BR112017000458B1 - METHOD, APPARATUS AND SYSTEM FOR DISCOVERING AN APPLICATION TOPOLOGY RELATIONSHIP - Google Patents

Abstract

This application relates to the field of IT technologies and, in particular, to a method, an apparatus and a system for discovering an application topology relationship between virtual machines. According to the method for discovering an application topology relationship provided by this application, in a packet transmission process, API call information is recorded and a topology discovery server determines, by analyzing the API call information collected, whether there is interaction between virtual machines in a cluster of virtual machines. By using the aforementioned analysis manner, the topology discovery server can further determine an interaction frequency that occurs between virtual machines and to which the collected API call information refers, and can determine an application topology relationship between virtual machines according to the frequency of interaction of virtual machines. The aforementioned solution provides a method for discovering an application topology relationship between virtual machines in a virtualization situation, wherein an application topology relationship between virtual machines is determined by analyzing the API call information generated in a process ( ...).

Description

FIELD OF TECHNIQUE

[0001] The present invention relates to the field of IT technologies and, in particular, to a method, an apparatus and a system for discovering an application topology relationship.

BACKGROUND

[0002] With the arrival of the information age, the need for a computer network makes the reliability of computer network operation significantly important and a higher requirement is imposed on network management. According to a definition of an Open System Interconnection (OSI), there are mainly five functional domains for network management: fault management, configuration management, performance management, security management, and accounting management . Among the five functional domains, configuration management is a foundation, and main functions of configuration management include discovering a network topology structure and monitoring and managing a configuration state of a network device. All other functions are based on the network topology structure. Network topology discovery is performed for an end-to-end connection relationship in a network and a main objective is to obtain and maintain existence information of network nodes and connection relationship information of network nodes and draw a topology diagram of the entire network based on existence information and connection relationship information.

[0003] As a specific form of a network topology, an Application Topology in an IT system is a network communication relationship between virtual machines, and a network communication between virtual machines is generated based on applications run by virtual machines. More specifically, application topology is a relationship of employment of application components (such as a program, a service, a component, and a virtual machine that runs the application) on hosts (such as servers) in the IT system and a relationship of interaction (such as a service request and response) between the employed application components.

[0004] Existing application topology discovery is an active detection discovery. Active sensing is an action of studying an application framework and an application user by sending a related sensing data packet to a network target and observing, recording, and returning a result. Due to the fact that a large amount of data needs to be sent to a network, the load on the network is increased and the accuracy of topology discovery is low. In the prior art, there is a lack of a method for discovering an application topology without the use of a detection data packet in a virtualization environment.

SUMMARY

[0005] This application describes a method, an apparatus and a system for discovering an application topology relationship and provides an application topology discovery solution for a virtualization environment so as to reduce the complexity of establishing an application topology relationship application topology between virtual machines.

[0006] According to one aspect, this application provides a method for discovering an application topology relationship, wherein the method includes: collecting at least two sets of API call information, wherein each set of API call information API corresponds to an API call, and each set of API call information includes an identifier of a virtual machine that corresponds to the API call, an occurrence time of the API call, and a packet flow direction of the API call; analyze the aforementioned collected API call information and determine first API call information and second API call information that meet a first condition, wherein the fact that the first API call information and the second API call information of APIs meeting the first condition includes: a packet flow direction in the first API call information and a packet flow direction in the second API call information are mutually opposite and a difference between an occurrence time of an API call API in the first API call information and an occurrence time of an API call in the second API call information is less than or equal to a predefined threshold; Since meeting the first condition means that an interaction time exists between two virtual machines in the first API call information and the second API call information, determining whether the interaction frequency of a first virtual machine indicated by the first API call information calling the API and a second virtual machine indicated by the second API calling information meeting a second condition; and, if the interaction frequency of the first virtual machine and the second virtual machine meets the second condition, determine that an application topology relationship exists between the first virtual machine and the second virtual machine.

[0007] According to the method for discovering an application topology relationship provided by this application, API call information in a packet transmission process is collected and the existence of interaction between two virtual machines corresponding to two sets of API call information is determined by correlating whether the two sets of API call information meet a first condition. Using the previously mentioned manner, a topology discovery server can determine the frequency of interaction, involved in the collected API call information, of virtual machines and an application topology relationship between the virtual machines is determined according to the frequency of interaction of virtual machines. The aforementioned solution provides a method for discovering an application topology relationship between virtual machines in a virtualization case, wherein an application topology relationship between virtual machines is determined by analyzing API call information generated in a streaming process of package and therefore the complexity of the solution is relatively low.

[0008] In a possible deployment manner, in addition to packet flow directions and the difference between the occurrence times of API calls, protocols for communications involved by API calls also need to be considered. Specifically, each set of API call information further includes a communications protocol; and correspondingly, the fact that the first API call information and the second API call information meet the first condition further includes: a communications protocol on the first API call information and a communications protocol on the second API call information is the same. That is, only when the protocols for communications on the two sets of API call information are the same, an application topology relationship can exist between two virtual machines that correspond to the two sets of API call information; and when the protocols for communications in the two sets of API call information are different, although the requirements on the packet flow directions and the difference between the occurrence times of the API calls are met, it is still not considered that there is interaction between the two virtual machines that correspond to the two sets of API call information. The accuracy of identification interaction between virtual machines is improved by specifying protocols for communications at a packet transmitting end and a packet receiving end.

[0009] In one possible deployment manner, determining whether the interaction frequency of the first virtual machine and the second virtual machine meets a second condition includes: analyzing at least two sets of API call information on the first virtual machine and at least two sets of API call information on the second virtual machine, determine the interaction frequency of the first virtual machine and the second virtual machine, compare the interaction frequency with the predefined frequency, and when the interaction frequency is greater than the frequency predefined, determine that the interaction frequency meets the second condition. Using the predefined frequency as a basis for determining whether an application topology relationship exists between virtual machines, persons skilled in the art can adjust the aforementioned predefined frequency to control the strictness of determining an application topology relationship. The preset frequency may also be set according to a requirement that is not limited by an embodiment of the present invention.

