery module by pre-processing. For example, the first module may be pre-embedded in the location within the delivery module, or may be disposed outside the delivery module, as long as the running delivery module can trigger the operation of the first module. can. For example, the first module is pre-embedded in a specific location during the running process of the delivery module, and when the delivery module runs to here, the first module is triggered, and the first module is operated to record the first identification information of the first event.

参图6所示，本申请所提供的在第二设备端将计算设备间事件相关联的方法包括：As shown in FIG. 6, the method for associating computing device events on the second device side provided by the present application includes:

S4，接收第一设备通过通信协议所发送的数据包。S4. Receive a data packet sent by the first device by using a communication protocol.

S5，将数据包中关于通信协议的字段信息记为第二事件的第二标识信息，其中，第二事件包括接收第一设备通过通信协议发送的数据包。S5, the field information about the communication protocol in the data packet is recorded as the second identification information of the second event, where the second event includes receiving the data packet sent by the first device by using the communication protocol.

在该实施例中，第二设备接收第一设备通过通信协议所发送的数据包，具体地，根据通信协议的数据传输规则接收符合要求的数据包，例如，若通过TCP传输协议进行的数据传输，需要满足TCP协议的传输格式，传输策略等。将数据包中关于通信协议的字段信息记为第二事件的第二标识信息，具体地，数据包作为通过通信协议进行网络传输的传输单元，其携带有使数据接收设备识别数据包的相关信息。例如，与通信协议相关的信息，数据包本身的大小信息等能够唯一标识该数据包的信息。具体地，关于通信协议的字段信息一般包括：数据包发送设备与接收设备的地址信息、发送设备与接收设备的端口号信息、数据包的序列号等能够唯一标识该数据包的信息。以TCP传输协议为例，其中数据包中的关于通信协议的字段信息一般包括：第一个字节的序列号(Sequence Number)、确认序列号(Acknowledgment Number)、发送设备与接收设备的地址(IP地址)、发送设备与接收设备的端口号等。将数据包中关于通信协议的字段信息进行记录，并作为第二事件的第二标识信息。具体地，可通过函数记录，也可通过其它方式记录，通常记录在第二事件的日志中。当然，具体的记录方式以及记录位置也不做限制。其中，第二事件包括接收第一设备通过通信协议发送的数据包，此处，第二事件发生在第二设备中，可表示第二设备接收了第一设备通过网络通信协议所传输的一个数据包，第二事件的完成，包括第二设备接收了来自第一设备的一个数据包。In this embodiment, the second device receives the data packet sent by the first device through the communication protocol, and specifically, receives the data packet that meets the requirements according to the data transmission rule of the communication protocol, for example, if the data transmission is performed through the TCP transmission protocol. It needs to meet the transmission format and transmission strategy of the TCP protocol. Recording the field information about the communication protocol in the data packet as the second identification information of the second event, specifically, the data packet is a transmission unit that performs network transmission by using a communication protocol, and carries information related to enabling the data receiving device to identify the data packet. . For example, information related to communication protocols, data packet Information such as size information of the body can uniquely identify the data packet. Specifically, the field information about the communication protocol generally includes: address information of the data packet transmitting device and the receiving device, port number information of the sending device and the receiving device, a serial number of the data packet, and the like, which can uniquely identify the data packet. Taking the TCP transmission protocol as an example, the field information about the communication protocol in the data packet generally includes: a sequence number of the first byte, an Acknowledgment Number, and an address of the sending device and the receiving device ( IP address), the port number of the sending device and the receiving device, and so on. The field information about the communication protocol in the data packet is recorded and used as the second identification information of the second event. Specifically, it can be recorded by function or by other means, and is usually recorded in the log of the second event. Of course, the specific recording method and recording position are not limited. The second event includes receiving a data packet sent by the first device by using a communication protocol, where the second event occurs in the second device, and the second device may receive the data that the first device transmits through the network communication protocol. The packet, the completion of the second event, includes the second device receiving a data packet from the first device.

参图6所示，在其中一个实施例中，本申请所提供的在第二设备端将计算设备间事件相关联的方法还包括：As shown in FIG. 6, in one embodiment, the method for associating computing device events on the second device side provided by the present application further includes:

将数据包发送至第二设备中的对应目标应用。The data packet is sent to a corresponding target application in the second device.

在该实施例中，由于数据包的传输需求来自于用户操作应用程序的需求，相应地，第一设备根据用户操作应用程序时的需要，将数据包传输至第二设备，第二设备接收到该数据包后，需要将数据包内容发送至第二设备中的对应目标应用。具体地，可通过第二设备用户空间的目标应用程序从第二设备的内核里读出数据包，完成整个数据的单向传输过程。当然，将数据包发送至第二设备中的目标应用的具体方式不做限制，只要满足需求即可，例如若第二设备没有内核，那么数据包发送至目标应用程序的方式便会不同。In this embodiment, since the transmission requirement of the data packet comes from the requirement of the user operating the application, accordingly, the first device transmits the data packet to the second device according to the needs of the user when the application program is operated, and the second device receives the data packet. After the data packet, the content of the data packet needs to be sent to the corresponding target application in the second device. Specifically, the data packet can be read from the kernel of the second device through the target application of the second device user space, and the one-way transmission process of the entire data is completed. Of course, the specific manner of sending the data packet to the target application in the second device is not limited as long as the requirement is met. For example, if the second device does not have a kernel, the manner in which the data packet is sent to the target application is different.

