CN-115033459-B - CPU usage monitoring method, device and storage medium

CN115033459BCN 115033459 BCN115033459 BCN 115033459BCN-115033459-B

Abstract

The application discloses a CPU (Central processing Unit) utilization monitoring method, a device and a storage medium, and relates to the field of electronic information. According to the CPU utilization rate monitoring method provided by the application, the CPU utilization rate of all processes is obtained, the process with the highest CPU utilization rate is obtained through screening, whether the CPU utilization rate of the process with the highest CPU utilization rate is within the preset fluctuation value is judged, the monitoring result is obtained, and the CPU utilization state is obtained through analysis according to the monitoring result, so that the problem root cause of high CPU utilization rate can be obtained specifically, the problem root cause of overhigh CPU utilization rate is verified through introducing eBPF programs, eBPF programs provide a mechanism for safely injecting codes when kernel events and user program events occur, and the code is utilized to realize dynamic tracking of kernel performance events, so that the problem root cause of overhigh CPU utilization rate is accurately judged.

Inventors

XU RENHAO
HU TAOTAO
XU YANGHE

Assignees

杭州安恒信息技术股份有限公司
杭州安恒信息技术股份有限公司

Dates

Publication Date: 20260421
Application Date: 20220628
Priority Date: 20220628

Claims (8)

1. The CPU usage monitoring method is characterized by being applied to a Linux system and comprising the following steps of: calculating CPU utilization rate and judging whether the CPU utilization rate exceeds a threshold value; if the CPU utilization rate exceeds a threshold value, acquiring the CPU utilization conditions of all processes, and screening to obtain the process with the highest CPU utilization rate; Judging whether the CPU utilization rate of the process with the highest CPU utilization rate is within a preset fluctuation value or not; If not, checking a short-time process, namely a process which is continuously crashed and restarted or an external command with short execution time which is executed by using an internal call exec, and acquiring a tracking point of exec system call in the kernel; Monitoring exec behaviors of the process by utilizing eBPF programs to obtain monitoring results; Analyzing and obtaining the CPU use state according to the monitoring result; In the kernel mode, the monitoring of exec behaviors of the process by using the eBPF program, and the obtaining of the monitoring result comprises: Verifying a BPF program, and defining hash mapping and performance event mapping; Adding an exec entry tracking point processing function, and acquiring process information when the entry tracking point processing function is triggered, wherein the process information comprises a process ID, a father process ID, an operation user and a parameter list; storing the process information into the Ha Xiying shots; adding an exec outlet tracking point processing function, and inquiring the process information in the hash map when the exec outlet tracking point processing function is triggered; Updating a return value, submitting the return value to the performance event mapping and clearing the hash mapping, wherein the performance event mapping is the monitoring result; In the user state, the exec behavior of the process is monitored by using the eBPF program, and the monitoring result comprises: defining the BPF program and a performance event buffer zone, and setting the size of a BPF mapping space; initializing the BPF program and mounting the BPF program on a corresponding tracking point; And configuring a performance event callback function, and circularly reading data from the performance event buffer area, wherein the read data is used for representing the monitoring result.
2. The CPU usage monitoring method of claim 1, wherein the calculating CPU usage includes: Reading CPU data in a proc/stat file, and confirming the core number; and respectively calculating the total CPU utilization rate, the user state CPU utilization rate, the kernel state CPU utilization rate, the I/O waiting CPU utilization rate and the interrupt CPU utilization rate.
3. The CPU usage monitoring method according to any one of claims 1 to 2, further comprising: Starting call relation sampling, generating an interrupt once every a first preset time, and recording a process and a function on the interrupt; the function causing the problem is located and output to the analysis result.
4. The CPU utilization monitoring method of claim 3, further comprising, prior to the calculating the CPU utilization and determining whether the CPU utilization exceeds a threshold value: initializing the CPU configuration, including setting the threshold, and configuring an interval time.
5. The CPU usage monitoring method according to claim 4, wherein after locating the function causing the problem, outputting to the analysis result, further comprising: According to the analysis result obtained by analysis, adopting a corresponding solving mode, wherein the solving mode is as follows; if the CPU utilization rate in the user state is high, checking the process performance problem; If the CPU utilization rate in the kernel mode is high, checking the use of system call; if the CPU utilization rate of the I/O waiting is high, checking whether the system storage has an I/O problem or not; And if the interrupted CPU utilization rate is high, checking the processing service interruption in the kernel.
6. A CPU usage monitoring device, comprising: The calculation module is used for calculating the CPU utilization rate and judging whether the CPU utilization rate exceeds a threshold value, if so, the acquisition module is started; The acquisition module is used for acquiring the CPU use conditions of all the processes and screening and obtaining the process with the highest CPU use rate; the judging module is used for judging whether the CPU utilization rate of the process with the highest CPU utilization rate is within a preset fluctuation value, if so, ending, and if not, starting the monitoring module; The system comprises an investigation module, a detection module and a control module, wherein the investigation module is used for investigating a short-time process, and obtaining a tracking point of exec system call in a kernel, wherein the short-time process is a process which is continuously crashed and restarted or an external command with short execution time which is executed by applying internal call exec; The monitoring module is used for monitoring exec behaviors of the process by utilizing eBPF programs to obtain monitoring results and starting the analysis module; the analysis module is used for analyzing and obtaining the CPU use state according to the CPU use rate or the monitoring result of the process; In the kernel mode, the monitoring of exec behaviors of the process by using the eBPF program, and the obtaining of the monitoring result comprises: Verifying a BPF program, and defining hash mapping and performance event mapping; Adding an exec entry tracking point processing function, and acquiring process information when the entry tracking point processing function is triggered, wherein the process information comprises a process ID, a father process ID, an operation user and a parameter list; storing the process information into the Ha Xiying shots; adding an exec outlet tracking point processing function, and inquiring the process information in the hash map when the exec outlet tracking point processing function is triggered; Updating a return value, submitting the return value to the performance event mapping and clearing the hash mapping, wherein the performance event mapping is the monitoring result; In the user state, the exec behavior of the process is monitored by using the eBPF program, and the monitoring result comprises: defining the BPF program and a performance event buffer zone, and setting the size of a BPF mapping space; initializing the BPF program and mounting the BPF program on a corresponding tracking point; And configuring a performance event callback function, and circularly reading data from the performance event buffer area, wherein the read data is used for representing the monitoring result.
7. A CPU usage monitoring device comprising a memory for storing a computer program; A processor for implementing the steps of the CPU usage monitoring method according to any one of claims 1 to 5 when executing the computer program.
8. A computer readable storage medium, characterized in that the computer readable storage medium has stored thereon a computer program which, when executed by a processor, implements the steps of the CPU usage monitoring method according to any of claims 1 to 5.