[0010] In a possible deployment manner, before comparing the interaction frequency with the predefined frequency, the method further includes: determining whether the first virtual machine and the second virtual machine are on the same network segment, and, when the first virtual machine and the second virtual machine are on the network segment, correct one of the interaction frequency or the predefined frequency according to a predefined weighting coefficient; and comparing the interaction frequency with the predefined frequency includes: comparing the corrected interaction frequency with the predefined frequency; or compare the interaction frequency with the corrected predefined frequency.

[0011] In one possible deployment manner, a topology discovery server may determine, in at least the following two ways, whether the first virtual machine and the second virtual machine are on the same network segment: way 1: determining whether a IP address of the first virtual machine and an IP address of the second virtual machine are on the same network segment; and Way 2: Determine whether a Virtual eXtensible Local Area Network (VXLAN) identifier of the first virtual machine and a VXLAN identifier of the second virtual machine are the same, where the two identifiers are the same, this indicates that the first virtual machine and the second virtual machine are on the same network segment.

[0012] It is more possible for virtual machines on the same network segment to have an application topology relationship than virtual machines on different network segments. Therefore, in one embodiment of the present invention, weighting is performed on the interaction frequency of virtual machines in the same network segment or the predefined frequency is reduced, to increase the accuracy of discovering an application topology relationship.

[0013] In one possible deployment manner, in a process of sending a package from the first virtual machine to the second virtual machine, API call information may be stored in a log file on a deployed host of the first virtual machine and the second virtual machine and the topology discovery server reads the API call information from the log file. Alternatively, an agent module is installed on each host and the topology discovery server receives API call information reported by the host's agent module.

[0014] In one possible deployment manner, in a packet transmission process, API call information may be written to a log file in the following ways: When a virtual machine calls an API to send a packet to a VMM where the virtual machine is located, write, through the virtual machine, a virtual switch in the VMM the VMM, API call information to a log file on a deployed host of the virtual machine; monitor, through an agent module in the deployed host of a virtual machine, a process of transmitting a packet on the host and recording API call information corresponding to an API call in the transmission process in a log file on the deployed host of the virtual machine; receive, through an on-host agent module deployed from a virtual machine, API call information that corresponds to an API call in an on-host packet transmission process and is sent through the virtual machine, a virtual switch, or a VMM, and write the received API call information to a log file on the virtual machine's deployed host; or when a VMM of a virtual machine calls an API to send a packet to the virtual machine, writes, through one of the virtual machine, a virtual switch in the VMM or the VMM, API call information to the log file on the host deployed from the virtual machine.

[0015] Specifically, any of the virtual machine, virtual switch, or VMM on the host can report API call information to the agent module by calling a topology information reporting API function.

[0016] In one possible deployment manner, an agent module is installed on each host and is configured to collect API call information on the host; and the agent module can monitor a virtual machine, a virtual switch and a VMM on the host, obtain API call information, and write the obtained API call information to a log file; or, after obtaining API call information, the agent module reports the API call information to the topology discovery server.

[0017] In one possible deployment manner, the API call includes an input API function call and an output API function call. Specifically, a VMM in which a virtual machine is located calls an output API function to send a packet to the virtual machine; and the virtual machine calls an input API function to send a packet to the VMM where the virtual machine is located.

[0018] In one possible deployment manner, the API call information may additionally include an identifier of a source virtual machine and an identifier of a target virtual machine; In this case, it can be learned, according to a set of API call information, that an interaction time exists between the source virtual machine and the target virtual machine.

[0019] Additionally, in terms of a block of virtual machines in a system, the topology discovery server determines an application topology relationship between virtual machines in the block of virtual machines and generates an application topology view of the block of machines virtual.

[0020] The topology discovery server is an independent physical server; or the topology discovery server is arranged together, in a form of a functional module, with other physical servers in the system.

[0021] In one possible deployment manner, virtual machines in a specific application topology relationship can be executed on the same host or on different hosts. When virtual machines run on different hosts, two hosts transmit the packet over an external physical network. In a specific transmission method, various transmission protocols and network transmission definitions may be used, and this order does not impose limitations on a transmission network structure.

[0022] According to another aspect, an embodiment of the present invention provides another method for discovering an application topology relationship. A difference from the aforementioned method for application topology relationship discovery is that an identifier of a virtual machine in each set of API call information recorded in this embodiment includes both an identifier of a source virtual machine at a transmission end of packet and an identifier of a destination virtual machine on a packet receiving end. In this case, it is determined, according to a set of API call information, that an interaction time exists between two virtual machines. Specifically, API call information is obtained, wherein the API call information includes an identifier of a source virtual machine and an identifier of a target virtual machine and the API call information corresponds to an API call; it is determined that an interaction time exists between the source virtual machine and the target virtual machine; and collected API call information is analyzed and it is determined, according to the interaction frequency of the first virtual machine and the second virtual machine, that an application topology relationship exists between the first virtual machine and the second virtual machine.

[0023] According to yet another aspect, an embodiment of the present invention provides a topology discovery server, wherein the topology discovery server specifically implements functions of the aforementioned methods. Functions can be implemented using hardware, or they can be implemented by running corresponding software using hardware. The hardware or software includes one or more modules that correspond to the functions mentioned above.

[0024] In one possible design, a topology discovery server structure includes a processor and a memory, wherein the processor is configured to support the topology discovery server in implementing corresponding functions in the aforementioned methods. The topology discovery server may further include memory, wherein the memory is configured to be coupled to the processor and to store a program instruction and data that are required by the topology discovery server to implement the aforementioned functions.

