WO2016180167A1

WO2016180167A1 - Method, device and system for associating events between computing devices

Info

Publication number: WO2016180167A1
Application number: PCT/CN2016/079551
Authority: WO
Inventors: 任震宇
Original assignee: 阿里巴巴集团控股有限公司; 任震宇
Priority date: 2015-05-08
Filing date: 2016-04-18
Publication date: 2016-11-17
Also published as: CN106201942B; CN106201942A

Abstract

Provided are a method, device and system for associating events between computing devices. The method and device comprises: recording, by a first device (1), first identification information of a first event when transmitting data from the first device (1) to a second device (2); recording, by the second device (2), second identification information of a second event, wherein the first identification information and the second identification information are equivalent because the two are characteristic information of the same data packet transmitted from the first device (1) to the second device (2); and acquiring, by a third device (3), the first event and corresponding first identification information from the first device (1), and acquiring the second event associated with the first event according to the first identification information of the first event, so as to associate the first event and the second event in different devices. The system associates events in different devices such as the first device (1) and the second device (2) via the third device (3), thereby realizing event collection after a plurality of associated events are associated, and outputting to a user a result of the event association.

Description

Method, device and system for associating events between computer devices

Technical field

The present application relates to the field of computer technology, and in particular, to a technique for associating events between computer devices.

Background technique

With the development of computer technology, especially distributed computing. It is common for a first computer program to request and utilize a resource to a second computer program or data source, or to send a message to a second computer program by a first computer program. Frequently, the second computer program or data source may be executed on a separate computer system from the first computer program, so communication between the two programs over a computer network may be necessary. Thus, processing a single transaction within a computer network may require a large amount of communication or interaction between resources distributed throughout the network. In order to manage these computer networks, especially to investigate problems and analyze performance needs, distributed systems or service systems deployed on computer clusters often associate non-independent events that occur on multiple servers.

In general, the two events occurring on the same computer are relatively easy to associate, and the two events occurring on different computers are transmitted over the network. Because the context of the execution event is completely different, it is difficult to associate. The traditional association method is to modify the network communication library, so that the sending server can add the global unique ID in the sent network data packet and record the ID as the field of the event A in the local log, and the receiving server extracts the network data packet. The ID is extracted and recorded as a field of Event B to the local log. When the events A and B are to be associated, the analyzer uses the global unique ID as the key, and finds the events A and B containing the key from the total set of events to complete the association.

The existing event correlation between computers has the following problems: (1) The network communication library needs to be modified, and a global unique ID is added to the network data packet as the key associated with the event. Some network communication libraries cannot be modified for various reasons, such as copyright and closed source. For service software that uses such a network communication library, it is impossible to correlate communication events occurring on multiple computers. (2) The generation of the global unique ID increases the certain processor resources, and the transmission of the global unique ID increases the network data traffic.

Summary of the invention

It is an object of the present application to provide a method, apparatus and system for associating events between computer devices.

According to an aspect of the present application, a method for associating inter-device computing events at a first device end is provided, wherein the method includes:

Obtaining a data packet to be sent to the second device by using a communication protocol;

Recording, in the data packet, field information about the communication protocol as first identification information of a first event, where the first event includes sending the data packet to the second device by using the communication protocol ;

The data packet is transmitted to the second device by the communication protocol.

According to another aspect of the present application, a method for associating inter-device computing events at a second device end is provided, wherein the method includes:

Receiving a data packet sent by the first device through a communication protocol;

Recording, in the data packet, field information about the communication protocol as second identifier information of the second event, where the second event includes receiving the data packet sent by the first device by using the communication protocol .

According to another aspect of the present application, a method for associating inter-device computing events at a third device end is provided, wherein the method includes:

Acquiring the first event and the corresponding first identification information from the first device;

And acquiring, by the second device, a second event associated with the first event, where the first identification information of the first event is equal to the second identification information of the second event and corresponds to the same communication protocol.

In accordance with another aspect of the present application, a first is provided for associating computing device events Equipment, wherein the equipment includes:

a first device, configured to acquire a data packet to be sent to the second device by using a communication protocol;

a third device, configured to record, in the data packet, field information about the communication protocol as first identifier information of a first event, where the first event includes sending the data packet by using the communication protocol To the second device;

And a fifth device, configured to send the data packet to the second device by using the communication protocol.

According to another aspect of the present application, a second device is provided for associating computing inter-device events, wherein the device comprises:

a second device, configured to receive a data packet sent by the first device by using a communication protocol;

a fourth device, configured to record, in the data packet, field information about the communication protocol as second identifier information of the second event, where the second event includes receiving, by the first device, the communication protocol The data packet sent.

According to another aspect of the present application, a third device is provided for associating computing device-to-device events, wherein the device comprises:

a tenth device, configured to acquire a first event and corresponding first identification information from the first device;

An eleventh device, configured to acquire, from the second device, a second event associated with the first event, where the first identifier information of the first event is equal to the second identifier information of the second event Corresponds to the same communication protocol.

In accordance with another aspect of the present application, a system for associating computing inter-device events is provided, wherein the system includes: the first device and the second device and the third device.

Compared with the prior art, the method and device for associating events between computer devices according to the present application, when transmitting data from the first device to the second device, the first device records the first of the first events therein And the second device records the second identifier information of the second event. The first identifier information and the second identifier information are the same information of the same data packet transmitted by the first device to the second device, so the two are equal. The third device acquires the first event and the corresponding first from the first device, because the first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. The first event associated with the first event is associated with the second event according to the first identification information of the first event, and the first event located on the different device is associated with the second event. The system for associating events between computer devices described herein includes the aforementioned first device, second device, and third device. The method and device for associating events between computer devices according to the present application can send events on multiple computers without modifying the network communication library, changing the content of the network data packet, and using the global unique ID. Make an association. On the one hand, for service software that cannot modify the network communication library, event correlation can still be performed. On the other hand, the generation of a costly global unique ID is also avoided, saving computing resources.

DRAWINGS

1 shows a functional block diagram of an embodiment of a first device for associating computing device-to-device events;

2 shows a functional block diagram of an embodiment of a second device for associating computing device-to-device events in the present application;

3 shows a functional block diagram of an embodiment of a third device for associating computing device-to-device events with the present application;

4 is a schematic block diagram showing an embodiment of an eleventh device in a third device for associating computing device-to-device events in the present application;

FIG. 5 illustrates a functional block diagram of an embodiment of a system for associating computing device-to-device events;

6 shows a flow chart of an embodiment of a method for associating computing device events between the present application;

7 shows a flow diagram of yet another embodiment of a method of correlating computing inter-device events in the present application.

The same or similar reference numerals in the drawings denote the same or similar components.

detailed description

In a typical configuration of the present application, the terminal, the device of the service network, and the trusted party each include one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium.

Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, A magnetic tape cartridge, magnetic tape storage or other magnetic storage device or any other non-transportable medium that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.

The technical solutions of the present application will be clearly and completely described in the following with reference to the accompanying drawings and preferred embodiments.

As shown in FIG. 1, a block diagram of a system for correlating computing device events provided by the present application is shown, the system including a first device 1, a second device 2, and a third device 3.