参图6所示，优选地，本申请所提供的在第二设备端将计算设备间事件相关联的方法还包括：As shown in FIG. 6, the method for associating computing device events on the second device side provided by the present application further includes:

在第二设备的内核中***用于记录第二事件的第二标识信息的第二模块；Inserting a second mode for recording second identification information of the second event in a kernel of the second device Piece;

其中，将数据包中关于通信协议的字段信息记为第二事件的第二标识信息包括：The second identifier information that records the field information about the communication protocol in the data packet as the second event includes:

执行第二模块，以记录第二事件的第二标识信息，其中，第二事件包括接收第一设备通过通信协议发送的数据包。Executing a second module to record second identification information of the second event, where the second event comprises receiving a data packet sent by the first device by using a communication protocol.

在该实施例中，在第二设备的内核中***用于记录第二事件的第二标识信息的第二模块。其中的第二模块用于记录第二事件的第二标识信息，第二模块可以为函数、代码等运行单元，只要能够将第二事件的第二标识信息进行记录便满足要求。具体地，第二设备具有内核与用户空间时，若要与其它设备进行数据传输，第二设备的内核接收到的来自第一设备内核的数据包，还需要发送至用户空间，以实现数据包的互动传输。其中的第二模块用于记录第二事件的第二标识信息，第二模块可以为函数、代码等运行单元，只要能够将第二事件的第二标识信息进行记录便满足要求。In this embodiment, a second module for recording second identification information of the second event is inserted in the kernel of the second device. The second module is configured to record the second identification information of the second event, and the second module may be an operation unit such as a function or a code, as long as the second identification information of the second event can be recorded. Specifically, when the second device has a kernel and a user space, if data is to be transmitted with other devices, the data packet received by the kernel of the second device from the core of the first device needs to be sent to the user space to implement the data packet. Interactive transmission. The second module is configured to record the second identification information of the second event, and the second module may be an operation unit such as a function or a code, as long as the second identification information of the second event can be recorded.

继续在该实施例中，第二设备的内核设置有应用程序编程接口，用户在第二设备接收到来自第一设备的数据包时，需要通过执行对应接口的收包模块，才可以将数据包从第二设备的内核传至其用户空间。具体地，第二模块可以设置在收包模块中，也可设置在内核的收包模块外，收包模块可为收包函数，也可为实现接收数据包请求的其它运行单元。执行第二模块，以记录第二事件的第二标识信息，具体地，第二事件的第二标识信息通过第二模块的运行进行记录。其中，第二模块的运行需要收包模块的触发。第二模块可以通过预处理，预先设置其与收包模块的关系，例如，第二模块可以预先嵌入收包模块内的位置，也可设置在收包模块外面，只要运行收包模块能够触发第二模块运行即可。例如，第二模块预先嵌入收包模块运行过程中的某具***置，在收包模块运行至此处时，便触发第二模块，运行第二模块将第二事件的第二标识信息进行记录。Continuing in this embodiment, the kernel of the second device is provided with an application programming interface. When the second device receives the data packet from the first device, the user needs to execute the packet receiving module of the corresponding interface. Passed from the core of the second device to its user space. Specifically, the second module may be disposed in the receiving module, or may be disposed outside the receiving module of the kernel, and the receiving module may be a receiving function, or may be another operating unit that implements receiving the data packet request. The second module is executed to record the second identification information of the second event. Specifically, the second identification information of the second event is recorded by the operation of the second module. The operation of the second module requires the triggering of the receiving module. The second module can pre-set the relationship between the second module and the receiving module. For example, the second module can be embedded in the location of the receiving module in advance, or can be set outside the receiving module, as long as the running receiving module can trigger the first The second module can be run. For example, the second module is pre-embedded in a specific location during the operation of the receiving module. When the receiving module runs here, the second module is triggered, and the second module is operated to record the second identification information of the second event.

参图6所示，优选地，S5中将数据包中关于通信协议的字段信息记为第二事件的第二标识信息包括：Referring to FIG. 6, preferably, in S5, the field information about the communication protocol in the data packet is recorded as the first The second identification information of the second event includes:

在接收到数据包时，执行第二模块，以记录第二事件的第二标识信息，其中，第二事件包括接收第一设备通过通信协议发送的数据包。When receiving the data packet, the second module is executed to record the second identification information of the second event, wherein the second event comprises receiving the data packet sent by the first device by using the communication protocol.