[0025] According to yet another aspect, an embodiment of the present invention provides a system for discovering an application topology relationship, which includes a topology discovery server and at least one host, wherein multiple virtual machines are running on the at least one at least one host and the topology discovery server determines, by obtaining API call information generated when an API is called in a packet transmission process, whether an application topology relationship exists between two virtual machines. Specifically, the topology discovery server, virtual machines, an agent module and the like deploy functions in the method to discover an application topology relationship in the first aspect. Functions can be implemented using hardware, or they can be implemented by running corresponding software using hardware. The hardware or software includes one or more modules that correspond to the functions mentioned above.

[0026] Optionally, the system for performing the method for discovering an application topology relationship may further include a database, wherein the database is configured to store the application topology relationship and a topology view of application. The system may further include a management node, wherein the management node manages virtual machines according to an application topology relationship between the virtual machines so as to improve management efficiency.

[0027] In one possible design, the host includes a processor and a memory, wherein the processor is configured to support the host in implementing corresponding functions in the aforementioned system. The host may further include memory, wherein the memory is configured to be coupled to the processor and store a program instruction and data that are required by the processor to implement the aforementioned functions.

[0028] According to yet another aspect, an embodiment of the present invention provides a computer storage medium, wherein the computer storage medium is configured to store a computer software instruction used by the aforementioned topology discovery server and includes a program designed to implement the previously mentioned functions.

[0029] According to a further aspect, an embodiment of the present invention provides a computer storage medium, wherein the computer storage medium is configured to store a computer software instruction used by the aforementioned host and includes a program designed to implement the previously mentioned functions.

[0030] According to the method, the apparatus and the system for discovering an application topology relationship provided by this application, API call information in a packet transmission process is collected and the existence of interaction between two virtual machines that correspond to two sets of API call information is determined by correlating whether the two sets of API call information meet a first condition. Using the previously mentioned manner, a topology discovery server can determine the frequency of interaction, involved in the collected API call information, of virtual machines and an application topology relationship between the virtual machines is determined according to the frequency of interaction of virtual machines. The aforementioned solution provides a method for discovering an application topology relationship between virtual machines in a virtualization case, wherein an application topology relationship between virtual machines is determined by analyzing API call information generated in a streaming process of package and therefore the complexity of the solution is relatively low.

BRIEF DESCRIPTION OF DRAWINGS

[0031] To describe the technical solutions in the embodiments of the present invention or in the prior art more clearly, the following briefly describes the attached drawings necessary to describe the embodiments of the prior art. Of course, the attached drawings in the following description merely show some embodiments of the present invention and persons of ordinary skill in the art can derive other ways of implementing these attached drawings without creative efforts. All these modalities or ways of implementation must fall within the scope of protection of the present invention.

[0032] Figure 1A is a schematic architectural diagram of a virtualization system possible in accordance with an embodiment of the present invention;

[0033] Figure 1B is a schematic architectural diagram of another virtualization system in accordance with an embodiment of the present invention;

[0034] Figure 1C is a schematic architectural diagram of yet another virtualization system in accordance with an embodiment of the present invention;

[0035] Figure 2 is a schematic diagram of a computer device in accordance with an embodiment of the present invention;

[0036] Figure 3A is a schematic diagram of a virtualization structure and a host in accordance with an embodiment of the present invention;

[0037] Figure 3B is a schematic diagram of a virtualization structure in a host in a direct network interface card situation in accordance with an embodiment of the present invention;

[0038] Figure 3C is a schematic diagram of a virtualization structure in a host in another direct network interface card situation in accordance with an embodiment of the present invention;

[0039] Figure 4 is a schematic diagram of obtaining API call information through a collection agent through active discovery in accordance with an embodiment of the present invention;

[0040] Figure 5 is a schematic diagram of obtaining API call information through a collection agent through passive discovery in accordance with an embodiment of the present invention;

[0041] Figure 6 is a schematic flowchart of obtaining, when two virtual machines on the same host communicate with each other, API call information through a collection agent in accordance with an embodiment of the present invention;

[0042] Figure 7 is a schematic flowchart of obtaining, when two virtual machines on different hosts communicate with each other, API call information through a collection agent in accordance with an embodiment of the present invention;

[0043] Figure 8 is a schematic structural diagram of a system for discovering an application topology relationship in accordance with an embodiment of the present invention; It is

[0044] Figure 9 is a schematic structural diagram of a topology discovery server in accordance with an embodiment of the present invention.

DESCRIPTION OF MODALITIES

[0045] The technical solutions, according to embodiments of the present invention, are clearly and completely described below with reference to the attached drawings. Apparently, the described embodiments are merely some, but not all, embodiments of the present invention. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments of the present invention without creating effort shall fall within the scope of protection of the present invention.

[0046] A network architecture and a service situation described in the embodiments of the present invention are used to describe the technical solutions of the embodiments of the present invention more clearly and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Persons of ordinary skill in the art may know that, with the evolution of network architecture and the occurrence of new service scenarios, the technical solutions provided by embodiments of the present invention are also applicable to similar technical problems.

[0047] Since there is a lack of a method for discovering an application topology relationship dedicated to a virtualization environment at a virtualization level in the prior art, embodiments of the present invention provide a method, an apparatus, and a system for discover an application topology relationship between virtual machines in a virtualization environment that can precisely identify an application topology relationship between virtual machines in a block of virtual machines. Specifically, embodiments of the present invention provide a topology discovery server configured to collect application programming interface (API) call information used in communication between virtual machines on each host. The topology discovery server analyzes the API call information collected from each host and generates an application topology relationship between the virtual machines.

[0048] As shown in Figure 1A, Figure 1A is a schematic architectural diagram of a virtualization system in accordance with an embodiment of the present invention. A topology discovery server is connected to each host and is configured to collect API call information on the host. The topology discovery server can also store an application topology relationship between virtual machines in a database. When a management node needs to perform a management operation according to the application topology relationship between virtual machines, the management node obtains the application topology relationship between virtual machines. Specifically, functions of each component shown in Figure 1A are described as follows:

[0049] Each host is a physical server and several virtual machines run on the host.