In this embodiment, when the first device 1 transmits data to the second device 2 through the communication protocol, the first device 1 records the first identification information of the first event, and the second device 2 records the second of the second event. The identification information, since the first identification information and the second identification information are characteristic information of the same data packet transmitted by the first device 1 to the second device 2, the two correspond to the same communication protocol and the contents are equal. The first identification information of the first event is equal to the second identification information of the second event and The third device 3 acquires the first event and the corresponding first identification information from the first device 1 according to the same communication protocol, and queries and searches for the first identification information on the second device 2 according to the content of the first identification information of the first event. The equal second identification information and corresponding to the second event of the second identification information, thereby associating the first event with the second event, and also associating the events on different devices. At the same time, the internal device can be associated with the first device 1 and the second device 2 of the system, and the events on the different devices, such as the first device 1 and the second device 2, are associated by the third device 3, thereby implementing A plurality of associated events are associated with the event collection, and the result of the event correlation is output to the user for use in further performance testing, problem analysis, and the like.

As shown in FIG. 2, a block diagram of a first device 1 for correlating inter-computer computing events provided by the present application is shown, the device including a first device 11, a third device 12, and a fifth device 13. The first device 11 acquires a data packet to be transmitted to the second device 2 through a communication protocol. The third device 12 records the field information about the communication protocol in the data packet as the first identification information of the first event, wherein the first event comprises transmitting the data packet to the second device 2 through the communication protocol. The fifth device 13 transmits the data packet to the second device 2 through the communication protocol.

In this embodiment, the first device 1 acquires a data packet to be sent to the second device 2 through the communication protocol by using the first device 11, and specifically, when the user needs to perform network transmission of data, a data transmission request is generated. The first device 11 can directly acquire the data that needs to be transmitted, and then process the data according to the requirements of the network transmission protocol, such as data packets or data segments, for data transmission. The first device 11 can also directly acquire the processed data packet or data segment and the like. The data packet or data segment processing may specifically refer to that the data stream to be sent is subjected to data packetization or segmentation processing according to the transmission unit size and transmission rules required by the network transmission protocol to obtain a data packet suitable for transmission. For example, when the TCP network transmission protocol transmits data, the data stream to be transmitted needs to be segmented into segments of appropriate length, and the maximum transmission segment size is usually limited by the maximum transmission unit of the data link layer of the network to which the computer is connected. The TCP then passes the packet to the IP layer, which transmits the packet over the network to the TCP layer of the receiving entity. Of course, the specific processing method is not limited, as long as the requirements of the transmission protocol are met. The third device 12 will be in the data packet about the communication protocol The field information of the discussion is recorded as the first identification information of the first event. Specifically, the data packet serves as a transmission unit that performs network transmission through the communication protocol, and carries related information that causes the data receiving device to identify the data packet. For example, information related to a communication protocol, size information of a packet itself, and the like can uniquely identify information of the packet. Specifically, the field information about the communication protocol generally includes: address information of the data packet transmitting device and the receiving device, port number information of the sending device and the receiving device, a serial number of the data packet, and the like, which can uniquely identify the data packet. Taking the TCP transmission protocol as an example, the field information about the communication protocol in the data packet generally includes: a sequence number of the first byte, an Acknowledgment Number, and an address of the sending device and the receiving device ( IP address), the port number of the sending device and the receiving device, and so on. Record the field information about the communication protocol in the data packet. Specifically, it can be recorded by function or by other means, usually recorded in the log of the first event. Of course, the specific recording method and recording position are not limited. The first event includes sending the data packet to the second device 2 through a communication protocol, where the first event occurs in the first device 1, and may indicate that the first device 1 transmits one to the second device 2 through the network communication protocol. The data packet, the completion of the first event, includes the transmission of the data packet from the first device 1 to the second device 2. The fifth device 13 transmits the data packet to the second device 2 through the communication protocol. Specifically, the fifth device 13 can transmit the data packet to the second device 2 by satisfying the required communication protocol, and the specific communication protocol is not limited, for example, It can be a TCP protocol or other communication protocol.

Referring to FIG. 2, preferably, the device further includes:

The seventh device 14 is configured to insert, in the kernel of the first device 1, a first module for recording first identification information of the first event; wherein the third device 12 is configured to:

Executing a first module to record first identification information of the first event, wherein the first event comprises transmitting the data packet to the second device 2 by using a communication protocol.

In this embodiment, the seventh device 14 inserts a first module for recording first identification information of the first event in the kernel of the first device 1, in particular, when the first device 1 has a kernel and a user space, To transfer data with other devices, you need to transfer the user space data packets to the kernel, and transfer the data packets to the kernel (if any) of other devices through the kernel to complete the data between the devices. Transmission. The first module is configured to record the first identification information of the first event, and the first module may be an operation unit such as a function or a code, as long as the first identification information of the first event can be recorded to meet the requirement. The kernel of the first device 1 is provided with an application programming interface. When the application layer of the first device 1 needs to send a data packet, the user needs to execute the packet sending module of the corresponding interface, so that the data packet can be transmitted from the application layer of the first device 1. Into its kernel. Specifically, the first module may be disposed in the sending module, or may be disposed outside the sending module of the kernel, and the sending module may be a sending function, or may be another running unit that implements sending a data packet request. The third device 12 executes the first module to record the first identification information of the first event. Specifically, the first identification information of the first event is recorded by the operation of the first module. The operation of the first module requires the triggering of the sending module. The first module may pre-set its relationship with the delivery module by pre-processing. For example, the first module may be pre-embedded in the location within the delivery module, or may be disposed outside the delivery module, as long as the running delivery module can trigger the operation of the first module. can. For example, the first module is pre-embedded in a specific location during the running process of the delivery module, and when the delivery module runs to here, the first module is triggered, and the first module is operated to record the first identification information of the first event.

Referring to FIG. 2, more preferably, the third device 12 is configured to, when receiving a sending request of the data packet, execute the first module to record first identification information of the first event, where the first event includes The protocol sends the data packet to the second device 2.

In this embodiment, the third device 12 is configured to execute the first module to record the first identification information of the first event when receiving the transmission request of the data packet. Specifically, when the first device 1 has a kernel and a user space, if data transmission is to be performed with other devices, the data packet of the user space is transmitted to the kernel, and the data packet is transmitted to the kernel of the other device through the kernel (if There is) to complete the transfer of data between devices. The kernel of the first device 1 is provided with an application programming interface. When the application layer of the first device 1 needs to send a data packet, the user needs to execute the packet sending module of the corresponding interface, so that the data packet can be transmitted from the application layer of the first device 1. Into its kernel. The sending request of the data packet may be a running request of the sending module, or a request generated by the sending module, and the like, as long as the data is sent from the user space, the specific request sending manner is not limited. The sending time is also not limited as long as the third device 12 can be executed to execute the first module to record the first identification information of the first event. The triggering of executing the first module may be implemented in the following specific manner. The first module may be set in the sending module, or may be set outside the sending module of the kernel, and the sending module may be a sending function, or may be configured to send a data packet request. Other operating units. The third device 12 executes the first module to record the first identification information of the first event. Specifically, the first identification information of the first event is recorded by the operation of the first module. The operation of the first module requires the triggering of the sending module. The first module may pre-set its relationship with the delivery module by pre-processing. For example, the first module may be pre-embedded in the location within the delivery module, or may be disposed outside the delivery module, as long as the running delivery module can trigger the operation of the first module. can. For example, the first module is pre-embedded in a specific location during the running process of the delivery module, and when the delivery module runs to here, the first module is triggered, and the first module is operated to record the first identification information of the first event.