在该实施例中，在接收到数据包时，执行第二模块，以记录第二事件的第二标识信息。具体地，第二设备具有内核与用户空间时，若要与其它设备进行数据传输，第二设备的内核接收到的来自第一设备内核的数据包，还需要发送至用户空间，以实现数据包的互动传输。第二设备的内核设置有应用程序编程接口，用户在第二设备内核接收到来自第一设备内核的数据包时，需要通过执行对应接口的收包模块，才可以将数据包从第二设备的内核传至其用户空间中。其中接收数据包的请求可以为收包模块的运行请求，也可为收包模块运行的同时产生的请求等，只要是来自第二设备内核的数据接收请求，具体的请求发出方式不做限制，发送时间也不做限制，只要满足能够执行第二模块，以记录下第二事件的第二标识信息即可。可通过如下具体方式实现对执行第二模块的触发，第二模块可以设置在收包模块中，也可设置在内核的收包模块外，收包模块可为收包函数，也可为实现接收数据包请求的其它运行单元。执行第二模块，以记录第二事件的第二标识信息，具体地，第二事件的第二标识信息通过第二模块的运行进行记录。其中，第二模块的运行需要收包模块的触发。第二模块可以通过预处理，预先设置其与收包模块的关系，例如，第二模块可以预先嵌入收包模块内的位置，也可设置在收包模块外面，只要运行收包模块能够触发第二模块运行即可。例如，第二模块预先嵌入收包模块运行过程中的某具***置，在收包模块运行至此处时，便触发第二模块，运行第二模块将第二事件的第二标识信息进行记录。In this embodiment, upon receiving the data packet, the second module is executed to record the second identification information of the second event. Specifically, when the second device has a kernel and a user space, if data is to be transmitted with other devices, the data packet received by the kernel of the second device from the core of the first device needs to be sent to the user space to implement the data packet. Interactive transmission. The kernel of the second device is provided with an application programming interface. When the user receives the data packet from the first device core, the user needs to execute the corresponding module of the corresponding interface, so that the data packet can be sent from the second device. The kernel is passed to its user space. The request for receiving the data packet may be a running request of the receiving module, or a request generated by the receiving module, and the like, as long as the data receiving request is from the second device core, the specific request sending manner is not limited. The sending time is also not limited as long as the second identification module capable of executing the second module is recorded to record the second identification information of the second event. The triggering of executing the second module may be implemented in the following specific manner. The second module may be set in the receiving module, or may be disposed outside the receiving module of the kernel, and the receiving module may be a receiving function or receiving Other runtime units for packet requests. The second module is executed to record the second identification information of the second event. Specifically, the second identification information of the second event is recorded by the operation of the second module. The operation of the second module requires the triggering of the receiving module. The second module can pre-set the relationship between the second module and the receiving module. For example, the second module can be embedded in the location of the receiving module in advance, or can be set outside the receiving module, as long as the running receiving module can trigger the first The second module can be run. For example, the second module is pre-embedded in a specific location during the operation of the receiving module. When the receiving module runs here, the second module is triggered, and the second module is operated to record the second identification information of the second event.

如图6所示，本申请所提供的在第三设备端将计算设备间事件相关联的方法包括：As shown in FIG. 6, the method for associating computing device events on a third device side provided by the present application includes:

S6，从第一设备获取第一事件及对应的第一标识信息。S6. Acquire a first event and corresponding first identification information from the first device.

S7，从第二设备获取与第一事件相关联的第二事件，其中，第一事件的第一标识信息与第二事件的第二标识信息相等且对应相同的通信协议。S7. Acquire, from the second device, a second event associated with the first event, where the first event The first identification information is equal to the second identification information of the second event and corresponds to the same communication protocol.

在该实施例中，第三设备用于对前述第一事件及第二事件进行关联，第三双设备可设置在第一设备中，也可设置在第二设备中，也可单独设置。从第一设备获取第一事件及对应的第一标识信息，具体地，可在第一设备上查找到需要关联的第一事件的第一标识信息，例如，可在第一设备上的事件日志上查找第一事件对应的第一标识信息。一般第一设备的事件日志记录在第一设备的存储器或者磁盘等中，直接去相应的存储位置查找读取即可。第三设备在第一设备上查找第一事件对应的第一标识信息的具体时间，可以为实时查找，也可以为间隔一定的预设时间进行查找，也可以根据用户的需求，在用户需要对第一设备、第二设备等组成的***的性能进行分析或者测试时进行查找，具体查找时间不做限制。从第二设备获取与第一事件相关联的第二事件，具体地，依据第一事件的第一标识信息，在第二设备上查找到与第一标识信息相等的第二标识信息，并对应至第二事件，例如，可在第二设备上的事件日志上查找与第一标识信息相等的第二标识信息。一般第二设备中的事件日志记录在第二设备的存储器或者磁盘等中，直接去相应的存储位置查找读取即可。通过查找到的第二标识信息，进一步找到其对应的第二事件，并获取第二事件，此时第一事件与第二事件相关联。第一事件的第一标识信息与第二事件的第二标识信息相等且对应相同的通信协议，具体地，由于第一事件为第一设备向第二设备发送一个数据包，第二事件为第二设备接收第一设备所发送的数据包，第一事件的第一标识信息与第二事件的第二标识信息，为同一个数据包的与通信协议相关的信息，故第一标识信息与第二标识信息相等并且对应相同的通信协议。In this embodiment, the third device is configured to associate the foregoing first event and the second event, and the third dual device may be disposed in the first device, or may be disposed in the second device, or may be separately set. Acquiring the first event and the corresponding first identifier information from the first device, specifically, the first identifier information of the first event that needs to be associated may be found on the first device, for example, an event log that can be on the first device Searching for the first identification information corresponding to the first event. Generally, the event log of the first device is recorded in the memory or the disk of the first device, and can be directly read and read by the corresponding storage location. The specific time for the third device to search for the first identifier information corresponding to the first event on the first device may be a real-time search, or may be searched for a preset time interval, or may be required by the user according to the user's needs. The performance of the system composed of the first device, the second device, and the like is analyzed or tested, and the specific search time is not limited. Acquiring, by the second device, the second event that is associated with the first event, and specifically, searching for the second identifier information that is equal to the first identifier information on the second device according to the first identifier information of the first event, and corresponding To the second event, for example, the second identification information equal to the first identification information may be searched for on the event log on the second device. Generally, the event log in the second device is recorded in the memory or the disk of the second device, and can be directly read and read by the corresponding storage location. The second identifier is further found by the found second identifier information, and the second event is obtained, and the first event is associated with the second event. The first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. Specifically, because the first event is that the first device sends a data packet to the second device, the second event is The second device receives the data packet sent by the first device, and the first identifier information of the first event and the second identifier information of the second event are information related to the communication protocol of the same data packet, so the first identifier information and the first identifier information The two identification information are equal and correspond to the same communication protocol.