[0050] Collection Agent: A Collection Agent is deployed on a host and is configured to collect API call information generated when each virtual machine, virtual switch, or Virtual Machine Monitor. VMM) on the host transmits a packet. The collection agent sends the collected API call information to the Topology Discovery Server, and the Topology Discovery Server analyzes the collected API call information, so as to finally obtain a topology relationship. application between virtual machines. The collection agent can monitor the virtual machines, virtual switch, or Virtual Machine Monitor (VMM) on the host and log API call information when a packet is known to be sent or received; or the virtual machine, virtual switch, or VMM reports API call information to the collection agent after sending or receiving a packet.

[0051] In one example, after collecting the API call information, the collection agent may send the collected API call information to the topology discovery server periodically or at an appropriate time (e.g., when the host or a network is idle).

[0052] In another example, the collection agent may actively push the API call information to the topology discovery server or push the API call information to the topology discovery server after passively receiving a topology discovery server request. Alternatively, the collection agent saves the API call information in the storage space shared with the topology discovery server, and the topology discovery server autonomously reads the API call information.

[0053] It should be noted that this embodiment of the present invention imposes no limitation on a specific manner of transmitting the API call information between the collection agent and the topology discovery server, as long as the topology discovery server can Get the API call information from each host.

[0054] It should also be noted that the aforementioned collection agent is optional and when no collection agent is on the host, the virtual machine, virtual switch or VMM can report the API call information to the discovery server topology in a manner similar to that used by the collection agent.

[0055] Topology discovery server: The topology discovery server collects API call information from each host connected to the topology discovery server, analyzes the collected API call information to obtain an application topology relationship between machines virtual and stores the application topology relationship in a database. Additionally, the topology discovery server can generate an application topology view according to the application topology relationship obtained between virtual machines.

[0056] Each set of API call information includes: an identifier of a virtual machine, an occurrence time of an API call, and a packet flow direction. The virtual machine identifier is an identifier of a virtual machine that receives or sends a packet. API call occurrence time is a time at which the API call is performed. The packet flow direction includes ingress or egress, where ingress refers to a packet being sent from a virtual machine to a VMM and egress refers to a packet being emitted from a VMM to a virtual machine. In an example, the API call occurrence time may further be a time in which a log is recorded, the duration of the entire call, or a time in which the occurrence of the call is monitored. Each set of API call information may further include a communications protocol, and the communications protocol is a communications protocol used when the virtual machine performs communication. The communications protocol may be the HyperText Transfer Protocol (HTTP), the User Datagram Protocol (UDP), the Transmission Control Protocol/Internet Protocol/ Internet Protocol, TCP/IP Protocol) and the like. The virtual machine identifier can be an IP address of the virtual machine. For example, the API call information is (VM1, t1, P1, Input), which indicates that a VM1 calls an input function at a time t1 using a P1 protocol to transmit a packet to a virtual switch VSwitch or a VMM. The API call information is (VM2, t2, P2, Output), which indicates that a virtual switch or a VMM calls an output function at a time t2 using a P2 protocol to transmit a packet to a VM2 .

[0057] It should be noted that when the host uses a direct network interface card solution, a packet is transmitted from a VMM to a physical network interface card rather than through a virtual switch.

[0058] The topology discovery server analyzes the API call information collected from each host, identifies the interaction frequency of virtual machines, and determines an application topology relationship between the virtual machines.

[0059] In an example, an API target of API call information is an input API function and an output API function.

[0060] In one example, a source virtual machine sends a packet to a destination virtual machine. When a protocol used by the source virtual machine to send the packet is the same as a protocol used by the destination virtual machine to receive the packet and a time Ts by which the source virtual machine calls an API to send the packet and a time Te by which the target virtual machine receives an API call from the package are within an acceptable custom predefined threshold, an interaction time is considered to occur between the source virtual machine and the target virtual machine. Additionally, in a period of time, if the interaction frequency of two virtual machines is greater than the predefined frequency, it is determined that an application topology relationship exists between the two virtual machines.

[0061] By way of example, the following shows examples of API call information collected by the topology discovery server in this request:

[0062] The topology discovery server analyzes the aforementioned API call information and determines first API call information and second API call information that meet a first condition, wherein the fact that the first call information of API call information and the second API call information meet the first condition includes: a packet flow direction in the first API call information and a packet flow direction in the second API call information are mutually opposite and a difference between an occurrence time of an API call in the first API call information and an occurrence time of an API call in the second API call information is less than or equal to a predefined threshold; Since meeting the first condition means that an interaction time exists between two virtual machines in the first API call information and the second API call information, it further determines whether the interaction frequency of a first virtual machine indicated by the first API call information and a second virtual machine indicated by the second API call information meets a second condition; and if the interaction frequency of the first virtual machine and the second virtual machine meets the second condition, determine that an application topology relationship exists between the first virtual machine and the second virtual machine.

[0063] The aforementioned analysis process provides a method in which the topology discovery server determines an application topology relationship between virtual machines according to API call information. Specifically, when a communications protocol is considered, the analysis process can be summarized as the following three determination processes: way 1: determine which packet flow directions in the two sets of API call information are respectively input and output; Way 2: Determine which protocols for communications in the two sets of API call information are the same; or way 3: determine that the difference between the occurrence times of API calls in the two sets of API call information is less than or equal to the predefined threshold (namely the second condition mentioned above).

[0064] The three previously mentioned determination processes are expressed as follows in a programming language:If( Protocol == Protocol && |(Time1 – Time1’)| < T && Input⇔Output)

[0065] Then, an interaction time occurs between VM1 and VM1’.