As shown in FIG. 3, a block diagram of a second device 2 for correlating inter-computer computing events provided by the present application is shown, the device including a second device 21 and a fourth device 22. The second device 21 receives the data packet sent by the first device 1 through the communication protocol. The fourth device 22 records the field information about the communication protocol in the data packet as the second identification information of the second event, wherein the second event includes receiving the data packet sent by the first device 1 through the communication protocol.

In this embodiment, the second device 2 receives, by the second device 21, the data packet sent by the first device 1 through the communication protocol. Specifically, the second device 21 receives the data packet that meets the requirements according to the data transmission rule of the communication protocol. For example, if data transmission is performed by the TCP transmission protocol, it is necessary to satisfy the transmission format, transmission strategy, and the like of the TCP protocol. The fourth device 22 records the field information about the communication protocol in the data packet as the second identification information of the second event, specifically, the data packet acts as a transmission unit for performing network transmission through the communication protocol, and carries the data receiving device to identify the data. Information about the package. For example, information related to a communication protocol, size information of a packet itself, and the like can uniquely identify information of the packet. Specifically, the field information about the communication protocol generally includes: address information of the data packet transmitting device and the receiving device, port number information of the sending device and the receiving device, a serial number of the data packet, and the like, which can uniquely identify the data packet. Take the TCP transport protocol as an example, where the data packet The field information about the communication protocol generally includes: a sequence number of the first byte, an Acknowledgment Number, an address of the transmitting device and the receiving device (IP address), and a port number of the transmitting device and the receiving device. Wait. The field information about the communication protocol in the data packet is recorded and used as the second identification information of the second event. Specifically, it can be recorded by function or by other means, and is usually recorded in the log of the second event. Of course, the specific recording method and recording position are not limited. The second event includes receiving a data packet sent by the first device 1 through a communication protocol. Here, the second event occurs in the second device 2, which may indicate that the second device 2 receives the first device 1 through a network communication protocol. A data packet transmitted, the completion of the second event, including the second device 2 receiving a data packet from the first device 1.

As shown in FIG. 3, a block diagram of a second device 2 for correlating inter-computer computing events provided by the present application is shown, the device further including a sixth device 23. The sixth device 23 sends the data packet to the corresponding target application in the second device 2.

In this embodiment, since the transmission requirement of the data packet comes from the requirement of the user operating the application, accordingly, the first device 1 transmits the data packet to the second device 2 according to the needs of the user when operating the application, and the second device 2 After receiving the data packet, the content of the data packet needs to be sent to the corresponding target application in the second device 2. Specifically, the data packet can be read from the kernel of the second device 2 through the target application of the user space of the second device 2, and the one-way transmission process of the entire data is completed. Certainly, the specific manner of sending the data packet to the target application in the second device 2 is not limited as long as the requirement is met. For example, if the second device 2 does not have a kernel, the manner in which the data packet is sent to the target application is different. .

Referring to FIG. 3, preferably, the device further includes:

The eighth device 24 is configured to insert, in the kernel of the second device 2, a second module for recording second identification information of the second event; wherein the fourth device 22 is configured to:

Executing a second module to record second identification information of the second event, wherein the second event comprises receiving a data packet sent by the first device 1 by using a communication protocol.

In this embodiment, the eighth device 24 is inserted in the kernel of the second device 2 for recording the second thing. The second module of the second identification information of the piece. The second module is configured to record the second identification information of the second event, and the second module may be an operation unit such as a function or a code, as long as the second identification information of the second event can be recorded. Specifically, when the second device 2 has a kernel and a user space, if data transmission is to be performed with other devices, the data packet received by the kernel of the second device 2 from the core of the first device 1 needs to be sent to the user space to Realize the interactive transmission of data packets. The second module is configured to record the second identification information of the second event, and the second module may be an operation unit such as a function or a code, as long as the second identification information of the second event can be recorded.

Continuing in this embodiment, the kernel of the second device 2 is provided with an application programming interface. When the second device 2 receives the data packet from the first device 1, the user needs to execute the receiving module of the corresponding interface. The packet is passed from the core of the second device 2 to its user space. Specifically, the second module may be disposed in the receiving module, or may be disposed outside the receiving module of the kernel, and the receiving module may be a receiving function, or may be another operating unit that implements receiving the data packet request. The fourth device 22 executes the second module to record the second identification information of the second event. Specifically, the second identification information of the second event is recorded by the operation of the second module. The operation of the second module requires the triggering of the receiving module. The second module can pre-set the relationship between the second module and the receiving module. For example, the second module can be embedded in the location of the receiving module in advance, or can be set outside the receiving module, as long as the running receiving module can trigger the first The second module can be run. For example, the second module is pre-embedded in a specific location during the operation of the receiving module. When the receiving module runs here, the second module is triggered, and the second module is operated to record the second identification information of the second event.

Referring to Figure 3, more preferably, the fourth device 22 is for:

Upon receiving the data packet, the second module is executed to record the second identification information of the second event, wherein the second event comprises receiving the data packet sent by the first device 1 through the communication protocol.

In this embodiment, the fourth device 22 is configured to execute the second module to record the second identification information of the second event when the data packet is received. Specifically, when the second device 2 has a kernel and a user space, if data transmission is to be performed with other devices, the data packet received by the kernel of the second device 2 from the core of the first device 1 needs to be sent to the user space to Realize the interactive transmission of data packets. Second setting The kernel of the standby 2 is provided with an application programming interface. When the user receives the data packet from the core of the first device 1 in the second device 2 core, the user needs to execute the receiving module of the corresponding interface, so that the data packet can be sent from the second device. The kernel of 2 is passed to its user space. The request for receiving the data packet may be a running request of the receiving module, or a request generated by the receiving module, and the like, as long as the data receiving request is from the core of the second device 2, the specific request sending manner is not limited. The sending time is also not limited as long as the fourth device 22 can be executed to execute the second module to record the second identification information of the second event. The triggering of executing the second module may be implemented in the following specific manner. The second module may be set in the receiving module, or may be disposed outside the receiving module of the kernel, and the receiving module may be a receiving function or receiving Other runtime units for packet requests. The fourth device 22 executes the second module to record the second identification information of the second event. Specifically, the second identification information of the second event is recorded by the operation of the second module. The operation of the second module requires the triggering of the receiving module. The second module can pre-set the relationship between the second module and the receiving module. For example, the second module can be embedded in the location of the receiving module in advance, or can be set outside the receiving module, as long as the running receiving module can trigger the first The second module can be run. For example, the second module is pre-embedded in a specific location during the operation of the receiving module. When the receiving module runs here, the second module is triggered, and the second module is operated to record the second identification information of the second event.

As shown in FIG. 4, a block diagram of a third device 3 for correlating inter-computer computing events provided by the present application is shown, the device including a tenth device 31 and an eleventh device 32. The tenth device 31 acquires the first event and the corresponding first identification information from the first device 1. The eleventh device 32 acquires a second event associated with the first event from the second device 2, wherein the first identification information of the first event is equal to the second identification information of the second event and corresponds to the same communication protocol.