继续在该实施例中，也可从第二设备中获取第二事件及对应的第二标识信息，然后从第一设备获取与第二事件相关联的第一事件，其中第二事件的第二标识信息与第一事件的第一标识信息相等且对应相同的通信协议。其具体的实现方式，与该实施例前部分的实质原理相同，在此不再赘述。 Continuing in this embodiment, the second event and the corresponding second identification information may also be obtained from the second device, and then the first event associated with the second event is acquired from the first device, wherein the second event is the second The identification information is equal to the first identification information of the first event and corresponds to the same communication protocol. The specific implementation of the previous embodiment is the same as that of the previous part of the embodiment, and details are not described herein again.

参图6所示，优选地，S7中从第二设备获取与第一事件相关联的第二事件包括：As shown in FIG. 6, preferably, acquiring, in S7, the second event associated with the first event from the second device includes:

根据第一事件的第一标识信息，在第二设备中查找与第一标识信息相等且对应相同的通信协议的标识信息，其中，查找到的标识信息为第二标识消息。And identifying, according to the first identifier information of the first event, the identifier information of the communication protocol that is equal to the first identifier information and corresponding to the same, and the identifier information that is found is the second identifier message.

获取第二标识信息对应的第二事件。Obtaining a second event corresponding to the second identifier information.

在该实施例中，根据第一事件的第一标识信息，在第二设备中查找与第一标识信息相等且对应相同的通信协议的标识信息，其中，查找到的标识信息为第二标识消息。一般地，事件的标识信息记录在事件的日志中，根据第一标识信息的具体内容，在第二设备的事件日志中查找具有相等内容的标识信息，查找到的标识信息即为第二标识信息，本领域的技术人员应当能够理解，此处的具体查找方式不做限制。获取第二标识信息对应的第二事件，具体地，通过第二标识信息可获取第二事件的处理过程情况、处理时间、处理结果等与第二事件相关的信息。可通过运行相关函数进行读取的方式，也可通过比较判断的方式等等进行获取，本领域的技术人员应当能够理解，此处的具体获取第二事件的方式并不做限制。In this embodiment, the identifier information of the communication protocol that is equal to the first identifier information and corresponds to the same is searched for, according to the first identifier information of the first event, where the found identifier information is the second identifier message. . Generally, the identifier information of the event is recorded in the log of the event, and the identifier information of the second device is found in the event log of the second device according to the specific content of the first identifier information, and the identifier information that is found is the second identifier information. Those skilled in the art should be able to understand that the specific search method herein is not limited. Acquiring the second event corresponding to the second identifier information, specifically, the information related to the second event, such as the processing status of the second event, the processing time, the processing result, and the like, may be acquired by using the second identifier information. It can be obtained by running the correlation function, or by comparing the judgment manner, etc., and those skilled in the art should be able to understand that the specific manner of obtaining the second event herein is not limited.

在其中一个实施例中，第一标识信息与第二标识信息的记录时间满足预定的时间间隔阈值。In one of the embodiments, the recording time of the first identification information and the second identification information satisfies a predetermined time interval threshold.

在该实施例中，主要针对依据第一标识信息在第二设备中查到了与第一标识信息相等并且对应相同的通信协议的多个标识信息的情况。此时还需要从这些标识信息中找到与第一标识信息对应的第二标识信息，具体地，需要借助标识信息的记录时间实现，即在第二设备上查到的与第一标识信息相等并且对应相同的通信协议的多个标识信息中，查找记录时间与第一标识信息的记录时间满足预设阈值间隔的标识信息，为第二标识信息。例如，预设时间间隔阈值为0-500毫秒，也即记录第一标识信息与第二标识信息的时间点间隔要在500毫秒范围内。在第二设备上查找到3个与第一标识信息相等并且对应相同的通信协议的标识信息，其中，3个标识信息的记录时间与第一标识信息的记录时间间隔分别为1分钟、100毫秒、10分钟，很明显时间间隔为100毫秒的标识信息为第二标识信息。时间间隔阈值根据需要进行设定。In this embodiment, it is mainly for the case that a plurality of pieces of identification information of the communication protocol equal to the first identification information and corresponding to the same identity information are found in the second device according to the first identification information. In this case, the second identification information corresponding to the first identification information needs to be found from the identification information, and specifically, the recording time of the identification information needs to be implemented, that is, the first identification information is equal to that found on the second device and And the identification information that the recording time and the recording time of the first identification information meet the preset threshold interval is the second identification information. For example, the preset time interval threshold is 0-500 milliseconds, that is, the time point interval for recording the first identification information and the second identification information is within a range of 500 milliseconds. Finding 3 equals to the first identification information on the second device And corresponding to the identification information of the same communication protocol, wherein the recording time interval of the three identification information and the recording time interval of the first identification information are 1 minute, 100 milliseconds, and 10 minutes, respectively, and the identification information with an apparent time interval of 100 milliseconds is Second identification information. The time interval threshold is set as needed.