[0066] It should be noted that this embodiment of the present invention imposes no limitation in that the topology discovery server deploys the three aforementioned determination processes at the same time and the topology discovery server can deploy the three aforementioned determination processes previously in a different sequence according to a requirement. For example, when no communications protocol is considered, in terms of collected API call information, the topology discovery server may first filter the API call information according to an API call occurrence time, select information finally filtered to determine an application topology relationship between virtual machines.

[0067] Still further, when a block of virtual machines uses the same communications protocol or the majority of virtual machines in a block of virtual machines use the same communications protocol to perform communication, the aforementioned API call information may not include the communications protocol. Correspondingly, the topology discovery server does not need to determine whether the protocols for communications in the two sets of API call information are the same. In this case, the discovery efficiency of an application topology relationship is improved and the accuracy may be reduced.

[0068] In an example, the limit in determination way 3 can be defined according to a requirement. Specifically, a real network load state can be considered, which is not limited by this embodiment of the present invention.

[0069] The topology discovery server cross-references the collected API call information to obtain the interaction frequency of any two virtual machines. When the interaction frequency is greater than a predefined interaction frequency, an application topology relationship is considered to exist between the two virtual machines. The Topology Discovery Server stores the application topology relationship between virtual machines in a database. It should be noted that the Topology Discovery Server can cross-reference API call information from an API call that occurs in a period of time and use an interaction time obtained between virtual machines as the interaction frequency, the period of time can be defined according to a requirement. Correspondingly, the preset frequency can also be set according to a requirement that is not limited by this embodiment of the present invention.

[0070] It should be noted that an error can be generated predictably when the interaction between virtual machines is calculated in the aforementioned manner. For example, in a case where protocol is not considered, if a virtual machine calls an inbound API function at a time t1 to send a packet to a VMM and the packet's destination virtual machine is a virtual machine b, Registered API call information is (a, t1, in). Virtual machine b receives, at time t2, the packet that is from virtual machine a and is forwarded by VMM and the registered API call information is (b, t2, out). A virtual machine c receives, at time t2, a packet that is from a virtual machine X and is forwarded by VMM and the registered API call information is (b, t2, out). A difference between t1 and t2 is less than a predefined interval, according to the previously mentioned rule, it can be learned that an interaction time exists between virtual machine a and virtual machine b; and an interaction time exists between virtual machine a and virtual machine c. Apparently, in this case, since the package from virtual machine c is from virtual machine X, no interaction exists between virtual machine a and virtual machine c.

[0071] It should be noted that, in a real product deployment situation, when there is a large amount of package exchanges between virtual machines, the aforementioned error is relatively small and does not cause apparent impact on an application topology relationship between huge virtual machines. Therefore, the aforementioned error is acceptable.

[0072] It should also be noted that, in some cases, virtual machine identifiers in the API call information may all include an identifier of a source virtual machine and an identifier of a target virtual machine. In this case, theoretically, it can be determined by recording a set of API call information that an interaction time exists between the source virtual machine and the target virtual machine. In this application, to ensure calculation efficiency, whether the API call information includes identifiers of two communicating groups or just one identifier of a communicating group, whether the existence of interaction between virtual machines can be determined in this application according to the aforementioned analysis method. That is, in terms of API call information whose packet flow direction is inbound, only the source virtual machine identifier in the API call information is used. In terms of API call information whose packet flow direction is outbound, only the target virtual machine identifier in the API call information is used. Regarding two types of API call information formats, the existence of interaction between virtual machines is determined according to the three previously mentioned determination processes without a need to separately perform the calculation for the two types of API call information formats. API call, so that analysis efficiency can be improved effectively.

[0073] Management node: A management node can be a functional entity such as VMware Vcenter and FusionManager that needs to obtain a network topology from a virtual machine. The management node reads an application topology relationship from the topology discovery server or the aforementioned database.

[0074] In one example, the topology discovery server may be an independent physical server or the topology discovery server serves as a functional module and is arranged together with other physical servers, such as the management node.

[0075] As shown in Figure 1B, Figure 1B is a schematic architectural diagram of another virtualization system in accordance with an embodiment of the present invention and a difference from Figure 1A is that a host does not include a collection agent and the API call information is stored in a log file or sent directly to a topology discovery server through a VM, virtual switch, or VMM.

[0076] As shown in Figure 1C, Figure 1C is a schematic architectural diagram of yet another virtualization system in accordance with an embodiment of the present invention. In this case, a topology discovery server and a management node are arranged together, and the functions of the aforementioned topology discovery server are implemented by a topology discovery module on the management node.

[0077] Virtualization architectures provided in Figure 1B and Figure 1C are enhancements based on Figure 1A. Component functions in virtualization architectures are similar to those in Figure 1A, can be adaptively modified according to changes in architectures, and can also implement API call information reporting and analysis functions. The functions of the components in Figure 1B and Figure 1C are not repeatedly described in embodiments of the present invention.

[0078] An application topology relationship is widely applied, for example, virtual machines that belong to the same application topology grouping should be better placed in a network covered by the same switch or a similar network, in order to reduce the interaction time. If groupings of virtual machines in a system need to be updated in batches, virtual machines from the same application topology grouping should best be updated in the same batch. Groupings of virtual machines in an application topology relationship should best be placed on the same server or an adjacent server. Virtual machine clusters in an application topology relationship and corresponding backup clusters must be placed on different servers. Virtual machines that correspond to an entire application topology grouping should also be better migrated during migration and the like. When a management node that deploys the previously mentioned functions needs to use an application topology of a virtual machine, the application topology can be obtained from the topology discovery server.

[0079] A collection agent and a topology discovery server can be deployed using hardware/software. Exemplarily, as shown in Figure 2, Figure 2 is a schematic diagram of a computer device in accordance with one embodiment of the present invention. A computer device 200 includes at least one processor 201, a communications bus 202, a memory 203, and at least one communications interface 204.

[0080] Processor 201 may be a central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling program execution in a solution of the present invention.