In this embodiment, the third device 3 is configured to associate the foregoing first event and the second event, and the third dual device may be disposed in the first device 1, or may be disposed in the second device 2, or may be separately Settings. The tenth device 31 acquires the first event and the corresponding first identification information from the first device 1, and specifically, the tenth device 31 can find the first identification information of the first event that needs to be associated on the first device 1, for example The first identifier information corresponding to the first event may be searched on the event log on the first device 1. Generally, the event log of the first device 1 is recorded in the memory or the disk of the first device 1, and can be directly read and read by the corresponding storage location. The specific time for the third device 3 to search for the first identifier information corresponding to the first event on the first device 1 may be a real-time search, or may be searched for a preset time interval, or may be performed according to the user's needs. The performance of the system composed of the first device 1, the second device 2, and the like needs to be analyzed or tested, and the specific search time is not limited. The eleventh device 32 acquires the second event associated with the first event from the second device 2, specifically, the eleventh device 32 finds the second device 2 according to the first identification information of the first event. A second identification information with the same information is identified, and corresponding to the second event. For example, the second identification information equal to the first identification information may be searched for on the event log on the second device 2. Generally, the event log in the second device 2 is recorded in the memory or the disk of the second device 2, and can be directly read to the corresponding storage location for reading. The second identifier is further found by the found second identifier information, and the second event is obtained, and the first event is associated with the second event. The first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. Specifically, because the first event is that the first device 1 sends a data packet to the second device 2, the second event Receiving, by the second device 2, the data packet sent by the first device 1, the first identifier information of the first event and the second identifier information of the second event are information related to the communication protocol of the same data packet, so the first The identification information is equal to the second identification information and corresponds to the same communication protocol.

Continuing in this embodiment, the tenth device 31 can also obtain the second event and the corresponding second identification information from the second device 2, and then the eleventh device 32 acquires the second event associated with the second event from the first device 1. The first event, wherein the second identification information of the second event is equal to the first identification information of the first event and corresponds to the same communication protocol. The specific implementation of the previous embodiment is the same as that of the previous part of the embodiment, and details are not described herein again.

As shown in FIG. 5, a schematic block diagram of an eleventh device 32 in a third device 3 for correlating inter-computer computing events provided by the present application is shown. The eleventh device 32 includes an eleventh unit 321 and The eleventh two-unit 322. The eleventh unit 321 searches, in the second device 2, the identification information of the communication protocol that is equal to the first identification information and corresponds to the same according to the first identification information of the first event. Information, wherein the found identification information is a second identification message. The eleventh unit 322 obtains the second event corresponding to the second identifier information.

In this embodiment, the eleventh unit 321 searches, in the second device 2, the identifier information of the communication protocol that is equal to the first identifier information and corresponds to the same, according to the first identifier information of the first event, where the identifier information is found. The identification information is a second identification message. Generally, the identifier information of the event is recorded in the log of the event, and the eleventh unit 321 searches for the identifier information with the equal content in the event log of the second device 2 according to the specific content of the first identifier information, and the identifier that is found is found. The information is the second identification information, and those skilled in the art should be able to understand that the specific search manner herein is not limited. The eleventh unit 322 obtains the second event corresponding to the second identifier information. Specifically, the eleventh and second units 322 can obtain the processing status, the processing time, the processing result, and the like of the second event by using the second identifier information. Event related information. It can be obtained by running the correlation function, or by comparing the judgment manner, etc., and those skilled in the art should be able to understand that the specific manner of obtaining the second event herein is not limited.

Preferably, the recording time of the first identification information and the second identification information meets a predetermined time interval threshold.

In this embodiment, it is mainly for the case where a plurality of pieces of identification information of the communication protocol equal to the first identification information and corresponding to the same identity information are found in the second device 2 according to the first identification information. In this case, the second identification information corresponding to the first identification information needs to be found from the identification information. Specifically, the recording time of the identification information needs to be implemented, that is, the first identification information is found on the second device 2. And the identifier information that meets the preset threshold interval, and is the second identifier information, in the plurality of pieces of the identification information corresponding to the same communication protocol. For example, the preset time interval threshold is 0-500 milliseconds, that is, the time point interval for recording the first identification information and the second identification information is within a range of 500 milliseconds. The third device 2 finds three pieces of identification information that are equal to the first identification information and correspond to the same communication protocol, wherein the recording time interval of the three identification information and the recording time interval of the first identification information are 1 minute and 100, respectively. In milliseconds and 10 minutes, it is obvious that the identification information with a time interval of 100 milliseconds is the second identification information. Time interval threshold as needed Line settings.

Continuing in this embodiment, the recording time of the first identification information and the second identification information meets a predetermined time interval threshold, and may also be found in the plurality of identification information of the communication protocol that is equal to the first identification information and corresponds to the same communication protocol. Excluding the case that the second identification information is obviously not met, for example, the preset time interval threshold is 0-500 milliseconds, and the identifiers of the communication protocols that are equal to the first identification information and corresponding to the same are found on the second device 2. The information, wherein the recording time of the three identification information and the recording time interval of the first identification information are respectively 60 milliseconds, 400 milliseconds, and 10 minutes, and the identification information of the time interval of 10 minutes obviously does not meet the requirement, and the remaining The identification information with a time interval of 60 milliseconds and 400 milliseconds can filter the second identification information in the closest manner to the time interval, and further screening can be implemented by other means. For example, the preset time interval threshold is 0-500 milliseconds, and the identifier information of the communication protocol equal to the first identification information and corresponding to the same is found on the second device 2, wherein the recording time of the identification information is If the recording time interval of the first identification information is 20 minutes, and the identification information obviously does not meet the requirement, it may be considered that the second identification information that meets the requirement is not found on the second device 2.

In addition, it should be noted that all time point values and time interval thresholds and the like in this embodiment are recorded and compared in the case where all the devices of the system in which the first device 1 and the second device 2 are located are synchronized. Wait. The time synchronization method between the internal devices of the specific system is not limited.

As shown in FIG. 4, a schematic block diagram of a third device 3 for associating computing device-to-device events provided by the present application is shown, the device further comprising:

The twelfth device 33 is configured to associate the third event on the second device 2 with the first event, wherein the third event is associated with the second event.

In this embodiment, mainly for the case that the event is associated within the same device, the third event and the second event both occur on the second device 2, and the association between the second event and the third event is an internal association of the same device. Specifically, the association may be performed by means of a thread ID or the like, and those skilled in the art should be able to understand that the manner in which the internal event of the device is associated is not specifically limited. The first event on the first device 1 is associated with the third event on the second device 2, and is the first event and the second event. After the event association, the second event is associated with the third event, the first event is associated with the third event by the second event. Especially in a distributed system, the events that need to be associated are located on many devices. To associate a large number of related events, the association between the internal events of the device is required, and the association of events between devices is required to achieve the final The association of associated events. Specifically, the twelfth device 33 associates the third event on the second device 2 with the first event on the first device 1. First, the third event and the second event on the second device 2 need to be passed through the thread ID. The association is performed, and the second event is associated with the first event by using the foregoing first event to be associated with the second event, and finally the association of the first event, the second event, and the third event is implemented.

As shown in FIG. 4, a functional block diagram of a third device 3 for correlating inter-computer computing events provided by the present application is shown, the device further including a thirteenth device 34. The thirteenth device 34 outputs the associated event collection to the user, wherein the event set includes the first event and an event associated with the first event.