继续在该实施例中，第一标识信息与第二标识信息的记录时间满足预定的时间间隔阈值，还可以在找到的与第一标识信息相等并且对应相同的通信协议的多个标识信息中，排除明显不符合成为第二标识信息的情况，例如，仍预设时间间隔阈值为0-500毫秒，在第二设备上查找到3个与第一标识信息相等并且对应相同的通信协议的标识信息，其中，3个标识信息的记录时间与第一标识信息的记录时间间隔分别为60毫秒、400毫秒、10分钟，此时时间间隔为10分钟的标识信息明显不符合要求，而剩下的时间间隔为60毫秒及400毫秒的标识信息可通过时间间隔最接近的方式筛选出第二标识信息，也可借助其他方式实现进一步的筛选。再例如，仍预设时间间隔阈值为0-500毫秒，在第二设备上查找到个与第一标识信息相等并且对应相同的通信协议的标识信息，其中，该标识信息的记录时间与第一标识信息的记录时间间隔为20分钟，该标识信息明显不符合要求，则可认为在第二设备上未找到符合要求的第二标识信息。Continuing in this embodiment, the recording time of the first identification information and the second identification information meets a predetermined time interval threshold, and may also be found in the plurality of identification information of the communication protocol that is equal to the first identification information and corresponds to the same communication protocol. Excluding the case that the second identification information is obviously not met, for example, the preset time interval threshold is 0-500 milliseconds, and three identification information of the communication protocol that is equal to the first identification information and corresponding to the same is found on the second device. Wherein, the recording time interval of the three identification information and the recording time interval of the first identification information are respectively 60 milliseconds, 400 milliseconds, and 10 minutes, and the identification information of the time interval of 10 minutes obviously does not meet the requirement, and the remaining time The identification information with an interval of 60 milliseconds and 400 milliseconds can filter the second identification information in the closest manner to the time interval, and further screening can be implemented by other means. For example, the preset time interval threshold is 0-500 milliseconds, and the identification information of the communication protocol that is equal to the first identification information and corresponds to the same communication protocol is found on the second device, where the recording time of the identification information is first The recording time interval of the identification information is 20 minutes. If the identification information obviously does not meet the requirements, it may be considered that the second identification information that meets the requirement is not found on the second device.

另外，需要指出的是，在该实施例中的所有时间点值及时间间隔阈值等，均是在第一设备与第二设备所在***的所有设备时间同步的情况下进行的记录、比较等。具体***内部设备间的时间同步方法不做限制。In addition, it should be noted that all time point values, time interval thresholds, and the like in this embodiment are records, comparisons, and the like performed when the first device is synchronized with all devices of the system in which the second device is located. The time synchronization method between the internal devices of the specific system is not limited.

如图7所示，展示了本申请提供的将计算设备间事件相关联的方法的又一实施例，该方法在如图6所示的实施例基础上还包括：As shown in FIG. 7, another embodiment of a method for associating computing device events provided by the present application is shown. The method further includes:

S8，将第二设备上的第三事件与第一事件相关联，其中，第三事件与第二事件相关联。S8. Associate a third event on the second device with the first event, where the third event is associated with the second event.

S9，将关联所得的事件集合输出给用户，其中，事件集合包括第一事件及与第一事件相关联的事件。S9. Output the associated event collection to the user, where the event collection includes the first event and an event associated with the first event.

在该实施例中，S8主要针对事件在同一个设备内部进行关联的情况，第三事件与第二事件均发生在第二设备上，第二事件与第三事件的关联为同一设备内部的关联，具体地，可通过线程ID等方式进行关联，本领域的技术人员应当能够理解设备内部事件关联的方式并不做具体限制。其中第一设备上的第一事件与第二设备上的第三事件进行关联，是通过第一事件与第二事件关联、第二事件与第三事件关联后，第一事件通过第二事件与第三事件进行关联。尤其是在分布式***中，需要关联的事件位于很多台设备上，要将很多个相关联的事件关联起来，就即需要设备内部事件的关联，又需要设备间事件的关联，以实现最终所有相关联事件的关联。具体地，将第二设备上的第三事件与第一设备上的第一事件相关联，首先，需要通过线程ID将第二设备上第三事件与第二事件进行关联，再通过前述第一事件与第二事件进行关联的方式，将第二事件与第一事件进行关联，最终实现第一事件、第二事件、第三事件的关联。In this embodiment, S8 is mainly for the case where an event is associated within the same device, The third event and the second event are both performed on the second device, and the association between the second event and the third event is an association within the same device. Specifically, the association may be performed by using a thread ID or the like, and those skilled in the art should be able to understand The way in which the internal events of the device are associated is not specifically limited. The first event on the first device is associated with the third event on the second device, and the first event is associated with the second event, and the second event is associated with the third event, and the first event is passed through the second event. The third event is related. Especially in a distributed system, the events that need to be associated are located on many devices. To associate a large number of related events, the association between the internal events of the device is required, and the association of events between devices is required to achieve the final The association of associated events. Specifically, the third event on the second device is associated with the first event on the first device. First, the third event on the second device needs to be associated with the second event by using the thread ID, and then the first The manner in which the event is associated with the second event, the second event is associated with the first event, and finally the association of the first event, the second event, and the third event is achieved.