[0081] Communications bus 202 may include a path for transferring information between the aforementioned components. Communications interface 204 is a device that uses any type of transceiver and is configured to communicate with another device or a communications network, such as Ethernet, radio access network (RAN), or a Wireless Local Area Network. Area Networks, WLAN).

[0082] Memory 203 may be a readonly memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of a dynamic storage device that can store information and instructions, or it may be an Electrically Erasable Programmable Read-Only Memory, EEPROM, a Compact Disc Read-Only Memory , CD-ROM) or other compact disc storage, optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, and the like) a magnetic disk or other magnetic storage device or any other medium that can be used to carry or store an expected program code in a form of an instruction or a data structure and can be accessed by a computer that is not limited. Memory can exist independently and is connected to the processor using the bus. Memory can also be integrated into the processor.

[0083] Memory 203 is configured to store an application program code for executing a solution of the present invention and is implemented through control of the processor 201. The processor 201 is configured to execute the application program code stored in the memory 203.

[0084] In a specific implementation, as one embodiment, the processor 201 may include one or more CPUs, e.g., a CPU0 and a CPU1 in Figure 2.

[0085] In a specific implementation, as one embodiment, the computer device 200 may include multiple processors, e.g., the processor 201 and a processor 208 in Figure 2. Each of the processors may be a single-core processor (single CPU ) or it can be a multi-core processor (multi-CPU). The processor herein may refer to one or more devices, circuits and/or processing cores for processing data (e.g., a computer program instruction).

[0086] In a specific implementation, as one embodiment, the computer device 200 may further include an output device 205 and an input device 206. The output device 205 communicates with the processor 201 and may display information from multiple ways. For example, the output device 205 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube display device, and a cathode ray tube display device. ray tube, CRT), a projector (projector) or similar. Input device 206 communicates with processor 201 and can receive input from a user in multiple ways. For example, the input device 206 may be a mouse, a keyboard, a touch screen device, a sensing device, or the like.

[0087] The aforementioned computer device 200 may be a general purpose computer device or a dedicated computer device. In a specific deployment, the computer device 200 may be a desktop computer, a portable computer, a network server, a Personal Digital Assistant (PDA), a mobile phone, a tablet computer, a device of a wireless terminal, a communications device, an integrated device, or a device with a similar structure in Figure 2. This embodiment of the present invention imposes no limitation on a type of the computer device 200.

[0088] The collection agent, host, and topology discovery server in Figure 1A, Figure 1B, and Figure 1C may be a device shown in Figure 2. One or more software modules are stored in memory to deploy functions of the collection agent, the host, and the topology discovery server (for example, an API call information parsing function on the topology discovery server). The collection agent, host, and topology discovery server may implement, using processor usage and in-memory program code, a method for discovering an application topology between virtual machines.

[0089] It should be noted that the computer device shown in Figure 2 merely provides a means of possible hardware deployment of parts in a system to discover an application topology and hardware components of the computer device can be added or removed from according to a difference or a change of functions of the parts in the system, to correlate the functions of the parts in the system.

[0090] As shown in Figure 3A, Figure 3A is a schematic diagram of a virtualization structure on a host in accordance with an embodiment of the present invention. The host is a physical server, a bottom layer of the physical server is a hardware layer, and the hardware layer mainly includes hardware resources such as a central processing unit (CPU), a memory, a hard disk and a network interface card. Server virtualization refers to the deployment of a virtualized running environment of multiple virtual machines (Virtual Machine, VM) on a physical server using virtualization software (such as VMWare ESX and Citrix XEN). A software layer installed on the server to deploy a virtualized environment is called VMM. The VMM running at the hardware layer is responsible for scheduling, allocating, and managing hardware resources at the hardware layer. Multiple virtual machines VMs run in VMM, and VMM provides each virtual machine with a hardware environment such as a virtualized CPU, memory, storage, an IO device (such as a network interface card), and an Ethernet switch , in order to ensure that the multiple virtual machines run in an isolated manner from each other.

[0091] In a virtualized running environment, VMM creates a Virtual Network Interface Card (vNIC) for each virtual machine and a VSwitch virtual switch provides a communication capability for virtual machines and a virtual machine and an external network. For VSwitch running on VMM, a virtual network interface card for each virtual machine corresponds to a logical port on the VSwitch, and a physical host network interface card corresponds to a port that connects the VSwitch to an external physical switch.

[0092] One process of receiving a packet through a virtual machine is: the VSwitch receives an Ethernet packet from the physical network interface card and forwards the packet according to a correspondence table (i.e., a MAC table static) that is between a virtual machine's Media Access Control (MAC) address and a VSwitch logical port and that is delivered by VMM.

[0093] A process of sending a packet through a virtual machine is: when a MAC address of the packet is on an external network, the VSwitch directly sends the packet to the external network of the physical network interface card; and when a packet destination MAC address is connected to a virtual machine of the same VSwitch, the VSwitch forwards the packet using a static MAC table.

[0094] As shown in Figure 3B, Figure 3B is a schematic diagram of a virtualization structure in a host in a direct network interface card situation in accordance with an embodiment of the present invention. In this case, a physical network interface card is not virtualized, and each output port on the physical network interface card is allocated to a virtual machine. As shown in Figure 3C, Figure 3C is a schematic diagram of a virtualization structure in a host in another direct network interface card situation in accordance with an embodiment of the present invention. A difference from Figure 3B is that a physical network interface card is virtualized into multiple Virtual Function (VF) devices using a virtual machine, wherein the aforementioned network interface card virtualization technologies previously they can be Single-Root I/O Virtualization (SR-IOV) and Multi-Root I/O Virtualization (MR-IOV). The virtual function devices may share a physical resource (such as a network interface card port) of the physical network interface card, and the virtual function devices may also be mapped to a virtual machine system on the host.