In this embodiment, the thirteenth device 34 outputs the associated event set to the user, specifically, the result of associating the associated event to the user, for example, when a distributed system is always running slowly, the user needs to The system performs performance testing or finds the cause of the problem. If the distributed system includes three devices A, B, and C, data needs to be transmitted on the three devices, and the first event occurs on the A device. The second event and the third event occur, and a fourth event occurs on the C device. The first event to the fourth event are associated events, and then the thirteenth device 34 searches for the reason why the system is slow according to the user needs. It is necessary to separately search for the spatio-temporal information of the first event, such as the sending time point and the sending position, the second event receiving the spatio-temporal information of the data packet sent by the first event, and so on. If it is found that the spatio-temporal information of the sending/receiving data packet of the event does not meet the preset threshold, it can be determined that there is a problem in the device that executes the event in the system, and further analysis can be performed according to the specific information read. The cause of the problem.

Compared with the prior art, the device for associating events between computer devices of the present application, when transmitting data from the first device 1 to the second device 2, the first device 1 records the first identifier of the first event therein. Information, the second device 2 records the second identification information of the second event, due to the first identifier The information and the second identification information are characteristic information of the same data packet transmitted by the first device 1 to the second device 2, so the two are equal. The third device 3 acquires the first event and the corresponding first identification information from the first device 1 according to the first information, because the first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. The first identification information of the event acquires the second event associated with the first event, and the first event located on the different device can be associated with the second event. The system for associating events between computer devices of the present application includes the aforementioned first device 1, second device 2, and third device 3. The method and device for associating events between computer devices according to the present application can send events on multiple computers without modifying the network communication library, changing the content of the network data packet, and using the global unique ID. Make an association. On the one hand, for service software that cannot modify the network communication library, event correlation can still be performed. On the other hand, the generation of a costly global unique ID is also avoided, saving computing resources.

As shown in FIG. 6, a method for associating computing inter-device events provided by the present application is shown, wherein the method for associating inter-device computing events on the first device side includes:

S1. Obtain a data packet to be sent to the second device by using a communication protocol.

S2. Record field information about the communication protocol in the data packet as the first identification information of the first event, where the first event includes sending the data packet to the second device by using a communication protocol.

S3. Send the data packet to the second device by using a communication protocol.

In this embodiment, the first device acquires a data packet to be sent to the second device by using a communication protocol, and specifically, when the operation of the user needs to perform data transmission on the network, a data transmission request is generated, and the data transmission request may be directly obtained. The data is then processed according to the requirements of the network transmission protocol, such as data packets or data segments, for data transmission. It is also possible to directly obtain the processed data packet or data segment. The data packet or data segment processing may specifically refer to that the data stream to be sent is subjected to data packetization or segmentation processing according to the transmission unit size and transmission rules required by the network transmission protocol to obtain a data packet suitable for transmission. For example, when the TCP network transmission protocol transmits data, the data stream to be transmitted needs to be segmented into segments of appropriate length, and the maximum transmission segment size is usually limited by the maximum transmission unit of the data link layer of the network to which the computer is connected. Then TCP The data packet is transmitted to the IP layer, and the IP layer transmits the data packet to the TCP layer of the receiving entity through the network. Of course, the specific processing method is not limited, as long as the requirements of the transmission protocol are met. Recording the field information about the communication protocol in the data packet as the first identification information of the first event, specifically, the data packet is a transmission unit that performs network transmission by using a communication protocol, and carries information related to enabling the data receiving device to identify the data packet. . For example, information related to a communication protocol, size information of a packet itself, and the like can uniquely identify information of the packet. Specifically, the field information about the communication protocol generally includes: address information of the data packet transmitting device and the receiving device, port number information of the sending device and the receiving device, a serial number of the data packet, and the like, which can uniquely identify the data packet. Taking the TCP transmission protocol as an example, the field information about the communication protocol in the data packet generally includes: a sequence number of the first byte, an Acknowledgment Number, and an address of the sending device and the receiving device ( IP address), the port number of the sending device and the receiving device, and so on. Record the field information about the communication protocol in the data packet. Specifically, it can be recorded by function or by other means, usually recorded in the log of the first event. Of course, the specific recording method and recording position are not limited. The first event includes sending the data packet to the second device by using a communication protocol, where the first event occurs in the first device, and the first device may transmit a data packet to the second device by using the network communication protocol, where The completion of an event, including the transmission of the data packet from the first device to the second device. The data packet is sent to the second device by using a communication protocol. Specifically, the data packet can be sent to the second device by satisfying the required communication protocol, and the specific communication protocol is not limited, and may be, for example, a TCP protocol or other communication. protocol.

Referring to FIG. 6, preferably, the method for associating inter-device computing events on the first device side further includes:

Inserting, in a kernel of the first device, a first module for recording first identification information of the first event;

The first identifier information that records the field information about the communication protocol in the data packet as the first event includes:

Executing a first module to record first identification information of the first event, where the first event includes The data packet is transmitted to the second device through a communication protocol.

In this embodiment, a first module for recording first identification information of the first event is inserted in a kernel of the first device. Specifically, when the first device has a kernel and a user space, data is to be performed with other devices. For transmission, the data packet of the user space needs to be transmitted to the kernel, and the data packet is transmitted to the kernel (if any) of the other device through the kernel to complete the transmission of data between the devices. The first module is configured to record the first identification information of the first event, and the first module may be an operation unit such as a function or a code, as long as the first identification information of the first event can be recorded to meet the requirement. The kernel of the first device is provided with an application programming interface. When the first device application layer needs to send a data packet, the user needs to execute the corresponding module of the corresponding interface to transmit the data packet from the application layer of the first device to the kernel. in. Specifically, the first module may be disposed in the sending module, or may be disposed outside the sending module of the kernel, and the sending module may be a sending function, or may be another running unit that implements sending a data packet request. The first module is executed to record the first identification information of the first event. Specifically, the first identification information of the first event is recorded by running the first module. The operation of the first module requires the triggering of the sending module. The first module may pre-set its relationship with the delivery module by pre-processing. For example, the first module may be pre-embedded in the location within the delivery module, or may be disposed outside the delivery module, as long as the running delivery module can trigger the operation of the first module. can. For example, the first module is pre-embedded in a specific location during the running process of the delivery module, and when the delivery module runs to here, the first module is triggered, and the first module is operated to record the first identification information of the first event.

Referring to FIG. 6 , more preferably, the first identification information that records the field information about the communication protocol in the data packet as the first event in S2 includes:

When receiving the sending request of the data packet, the first module is executed to record the first identification information of the first event, wherein the first event comprises sending the data packet to the second device by using a communication protocol.

In this embodiment, when receiving the transmission request of the data packet, the first module is executed to record the first identification information of the first event. Specifically, when the first device has a kernel and a user space, if data transmission is to be performed with other devices, the data packet of the user space is transmitted to the kernel, and the data packet is transmitted to the kernel of the other device through the kernel (if any) ), to complete the data between devices Transmission. The kernel of the first device is provided with an application programming interface. When the first device application layer needs to send a data packet, the user needs to execute the corresponding module of the corresponding interface to transmit the data packet from the application layer of the first device to the kernel. in. The sending request of the data packet may be a running request of the sending module, or a request generated by the sending module, and the like, as long as it is a data sending request from the user space, the specific request sending manner is not limited, and the sending time is not A limitation is made as long as the first module capable of executing the first module is recorded to record the first identification information of the first event. The triggering of executing the first module may be implemented in the following specific manner. The first module may be set in the sending module, or may be set outside the sending module of the kernel, and the sending module may be a sending function, or may be configured to send a data packet request. Other operating units. The first module is executed to record the first identification information of the first event. Specifically, the first identification information of the first event is recorded by running the first module. The operation of the first module requires the triggering of the sending module. The first module may pre-set its relationship with the delivery module by pre-processing. For example, the first module may be pre-embedded in the location within the delivery module, or may be disposed outside the delivery module, as long as the running delivery module can trigger the operation of the first module. can. For example, the first module is pre-embedded in a specific location during the running process of the delivery module, and when the delivery module runs to here, the first module is triggered, and the first module is operated to record the first identification information of the first event.