Description

CPU usage monitoring method, device and storage medium Technical Field The present application relates to the field of electronic information, and in particular, to a method and apparatus for monitoring CPU usage, and a storage medium. Background In recent years, with the rapid development of computer technology, demands for a central processing unit (central processing unit, CPU) are also increasing, and with the increase of functions of software, the burden of the CPU is increasing, and statistics of CPU usage in unit time is generally calculated in a percentage manner. It includes not only user mode and kernel mode running of processes, but also interrupt handling, waiting for I/O, kernel threads, etc. The existing CPU detection method comprises the steps of firstly obtaining the CPU utilization rate of a monitored object in a current monitoring period, and then comparing the CPU utilization rate with a preset value. When the actual CPU utilization rate is monitored to be larger than a preset value, the number of the active sessions is acquired, and finally the hierarchical alarm is carried out according to specific alarm conditions, and only the influence of the number of the active sessions on the CPU utilization rate is considered, so that the strength is often insufficient, the problem root cause is difficult to further locate, and therefore, when the CPU utilization rate of the system is found to be very high, the problem of the corresponding high CPU utilization rate cannot be found directly. In view of the above-mentioned technology, finding a method for monitoring CPU usage rate that can determine a problem of high CPU usage rate is a problem that needs to be solved by those skilled in the art. Disclosure of Invention The application aims to provide a CPU utilization rate monitoring method, a device and a storage medium, so as to solve the problems that when the actual CPU utilization rate is monitored to be larger than a preset value, the number of active sessions is acquired, and finally hierarchical alarm is carried out according to specific alarm conditions, and only the influence of the number of active sessions on the CPU utilization rate is considered, so that the strength is insufficient and the problem root is difficult to further locate, and therefore, when the CPU utilization rate of a system is found to be very high, the problem of the corresponding high CPU utilization rate cannot be found directly. In order to solve the technical problems, the application provides a method for monitoring CPU usage, which is applied to a Linux system and comprises the following steps: calculating CPU utilization rate and judging whether the CPU utilization rate exceeds a threshold value; if the CPU utilization rate exceeds a threshold value, acquiring the CPU utilization conditions of all processes, and screening to obtain the process with the highest CPU utilization rate; Judging whether the CPU utilization rate of the process with the highest CPU utilization rate is within a preset fluctuation value or not; if yes, analyzing to obtain a CUP use state according to the process with the highest CPU use rate; If not, checking the short-time process, and acquiring a tracking point of exec system call in the kernel; Monitoring exec behaviors of the process by utilizing eBPF programs to obtain monitoring results; And analyzing and obtaining the CUP use state according to the monitoring result. Preferably, in the kernel state, the monitoring the exec behavior of the process by using the eBPF program, and obtaining the monitoring result includes: Verifying a BPF program, and defining hash mapping and performance event mapping; Adding an exec entry tracking point processing function, and acquiring process information when the entry tracking point processing function is triggered, wherein the process information comprises a process ID, a father process ID, an operation user and a parameter list; storing the process information into the Ha Xiying shots; adding an exec outlet tracking point processing function, and inquiring the process information in the hash map when the exec outlet tracking point processing function is triggered; and updating a return value, submitting the return value to the performance event mapping and clearing the hash mapping, wherein the performance event mapping is the monitoring result. Preferably, in the user mode, the monitoring the exec behavior of the process by using the eBPF program, and obtaining the monitoring result includes: defining a BPF program and a performance event buffer zone, and setting the size of a BPF mapping space; initializing a BPF program and mounting the BPF program on a corresponding tracking point; And configuring a performance event callback function, and circularly reading data from the performance event buffer area, wherein the read data is used for representing the monitoring result. Preferably, the calculating the CPU utilization includes: Reading CP