[0095] The method for discovering an application topology relationship provided by embodiments of the present invention is also applicable to scenarios shown in Figure 3B and Figure 3C. In this case, a virtual machine can directly call an output interface of a physical network interface card to transmit a packet, so as to skip a virtual switch in a VMM. An agent module can obtain API call information from a virtual machine or VMM. For example, in a direct network interface card situation, when the virtual machine calls an input API function to transmit a packet to the physical network interface card using VMM, the virtual machine or VMM can record the API call information in a log file or may directly transmit the API call information to a collection agent; or a collection agent monitors packet transmission between the virtual machine, VMM, and physical network interface card and records the API call information in a log file.

[0096] The collection agent can collect the API call information through two means: active discovery and passive discovery. As shown in Figure 4, Figure 4 is a schematic diagram of obtaining API call information through a collection agent through active discovery in accordance with an embodiment of the present invention. As shown in Figure 5, Figure 5 is a schematic diagram of obtaining API call information through a collection agent via passive discovery in accordance with an embodiment of the present invention. Active discovery refers to when a virtual machine calls an input API function (Port_Input API), the virtual machine, a virtual switch, or a VMM writes API call information to a log file, or when a virtual switch calls an output API function (Port_Output API), a virtual machine, virtual switch, or a VMM writes API call information to a log file, and a collection agent can obtain the API call information from the log by scanning the log file; and passive discovery refers to a topology information reporting API function (Topo_Info_API) used to report API call information to a collection agent being added, and when a virtual machine calls an input API function (API of Port_Input) to transmit a packet using a VMM, the virtual machine, a virtual switch, or the VMM calls the topology information reporting API function to send currently called API call information to the collection agent, or when a virtual switch calls an output API function (Port_Output API), a virtual machine, the virtual switch, or a VMM calls the topology information reporting API function to send currently called API call information to the collection agent.

[0097] It should be noted that for different operating systems, the input API function, the output API function and the topology information report API function mentioned above may be in different formats, which is not limited by this embodiment of the present invention. Persons skilled in the art can understand that the aforementioned functions can separately implement input, output and reporting functions. API functions can be searched using an API function reference book. By way of example, the Windows API Function Reference Manual published by Post & Telcom Press is a reference manual for a Microsoft Win32 API function; and for operating systems of other versions or types, corresponding input API functions and output API functions can also be looked up using related reference books.

[0098] It should also be noted that storing API call information in a log file is merely an example. The API call information may also be stored in other files or other locations from which the collection agent can obtain the API call information.

[0099] A topology discovery server collects API call information from hosts and each set of API call information corresponds to an API call. In embodiments of the present invention, the API call specifically includes an input API function call and an output API function call. A source virtual machine at a packet transmitting end calls an inbound API function to transmit a packet to a VMM, the VMM transmits the packet to a VMM at a packet receiving end across a network, and the VMM at the The packet receiving end calls an output API function to send the packet to a destination virtual machine. In the aforementioned process, both a host at the packet transmitting end and a host at the packet receiving end register a set of API call information, and each set of API call information includes an identifier of a virtual machine that corresponds to the API call, an occurrence time of the API call, and a packet flow direction of the API call; and may also include a communications protocol. The topology discovery server analyzes the collected API call information. When a difference between occurrence times of API calls in the two sets of API call information is smaller than a predefined threshold and the packet flow directions in the two sets of API call information are mutually opposite (one is input and the other is output), an interaction relationship exists between two virtual machines that correspond to two identifiers of the virtual machines in the two sets of API call information, such that the interaction frequency of the two virtual machines is determined. If the interaction frequency of the first virtual machine and the second virtual machine meets the second condition, it is determined that an application topology relationship exists between the first virtual machine and the second virtual machine. Specifically, the interaction frequency of the first virtual machine and the second virtual machine is determined, the interaction frequency is compared with the predefined frequency, and when the interaction frequency is greater than the predefined frequency, it is determined that the interaction frequency meets to the second condition. Apparently, the two virtual machines that correspond to the two virtual machine identifiers in the two previously mentioned sets of API call information are different. The aforementioned solution provides a method for discovering an application topology relationship between virtual machines in a virtualization case, wherein an application topology relationship between virtual machines is determined by analyzing API call information generated in a streaming process of package and therefore the complexity of the solution is relatively low.

[0100] With reference to the schematic diagram of a virtualization structure on a host shown in Figure 3A, as shown in Figure 6, Figure 6 is a schematic flowchart of obtaining when two virtual machines on the same host communicate with each other. another, of API call information through a collection agent in accordance with an embodiment of the present invention. The collection agent runs on the host and serves as a functional module of the host. A VM1 and a VM2 (two VMs are used as an example for description in this embodiment of the present invention) are running on the host, a virtual network interface card of VM1 is a vNIC1 and a virtual network interface card of VM2 is a vNIC2, a port, on a virtual switch, that corresponds to vNIC1 is a Port1, and a port on the virtual switch, that corresponds to vNIC2 is a Port2. It should be noted that allocating a virtual network interface card to a virtual machine and establishing a correspondence between a virtual network interface card and a port of a virtual switch are common technical means in the art and a specific process thereof is not described repeatedly in this embodiment of the present invention. One method shown in Figure 6 includes:

[0101] Step 601: When VM1 needs to send a packet to VM2, VM1 calls an input API function (Port_Input API) of a VMM and sends the packet to Port1 of the virtual switch using vNIC1.

[0102] Step 602: The virtual switch determines, by searching a static MAC table, the destination MAC of the packet, and determines that a port of the virtual switch, which corresponds to VM2, is Port2.

[0103] Possibly, if VM1 does not know an address of VM2, the packet sent by VM1 to VM2 does not carry the address of VM2. In this case, the virtual switch broadcasts the packet from VM1 and sends the packet from VM1 to all VMs of the virtual switch in a broadcast manner, and then VM2 can receive the packet from VM1 and return a response.