As shown in FIG. 6, the method for associating computing device events on the second device side provided by the present application includes:

S4. Receive a data packet sent by the first device by using a communication protocol.

S5, the field information about the communication protocol in the data packet is recorded as the second identification information of the second event, where the second event includes receiving the data packet sent by the first device by using the communication protocol.

In this embodiment, the second device receives the data packet sent by the first device through the communication protocol, and specifically, receives the data packet that meets the requirements according to the data transmission rule of the communication protocol, for example, if the data transmission is performed through the TCP transmission protocol. It needs to meet the transmission format and transmission strategy of the TCP protocol. Recording the field information about the communication protocol in the data packet as the second identification information of the second event, specifically, the data packet is a transmission unit that performs network transmission by using a communication protocol, and carries information related to enabling the data receiving device to identify the data packet. . For example, information related to communication protocols, data packet Information such as size information of the body can uniquely identify the data packet. Specifically, the field information about the communication protocol generally includes: address information of the data packet transmitting device and the receiving device, port number information of the sending device and the receiving device, a serial number of the data packet, and the like, which can uniquely identify the data packet. Taking the TCP transmission protocol as an example, the field information about the communication protocol in the data packet generally includes: a sequence number of the first byte, an Acknowledgment Number, and an address of the sending device and the receiving device ( IP address), the port number of the sending device and the receiving device, and so on. The field information about the communication protocol in the data packet is recorded and used as the second identification information of the second event. Specifically, it can be recorded by function or by other means, and is usually recorded in the log of the second event. Of course, the specific recording method and recording position are not limited. The second event includes receiving a data packet sent by the first device by using a communication protocol, where the second event occurs in the second device, and the second device may receive the data that the first device transmits through the network communication protocol. The packet, the completion of the second event, includes the second device receiving a data packet from the first device.

As shown in FIG. 6, in one embodiment, the method for associating computing device events on the second device side provided by the present application further includes:

The data packet is sent to a corresponding target application in the second device.

In this embodiment, since the transmission requirement of the data packet comes from the requirement of the user operating the application, accordingly, the first device transmits the data packet to the second device according to the needs of the user when the application program is operated, and the second device receives the data packet. After the data packet, the content of the data packet needs to be sent to the corresponding target application in the second device. Specifically, the data packet can be read from the kernel of the second device through the target application of the second device user space, and the one-way transmission process of the entire data is completed. Of course, the specific manner of sending the data packet to the target application in the second device is not limited as long as the requirement is met. For example, if the second device does not have a kernel, the manner in which the data packet is sent to the target application is different.

As shown in FIG. 6, the method for associating computing device events on the second device side provided by the present application further includes:

Inserting a second mode for recording second identification information of the second event in a kernel of the second device Piece;

The second identifier information that records the field information about the communication protocol in the data packet as the second event includes:

Executing a second module to record second identification information of the second event, where the second event comprises receiving a data packet sent by the first device by using a communication protocol.

In this embodiment, a second module for recording second identification information of the second event is inserted in the kernel of the second device. The second module is configured to record the second identification information of the second event, and the second module may be an operation unit such as a function or a code, as long as the second identification information of the second event can be recorded. Specifically, when the second device has a kernel and a user space, if data is to be transmitted with other devices, the data packet received by the kernel of the second device from the core of the first device needs to be sent to the user space to implement the data packet. Interactive transmission. The second module is configured to record the second identification information of the second event, and the second module may be an operation unit such as a function or a code, as long as the second identification information of the second event can be recorded.

Continuing in this embodiment, the kernel of the second device is provided with an application programming interface. When the second device receives the data packet from the first device, the user needs to execute the packet receiving module of the corresponding interface. Passed from the core of the second device to its user space. Specifically, the second module may be disposed in the receiving module, or may be disposed outside the receiving module of the kernel, and the receiving module may be a receiving function, or may be another operating unit that implements receiving the data packet request. The second module is executed to record the second identification information of the second event. Specifically, the second identification information of the second event is recorded by the operation of the second module. The operation of the second module requires the triggering of the receiving module. The second module can pre-set the relationship between the second module and the receiving module. For example, the second module can be embedded in the location of the receiving module in advance, or can be set outside the receiving module, as long as the running receiving module can trigger the first The second module can be run. For example, the second module is pre-embedded in a specific location during the operation of the receiving module. When the receiving module runs here, the second module is triggered, and the second module is operated to record the second identification information of the second event.

Referring to FIG. 6, preferably, in S5, the field information about the communication protocol in the data packet is recorded as the first The second identification information of the second event includes:

When receiving the data packet, the second module is executed to record the second identification information of the second event, wherein the second event comprises receiving the data packet sent by the first device by using the communication protocol.

In this embodiment, upon receiving the data packet, the second module is executed to record the second identification information of the second event. Specifically, when the second device has a kernel and a user space, if data is to be transmitted with other devices, the data packet received by the kernel of the second device from the core of the first device needs to be sent to the user space to implement the data packet. Interactive transmission. The kernel of the second device is provided with an application programming interface. When the user receives the data packet from the first device core, the user needs to execute the corresponding module of the corresponding interface, so that the data packet can be sent from the second device. The kernel is passed to its user space. The request for receiving the data packet may be a running request of the receiving module, or a request generated by the receiving module, and the like, as long as the data receiving request is from the second device core, the specific request sending manner is not limited. The sending time is also not limited as long as the second identification module capable of executing the second module is recorded to record the second identification information of the second event. The triggering of executing the second module may be implemented in the following specific manner. The second module may be set in the receiving module, or may be disposed outside the receiving module of the kernel, and the receiving module may be a receiving function or receiving Other runtime units for packet requests. The second module is executed to record the second identification information of the second event. Specifically, the second identification information of the second event is recorded by the operation of the second module. The operation of the second module requires the triggering of the receiving module. The second module can pre-set the relationship between the second module and the receiving module. For example, the second module can be embedded in the location of the receiving module in advance, or can be set outside the receiving module, as long as the running receiving module can trigger the first The second module can be run. For example, the second module is pre-embedded in a specific location during the operation of the receiving module. When the receiving module runs here, the second module is triggered, and the second module is operated to record the second identification information of the second event.

As shown in FIG. 6, the method for associating computing device events on a third device side provided by the present application includes:

S6. Acquire a first event and corresponding first identification information from the first device.

S7. Acquire, from the second device, a second event associated with the first event, where the first event The first identification information is equal to the second identification information of the second event and corresponds to the same communication protocol.