继续在该实施例中，将关联所得的事件集合输出给用户，具体地，将关联事件关联后的结果输出给用户，例如，当一个分布式***总是运行缓慢，用户需要对该***进行性能测试或者查找问题的原因，若该分布式***包括三个设备A、B、C，数据需要在此三个设备上进行传输，在A设备上发生了第一事件，在B设备上发生了第二事件及第三事件，在C设备上发生了第***，第一事件至第***为关联事件，那么根据用户需要查找该***运行缓慢的原因时，需要分别查找第一事件的数据包发送时空信息，例如发送时间点、发送位置，第二事件接收第一事件发送的数据包的时空信息，以此类推。若发现其中有的事件的发送\接收数据包的时空信息不符合预设的阈值，那么可以判断出，***中执行该事件的设备出现了问题，还可以根据读取的相关具体信息，进一步分析问题的原因。Continuing in this embodiment, the associated event set is output to the user, specifically, the result of associating the associated event is output to the user. For example, when a distributed system is always running slowly, the user needs to perform performance on the system. Test or find the cause of the problem. If the distributed system includes three devices A, B, and C, the data needs to be transmitted on the three devices. The first event occurs on the A device, and the second device occurs on the B device. In the second event and the third event, a fourth event occurs on the C device, and the first event to the fourth event are associated events. When the user needs to find the reason for the slow operation of the system, the data packet of the first event needs to be separately searched. Send spatio-temporal information, such as the transmission time point, the transmission location, the second event receives the spatio-temporal information of the data packet sent by the first event, and so on. If it is found that the spatio-temporal information of the sending/receiving data packet of the event does not meet the preset threshold, it can be determined that there is a problem in the device that executes the event in the system, and further analysis can be performed according to the specific information read. The cause of the problem.

另外，在如图6-7所示的两个实施例中的步骤并不要求按照上述书写顺序完成，其中有些步骤的顺便是不限制的，甚至可以同步。In addition, the steps in the two embodiments shown in Figures 6-7 are not required to be completed in the above-described writing sequence, and the steps of some of the steps are not limited and may even be synchronized.

与现有技术相比，本申请的用于将计算机设备间事件相关联的方法，在从第一设备向第二设备传输数据时，第一设备记录其中第一事件的第一标识信息，第二设备记录其中第二事件的第二标识信息，由于第一标识信息与第二标识信息为第一设备传输至第二设备的同一个数据包的特征信息，故二者相等。由于第一事件的第一标识信息与第二事件的第二标识信息相等且对应相同的通信协议，第三设备从第一设备获取第一事件及对应的第一标识信息，依据第一事件的第一标识信息获取与第一事件相关联的第二事件，便可以将位于不同设备上的第一事件与第二事件进行关联。本申请的用于将计算机设备间事件相关联的***包括前述第一设备、第二设备及第三设备。采用本申请的将计算机设备间事件相关联的方法及设备，可以在不修改网络通讯库，不改变网络数据包内容，不使用全局唯一性ID的前提下，对发送在多台计算机上的事件进行关联。一方面，对于不能修改网络通讯库的服务软件来说，仍然可以进行事件关联。另一方面，也避免了代价较大的全局唯一性ID的产生，节省了计算资源。Compared with the prior art, the method for associating events between computer devices of the present application is When the data is transmitted from the first device to the second device, the first device records the first identifier information of the first event, and the second device records the second identifier information of the second event, where the first identifier information and the second identifier information The feature information of the same data packet transmitted by the first device to the second device is equal. The third device acquires the first event and the corresponding first identification information from the first device, according to the first event, because the first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. The first identification information acquires a second event associated with the first event, and the first event located on the different device can be associated with the second event. The system for associating events between computer devices of the present application includes the aforementioned first device, second device, and third device. The method and device for associating events between computer devices according to the present application can send events on multiple computers without modifying the network communication library, changing the content of the network data packet, and using the global unique ID. Make an association. On the one hand, for service software that cannot modify the network communication library, event correlation can still be performed. On the other hand, the generation of a costly global unique ID is also avoided, saving computing resources.

对于本领域技术人员而言，显然本申请不限于上述示范性实施例的细节，而且在不背离本申请的精神或基本特征的情况下，能够以其他的具体形式实现本申请。因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附图标记视为限制所涉及的权利要求。此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。装置权利要求中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第一，第二等词语用来表示名称，而并不表示任何特定的顺序。 It is obvious to those skilled in the art that the present application is not limited to the details of the above-described exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Therefore, the present embodiments are to be considered as illustrative and not restrictive, and the scope of the invention is defined by the appended claims instead All changes in the meaning and scope of equivalent elements are included in this application. Any reference signs in the claims should not be construed as limiting the claim. In addition, it is to be understood that the word "comprising" does not exclude other elements or steps. A plurality of units or devices recited in the device claims may also be implemented by a unit or device by software or hardware. The first, second, etc. words are used to denote names and do not denote any particular order.

Claims

一种在第一设备端将计算设备间事件相关联的方法，其中，该方法包括：A method for associating computing device events at a first device end, wherein the method comprises:

获取待通过通信协议发送至第二设备的数据包；Obtaining a data packet to be sent to the second device by using a communication protocol;

将所述数据包中关于所述通信协议的字段信息记为第一事件的第一标识信息，其中，所述第一事件包括通过所述通信协议将所述数据包发送至所述第二设备；Recording, in the data packet, field information about the communication protocol as first identification information of a first event, where the first event includes sending the data packet to the second device by using the communication protocol ;

通过所述通信协议将所述数据包发送至所述第二设备。The data packet is transmitted to the second device by the communication protocol.
根据权利要求1所述的方法，其中，该方法还包括：The method of claim 1 wherein the method further comprises:

在所述第一设备的内核中***用于记录所述第一事件的第一标识信息的第一模块；Inserting, in a kernel of the first device, a first module for recording first identification information of the first event;

其中，所述将所述数据包中关于所述通信协议的字段信息记为第一事件的第一标识信息包括：The first identifier information that records the field information about the communication protocol in the data packet as the first event includes:

执行所述第一模块，以记录所述第一事件的第一标识信息，其中，所述第一事件包括通过所述通信协议将所述数据包发送至所述第二设备。Executing the first module to record first identification information of the first event, wherein the first event comprises sending the data packet to the second device by using the communication protocol.
根据权利要求2所述的方法，其中，所述将所述数据包中关于所述通信协议的字段信息记为第一事件的第一标识信息包括：The method according to claim 2, wherein said recording the field information about the communication protocol in the data packet as the first identification information of the first event comprises:

当接收到所述数据包的发送请求时，执行所述第一模块，以记录所述第一事件的第一标识信息，其中，所述第一事件包括通过所述通信协议将所述数据包发送至所述第二设备。When the sending request of the data packet is received, the first module is executed to record first identification information of the first event, where the first event includes the data packet by using the communication protocol Send to the second device.
一种在第二设备端将计算设备间事件相关联的方法，其中，该方法包括：A method for associating computing device events at a second device end, wherein the method includes:

接收第一设备通过通信协议所发送的数据包；Receiving a data packet sent by the first device through a communication protocol;

将所述数据包中关于所述通信协议的字段信息记为第二事件的第二标识信息，其中，所述第二事件包括接收所述第一设备通过所述通信协议发送的所述数据包。 Recording, in the data packet, field information about the communication protocol as second identifier information of the second event, where the second event includes receiving the data packet sent by the first device by using the communication protocol .
根据权利要求4所述的方法，其中，该方法还包括：将所述数据包发送至所述第二设备中的对应目标应用。The method of claim 4, wherein the method further comprises transmitting the data packet to a corresponding target application in the second device.
根据权利要求4或5所述的方法，其中，该方法还包括：The method of claim 4 or 5, wherein the method further comprises:

在所述第二设备的内核中***用于记录所述第二事件的第二标识信息的第二模块；Inserting, in a kernel of the second device, a second module for recording second identification information of the second event;

其中，所述将所述数据包中关于所述通信协议的字段信息记为第二事件的第二标识信息包括：The second identifier information that records the field information about the communication protocol in the data packet as the second event includes:

执行所述第二模块，以记录所述第二事件的第二标识信息，其中，所述第二事件包括接收所述第一设备通过所述通信协议发送的所述数据包。Executing the second module to record second identification information of the second event, where the second event comprises receiving the data packet sent by the first device by using the communication protocol.
根据权利要求6所述的方法，其中，所述将所述数据包中关于所述通信协议的字段信息记为第二事件的第二标识信息包括：The method according to claim 6, wherein the recording of the field information about the communication protocol in the data packet as the second identification information of the second event comprises:

在接收到所述数据包时，执行所述第二模块，以记录所述第二事件的第二标识信息，其中，所述第二事件包括接收所述第一设备通过所述通信协议发送的所述数据包。And when the data packet is received, the second module is configured to record second identification information of the second event, where the second event comprises receiving, by the first device, by using the communication protocol The data packet.
一种在第三设备端将计算设备间事件相关联的方法，其中，该方法包括：A method for associating computing device events at a third device end, wherein the method includes:

从第一设备获取第一事件及对应的第一标识信息；Acquiring the first event and the corresponding first identification information from the first device;

从第二设备获取与所述第一事件相关联的第二事件，其中，所述第一事件的第一标识信息与所述第二事件的第二标识信息相等且对应相同的通信协议。And acquiring, by the second device, a second event associated with the first event, where the first identification information of the first event is equal to the second identification information of the second event and corresponds to the same communication protocol.
根据权利要求8所述的方法，其中，所述从第二设备获取与所述第一事件相关联的第二事件包括：The method of claim 8, wherein the obtaining, by the second device, the second event associated with the first event comprises:

根据所述第一事件的第一标识信息，在所述第二设备中查找与所述第一标识信息相等且对应相同的通信协议的标识信息，其中，查找到的标识信息为第二标识消息；And identifying, according to the first identifier information of the first event, identifier information of a communication protocol that is equal to the first identifier information and corresponding to the same, where the found identifier information is a second identifier message. ;

获取所述第二标识信息对应的第二事件。 Obtaining a second event corresponding to the second identifier information.
根据权利要求8或9所述的方法，其中，所述第一标识信息与所述第二标识信息的记录时间满足预定的时间间隔阈值。The method according to claim 8 or 9, wherein the recording time of the first identification information and the second identification information satisfies a predetermined time interval threshold.
根据权利要求8至10中任一项所述的方法，其中，该方法还包括：The method according to any one of claims 8 to 10, wherein the method further comprises:

将所述第二设备上的第三事件与所述第一事件相关联，其中，所述第三事件与所述第二事件相关联。A third event on the second device is associated with the first event, wherein the third event is associated with the second event.
根据权利要求8至11中任一项所述的方法，其中，该方法还包括：The method according to any one of claims 8 to 11, wherein the method further comprises:

将关联所得的事件集合输出给用户，其中，所述事件集合包括所述第一事件及与所述第一事件相关联的事件。Outputting the associated set of events to the user, wherein the set of events includes the first event and an event associated with the first event.
一种用于将计算设备间事件相关联的第一设备，其中，该设备包括：A first device for associating computing device-to-device events, wherein the device comprises:

第一装置，用于获取待通过通信协议发送至第二设备的数据包；a first device, configured to acquire a data packet to be sent to the second device by using a communication protocol;

第三装置，用于将所述数据包中关于所述通信协议的字段信息记为第一事件的第一标识信息，其中，所述第一事件包括通过所述通信协议将所述数据包发送至所述第二设备；a third device, configured to record, in the data packet, field information about the communication protocol as first identifier information of a first event, where the first event includes sending the data packet by using the communication protocol To the second device;