In this embodiment, the third device is configured to associate the foregoing first event and the second event, and the third dual device may be disposed in the first device, or may be disposed in the second device, or may be separately set. Acquiring the first event and the corresponding first identifier information from the first device, specifically, the first identifier information of the first event that needs to be associated may be found on the first device, for example, an event log that can be on the first device Searching for the first identification information corresponding to the first event. Generally, the event log of the first device is recorded in the memory or the disk of the first device, and can be directly read and read by the corresponding storage location. The specific time for the third device to search for the first identifier information corresponding to the first event on the first device may be a real-time search, or may be searched for a preset time interval, or may be required by the user according to the user's needs. The performance of the system composed of the first device, the second device, and the like is analyzed or tested, and the specific search time is not limited. Acquiring, by the second device, the second event that is associated with the first event, and specifically, searching for the second identifier information that is equal to the first identifier information on the second device according to the first identifier information of the first event, and corresponding To the second event, for example, the second identification information equal to the first identification information may be searched for on the event log on the second device. Generally, the event log in the second device is recorded in the memory or the disk of the second device, and can be directly read and read by the corresponding storage location. The second identifier is further found by the found second identifier information, and the second event is obtained, and the first event is associated with the second event. The first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. Specifically, because the first event is that the first device sends a data packet to the second device, the second event is The second device receives the data packet sent by the first device, and the first identifier information of the first event and the second identifier information of the second event are information related to the communication protocol of the same data packet, so the first identifier information and the first identifier information The two identification information are equal and correspond to the same communication protocol.

Continuing in this embodiment, the second event and the corresponding second identification information may also be obtained from the second device, and then the first event associated with the second event is acquired from the first device, wherein the second event is the second The identification information is equal to the first identification information of the first event and corresponds to the same communication protocol. The specific implementation of the previous embodiment is the same as that of the previous part of the embodiment, and details are not described herein again.

As shown in FIG. 6, preferably, acquiring, in S7, the second event associated with the first event from the second device includes:

And identifying, according to the first identifier information of the first event, the identifier information of the communication protocol that is equal to the first identifier information and corresponding to the same, and the identifier information that is found is the second identifier message.

Obtaining a second event corresponding to the second identifier information.

In this embodiment, the identifier information of the communication protocol that is equal to the first identifier information and corresponds to the same is searched for, according to the first identifier information of the first event, where the found identifier information is the second identifier message. . Generally, the identifier information of the event is recorded in the log of the event, and the identifier information of the second device is found in the event log of the second device according to the specific content of the first identifier information, and the identifier information that is found is the second identifier information. Those skilled in the art should be able to understand that the specific search method herein is not limited. Acquiring the second event corresponding to the second identifier information, specifically, the information related to the second event, such as the processing status of the second event, the processing time, the processing result, and the like, may be acquired by using the second identifier information. It can be obtained by running the correlation function, or by comparing the judgment manner, etc., and those skilled in the art should be able to understand that the specific manner of obtaining the second event herein is not limited.

In one of the embodiments, the recording time of the first identification information and the second identification information satisfies a predetermined time interval threshold.

In this embodiment, it is mainly for the case that a plurality of pieces of identification information of the communication protocol equal to the first identification information and corresponding to the same identity information are found in the second device according to the first identification information. In this case, the second identification information corresponding to the first identification information needs to be found from the identification information, and specifically, the recording time of the identification information needs to be implemented, that is, the first identification information is equal to that found on the second device and And the identification information that the recording time and the recording time of the first identification information meet the preset threshold interval is the second identification information. For example, the preset time interval threshold is 0-500 milliseconds, that is, the time point interval for recording the first identification information and the second identification information is within a range of 500 milliseconds. Finding 3 equals to the first identification information on the second device And corresponding to the identification information of the same communication protocol, wherein the recording time interval of the three identification information and the recording time interval of the first identification information are 1 minute, 100 milliseconds, and 10 minutes, respectively, and the identification information with an apparent time interval of 100 milliseconds is Second identification information. The time interval threshold is set as needed.

Continuing in this embodiment, the recording time of the first identification information and the second identification information meets a predetermined time interval threshold, and may also be found in the plurality of identification information of the communication protocol that is equal to the first identification information and corresponds to the same communication protocol. Excluding the case that the second identification information is obviously not met, for example, the preset time interval threshold is 0-500 milliseconds, and three identification information of the communication protocol that is equal to the first identification information and corresponding to the same is found on the second device. Wherein, the recording time interval of the three identification information and the recording time interval of the first identification information are respectively 60 milliseconds, 400 milliseconds, and 10 minutes, and the identification information of the time interval of 10 minutes obviously does not meet the requirement, and the remaining time The identification information with an interval of 60 milliseconds and 400 milliseconds can filter the second identification information in the closest manner to the time interval, and further screening can be implemented by other means. For example, the preset time interval threshold is 0-500 milliseconds, and the identification information of the communication protocol that is equal to the first identification information and corresponds to the same communication protocol is found on the second device, where the recording time of the identification information is first The recording time interval of the identification information is 20 minutes. If the identification information obviously does not meet the requirements, it may be considered that the second identification information that meets the requirement is not found on the second device.

In addition, it should be noted that all time point values, time interval thresholds, and the like in this embodiment are records, comparisons, and the like performed when the first device is synchronized with all devices of the system in which the second device is located. The time synchronization method between the internal devices of the specific system is not limited.

As shown in FIG. 7, another embodiment of a method for associating computing device events provided by the present application is shown. The method further includes:

S8. Associate a third event on the second device with the first event, where the third event is associated with the second event.

S9. Output the associated event collection to the user, where the event collection includes the first event and an event associated with the first event.

In this embodiment, S8 is mainly for the case where an event is associated within the same device, The third event and the second event are both performed on the second device, and the association between the second event and the third event is an association within the same device. Specifically, the association may be performed by using a thread ID or the like, and those skilled in the art should be able to understand The way in which the internal events of the device are associated is not specifically limited. The first event on the first device is associated with the third event on the second device, and the first event is associated with the second event, and the second event is associated with the third event, and the first event is passed through the second event. The third event is related. Especially in a distributed system, the events that need to be associated are located on many devices. To associate a large number of related events, the association between the internal events of the device is required, and the association of events between devices is required to achieve the final The association of associated events. Specifically, the third event on the second device is associated with the first event on the first device. First, the third event on the second device needs to be associated with the second event by using the thread ID, and then the first The manner in which the event is associated with the second event, the second event is associated with the first event, and finally the association of the first event, the second event, and the third event is achieved.

Continuing in this embodiment, the associated event set is output to the user, specifically, the result of associating the associated event is output to the user. For example, when a distributed system is always running slowly, the user needs to perform performance on the system. Test or find the cause of the problem. If the distributed system includes three devices A, B, and C, the data needs to be transmitted on the three devices. The first event occurs on the A device, and the second device occurs on the B device. In the second event and the third event, a fourth event occurs on the C device, and the first event to the fourth event are associated events. When the user needs to find the reason for the slow operation of the system, the data packet of the first event needs to be separately searched. Send spatio-temporal information, such as the transmission time point, the transmission location, the second event receives the spatio-temporal information of the data packet sent by the first event, and so on. If it is found that the spatio-temporal information of the sending/receiving data packet of the event does not meet the preset threshold, it can be determined that there is a problem in the device that executes the event in the system, and further analysis can be performed according to the specific information read. The cause of the problem.

In addition, the steps in the two embodiments shown in Figures 6-7 are not required to be completed in the above-described writing sequence, and the steps of some of the steps are not limited and may even be synchronized.

Compared with the prior art, the method for associating events between computer devices of the present application is When the data is transmitted from the first device to the second device, the first device records the first identifier information of the first event, and the second device records the second identifier information of the second event, where the first identifier information and the second identifier information The feature information of the same data packet transmitted by the first device to the second device is equal. The third device acquires the first event and the corresponding first identification information from the first device, according to the first event, because the first identifier information of the first event is equal to the second identifier information of the second event and corresponds to the same communication protocol. The first identification information acquires a second event associated with the first event, and the first event located on the different device can be associated with the second event. The system for associating events between computer devices of the present application includes the aforementioned first device, second device, and third device. The method and device for associating events between computer devices according to the present application can send events on multiple computers without modifying the network communication library, changing the content of the network data packet, and using the global unique ID. Make an association. On the one hand, for service software that cannot modify the network communication library, event correlation can still be performed. On the other hand, the generation of a costly global unique ID is also avoided, saving computing resources.

It is obvious to those skilled in the art that the present application is not limited to the details of the above-described exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Therefore, the present embodiments are to be considered as illustrative and not restrictive, and the scope of the invention is defined by the appended claims instead All changes in the meaning and scope of equivalent elements are included in this application. Any reference signs in the claims should not be construed as limiting the claim. In addition, it is to be understood that the word "comprising" does not exclude other elements or steps. A plurality of units or devices recited in the device claims may also be implemented by a unit or device by software or hardware. The first, second, etc. words are used to denote names and do not denote any particular order.

Claims

A method for associating computing device events at a first device end, wherein the method comprises:

Obtaining a data packet to be sent to the second device by using a communication protocol;

Recording, in the data packet, field information about the communication protocol as first identification information of a first event, where the first event includes sending the data packet to the second device by using the communication protocol ;

The data packet is transmitted to the second device by the communication protocol.
The method of claim 1 wherein the method further comprises:

Inserting, in a kernel of the first device, a first module for recording first identification information of the first event;

The first identifier information that records the field information about the communication protocol in the data packet as the first event includes:

Executing the first module to record first identification information of the first event, wherein the first event comprises sending the data packet to the second device by using the communication protocol.
The method according to claim 2, wherein said recording the field information about the communication protocol in the data packet as the first identification information of the first event comprises:

When the sending request of the data packet is received, the first module is executed to record first identification information of the first event, where the first event includes the data packet by using the communication protocol Send to the second device.
A method for associating computing device events at a second device end, wherein the method includes:

Receiving a data packet sent by the first device through a communication protocol;

Recording, in the data packet, field information about the communication protocol as second identifier information of the second event, where the second event includes receiving the data packet sent by the first device by using the communication protocol .
The method of claim 4, wherein the method further comprises transmitting the data packet to a corresponding target application in the second device.
The method of claim 4 or 5, wherein the method further comprises:

Inserting, in a kernel of the second device, a second module for recording second identification information of the second event;

The second identifier information that records the field information about the communication protocol in the data packet as the second event includes:

Executing the second module to record second identification information of the second event, where the second event comprises receiving the data packet sent by the first device by using the communication protocol.
The method according to claim 6, wherein the recording of the field information about the communication protocol in the data packet as the second identification information of the second event comprises:

And when the data packet is received, the second module is configured to record second identification information of the second event, where the second event comprises receiving, by the first device, by using the communication protocol The data packet.
A method for associating computing device events at a third device end, wherein the method includes:

Acquiring the first event and the corresponding first identification information from the first device;

And acquiring, by the second device, a second event associated with the first event, where the first identification information of the first event is equal to the second identification information of the second event and corresponds to the same communication protocol.
The method of claim 8, wherein the obtaining, by the second device, the second event associated with the first event comprises:

And identifying, according to the first identifier information of the first event, identifier information of a communication protocol that is equal to the first identifier information and corresponding to the same, where the found identifier information is a second identifier message. ;

Obtaining a second event corresponding to the second identifier information.
The method according to claim 8 or 9, wherein the recording time of the first identification information and the second identification information satisfies a predetermined time interval threshold.
The method according to any one of claims 8 to 10, wherein the method further comprises:

A third event on the second device is associated with the first event, wherein the third event is associated with the second event.
The method according to any one of claims 8 to 11, wherein the method further comprises:

Outputting the associated set of events to the user, wherein the set of events includes the first event and an event associated with the first event.
A first device for associating computing device-to-device events, wherein the device comprises:

a first device, configured to acquire a data packet to be sent to the second device by using a communication protocol;

a third device, configured to record, in the data packet, field information about the communication protocol as first identifier information of a first event, where the first event includes sending the data packet by using the communication protocol To the second device;

And a fifth device, configured to send the data packet to the second device by using the communication protocol.
The device of claim 13, wherein the device further comprises:

a seventh device, configured to insert, in a kernel of the first device, a first module for recording first identification information of the first event;

Wherein the third device is used to:

Executing the first module to record first identification information of the first event, wherein the first event comprises sending the data packet to the second device by using the communication protocol.
The apparatus of claim 14 wherein said third means is for:

When the sending request of the data packet is received, the first module is executed to record first identification information of the first event, where the first event includes the data packet by using the communication protocol Send to the second device.
A second device for associating computing device-to-device events, wherein the device comprises:

a second device, configured to receive a data packet sent by the first device by using a communication protocol;

a fourth device, configured to record, in the data packet, field information about the communication protocol as second identifier information of the second event, where the second event includes receiving, by the first device, the communication protocol The data packet sent.
The device of claim 16, wherein the device further comprises:

And a sixth device, configured to send the data packet to a corresponding target application in the second device.
The device according to claim 16 or 17, wherein the device further comprises:

An eighth device, configured to insert, in a kernel of the second device, a second module for recording second identification information of the second event;

Wherein the fourth device is used for:

Executing the second module to record second identification information of the second event, where the second event comprises receiving the data packet sent by the first device by using the communication protocol.
The method of claim 18 wherein said fourth means is for:

And when the data packet is received, the second module is configured to record second identification information of the second event, where the second event comprises receiving, by the first device, by using the communication protocol The data packet.
A third device for associating computing device-to-device events, wherein the device comprises:

a tenth device, configured to acquire a first event and corresponding first identification information from the first device;

An eleventh device, configured to acquire, from the second device, a second event associated with the first event, where the first identifier information of the first event is equal to the second identifier information of the second event Corresponds to the same communication protocol.
The apparatus of claim 20 wherein said eleventh device comprises:

An eleventh unit, configured to search, in the second device, identifier information that is equal to the first identifier information and corresponds to the same communication protocol, according to the first identifier information of the first event, where The identification information is a second identification message;

The eleventh unit is configured to acquire a second event corresponding to the second identifier information.
The device according to claim 20 or 21, wherein said first identification information and said The recording time of the second identification information satisfies a predetermined time interval threshold.
The device according to any one of claims 20 to 22, wherein the device further comprises:

a twelfth device, configured to associate a third event on the second device with the first event, wherein the third event is associated with the second event.
The device according to any one of claims 20 to 23, wherein the device further comprises:

The thirteenth device is configured to output the associated event collection to the user, wherein the event set includes the first event and an event associated with the first event.