第五装置，用于通过所述通信协议将所述数据包发送至所述第二设备。And a fifth device, configured to send the data packet to the second device by using the communication protocol.
根据权利要求13所述的设备，其中，该设备还包括：The device of claim 13, wherein the device further comprises:

第七装置，用于在所述第一设备的内核中***用于记录所述第一事件的第一标识信息的第一模块；a seventh device, configured to insert, in a kernel of the first device, a first module for recording first identification information of the first event;

其中，所述第三装置用于：Wherein the third device is used to:

执行所述第一模块，以记录所述第一事件的第一标识信息，其中，所述第一事件包括通过所述通信协议将所述数据包发送至所述第二设备。Executing the first module to record first identification information of the first event, wherein the first event comprises sending the data packet to the second device by using the communication protocol.
根据权利要求14所述的设备，其中，所述第三装置用于：The apparatus of claim 14 wherein said third means is for:

当接收到所述数据包的发送请求时，执行所述第一模块，以记录所述第一事件的第一标识信息，其中，所述第一事件包括通过所述通信协议将所述数据包发送至所述第二设备。When the sending request of the data packet is received, the first module is executed to record first identification information of the first event, where the first event includes the data packet by using the communication protocol Send to the second device.
一种用于将计算设备间事件相关联的第二设备，其中，该设备包括：A second device for associating computing device-to-device events, wherein the device comprises:

第二装置，用于接收第一设备通过通信协议所发送的数据包； a second device, configured to receive a data packet sent by the first device by using a communication protocol;

第四装置，用于将所述数据包中关于所述通信协议的字段信息记为第二事件的第二标识信息，其中，所述第二事件包括接收所述第一设备通过所述通信协议发送的所述数据包。a fourth device, configured to record, in the data packet, field information about the communication protocol as second identifier information of the second event, where the second event includes receiving, by the first device, the communication protocol The data packet sent.
根据权利要求16所述的设备，其中，该设备还包括：The device of claim 16, wherein the device further comprises:

第六装置，用于将所述数据包发送至所述第二设备中的对应目标应用。And a sixth device, configured to send the data packet to a corresponding target application in the second device.
根据权利要求16或17所述的设备，其中，该设备还包括：The device according to claim 16 or 17, wherein the device further comprises:

第八装置，用于在所述第二设备的内核中***用于记录所述第二事件的第二标识信息的第二模块；An eighth device, configured to insert, in a kernel of the second device, a second module for recording second identification information of the second event;

其中，所述第四装置用于：Wherein the fourth device is used for:

执行所述第二模块，以记录所述第二事件的第二标识信息，其中，所述第二事件包括接收所述第一设备通过所述通信协议发送的所述数据包。Executing the second module to record second identification information of the second event, where the second event comprises receiving the data packet sent by the first device by using the communication protocol.
根据权利要求18所述的方法，其中，所述第四装置用于：The method of claim 18 wherein said fourth means is for:

在接收到所述数据包时，执行所述第二模块，以记录所述第二事件的第二标识信息，其中，所述第二事件包括接收所述第一设备通过所述通信协议发送的所述数据包。And when the data packet is received, the second module is configured to record second identification information of the second event, where the second event comprises receiving, by the first device, by using the communication protocol The data packet.
一种用于将计算设备间事件相关联的第三设备，其中，该设备包括：A third device for associating computing device-to-device events, wherein the device comprises:

第十装置，用于从第一设备获取第一事件及对应的第一标识信息；a tenth device, configured to acquire a first event and corresponding first identification information from the first device;

第十一装置，用于从第二设备获取与所述第一事件相关联的第二事件，其中，所述第一事件的第一标识信息与所述第二事件的第二标识信息相等且对应相同的通信协议。An eleventh device, configured to acquire, from the second device, a second event associated with the first event, where the first identifier information of the first event is equal to the second identifier information of the second event Corresponds to the same communication protocol.
根据权利要求20所述的设备，其中，所述第十一装置包括：The apparatus of claim 20 wherein said eleventh device comprises:

第十一一单元，用于根据所述第一事件的第一标识信息，在所述第二设备中查找与所述第一标识信息相等且对应相同的通信协议的标识信息，其中，查找到的标识信息为第二标识消息；An eleventh unit, configured to search, in the second device, identifier information that is equal to the first identifier information and corresponds to the same communication protocol, according to the first identifier information of the first event, where The identification information is a second identification message;

第十一二单元，用于获取所述第二标识信息对应的第二事件。The eleventh unit is configured to acquire a second event corresponding to the second identifier information.
根据权利要求20或21所述的设备，其中，所述第一标识信息与所述第二标识信息的记录时间满足预定的时间间隔阈值。The device according to claim 20 or 21, wherein said first identification information and said The recording time of the second identification information satisfies a predetermined time interval threshold.
根据权利要求20至22中任一项所述的设备，其中，该设备还包括：The device according to any one of claims 20 to 22, wherein the device further comprises:

第十二装置，用于将所述第二设备上的第三事件与所述第一事件相关联，其中，所述第三事件与所述第二事件相关联。a twelfth device, configured to associate a third event on the second device with the first event, wherein the third event is associated with the second event.
根据权利要求20至23中任一项所述的设备，其中，该设备还包括：The device according to any one of claims 20 to 23, wherein the device further comprises:

第十三装置，用于将关联所得的事件集合输出给用户，其中，所述事件集合包括所述第一事件及与所述第一事件相关联的事件。 The thirteenth device is configured to output the associated event collection to the user, wherein the event set includes the first event and an event associated with the first event.