[0104] Step 603: The virtual switch calls an output API function (Port_Output API) and sends the packet to the virtual network interface card vNIC2 of VM2 through Port2, and then VM2 receives the packet sent by VM1.

[0105] In step 601, since VM1 needs to call the input API function and an API call occurs, API call information needs to be registered and VM1 can register the API call information in two ways. follow5:

[0106] Way 1: VM1 calls an interface between VM1 and a collection agent and reports API call information; and specifically, VM1 calls a topology information reporting API function (Topo_Info API) of the collection agent and sends the API call information to the collection agent. It should be noted that this embodiment of the present invention imposes no limitation on a time in which VM1 sends the API call information to the collection agent. Optionally, VM1 can send the API call information when the network load is small.

[0107] Way 2: VM1 writes the API call information to a log file and the collection agent reads the API call information. It should be noted that this embodiment of the present invention imposes no limitation on a time in which the collection agent obtains the API call information from the log file. Optionally, the collection agent can periodically read the API call information from the log file, or VM1 instructs the collection agent to read the API call information after writing the API call information to the log file.

[0108] Still further, in addition to recording API call information through a VM, a virtual switch or VMM may also record API call information. Specifically, the virtual switch or VMM writes the API call information to the log file or sends the API call information to the collection agent when it receives the packet sent by VM1.

[0109] The API call information includes an identifier of a virtual machine, an occurrence time of an API call, a communications protocol, and a packet flow direction. Optionally, the virtual machine identifiers in the API call information may include an identifier for a source virtual machine and an identifier for a target virtual machine. In this case, it can be directly identified, according merely to a piece of API call information, that an interaction time occurs between the source virtual machine and the target virtual machine. It should be noted that when VM1 knows an address of the communication pair-end VM2, the registered API call information may include the source virtual machine identifier and the target virtual machine identifier. The aforementioned communications protocol may be the HTTP protocol, the TCP/IP protocol, the UDP protocol or similar.

[0110] In step 603, once the virtual switch calls the output API function (Port_Output API) and an API call occurs, API call information needs to be recorded. Similar to VM1, the virtual switch can also record API call information in the following two ways:

[0111] Way 1: The virtual switch calls an interface between the virtual switch and a collection agent and reports the API call information; and specifically, the virtual switch calls a topology information reporting API function (Topo_Info API) of the collection agent and sends the API call information to the collection agent. It should be noted that this embodiment of the present invention imposes no limitation on a time in which the virtual switch sends the API call information to the collection agent. The topology information reporting API function can be implemented using a HOOK function or modifying code, as long as the transmission of the API call information can be provided.

[0112] Way 2: The virtual switch writes the API call information to a log file, and the collection agent reads the API call information. It should be noted that this embodiment of the present invention imposes no limitation on a time in which the collection agent obtains the API call information from the log file.

[0113] Still further, in step 603, in addition to the virtual switch, the API call information may also be registered by a virtual machine (VM2) or the VMM, which is not repeatedly described in this embodiment of the present invention.

[0114] The method shown in Figure 6 provides a process for obtaining, when two virtual machines on the same host communicate with each other, API call information through a collection agent. With reference to the schematic diagram of a virtualization framework shown in Figure 3A, as shown in Figure 7, Figure 7 is a schematic flowchart of obtaining, when two virtual machines on different hosts communicate with each other, call information. API through a collection agent according to an embodiment of the present invention. The two hosts can use the virtualization framework shown in Figure 3A, and the hosts are connected by a physical switch. A VM1 and a virtual switch 1 run on a host 1, a VM2 and a virtual switch 2 (two VMs are used as an example for describing this embodiment of the present invention) run on a host 2, a network interface card virtual network interface card of VM1 is a vNIC1 and a virtual network interface card of VM2 is a vNIC2, a port on virtual switch 1, which corresponds to vNIC1, is a Port1, and a port on virtual switch 2, which corresponds to vNIC2 is a Port2 . It should be noted that allocating a virtual network interface card to a virtual machine and establishing a correspondence between a virtual network interface card and a port of a virtual switch are common technical means in the art and a specific process thereof is not described repeatedly in this embodiment of the present invention. One method shown in Figure 7 includes:

[0115] Step 701: When VM1 needs to send a packet to VM2, VM1 calls an input API function (Port_Input API) of a VMM and sends the packet to Port1 of the virtual switch using vNIC1.

[0116] Step 702: Virtual switch 1 receives the packet on port1 and determines a destination MAC address and external network from the packet, and then virtual switch 1 sends the packet to the external network using a card host 1 physical network interface.

[0117] Step 703: The packet is forwarded, according to an existing packet forwarding rule, to a physical network interface card of host 2 where VM2 is located.

[0118] Step 704: Host 2 receives the packet using host 2's physical network interface card.

[0119] Step 705: Virtual switch 2 determines that a port corresponding to VM2 is Port2, and virtual switch 2 sends the packet to the virtual network interface card vNIC2 of VM2 via the Port2 port; and then VM2 receives the packet sent by VM1.

[0120] It should be noted that, in the aforementioned packet transmission process, the packet can be encapsulated and decapsulated according to an existing rule, which is not repeatedly described in this embodiment of the present invention.

[0121] In step 701, VM1 records the API call information in a manner similar to that defined in step 601. A collection agent on host 1 obtains the API call information.

[0122] In step 705, virtual switch 2 records the API call information in a manner similar to that defined in step 603. A collection agent on host 2 obtains the API call information.

[0123] It should be noted that, a distributed virtual switch can be used in this embodiment of the present invention, the distributed virtual switch can span multiple hosts, so that virtual machines on multiple hosts are similarly connected to the same virtual switch and virtual machines can be migrated between the previously mentioned multiple hosts or multiple distributed virtual keys can exist on one host. When a distributed virtual switch is used, a way of obtaining API call information through a collection agent is similar to that mentioned above, which is not repeatedly described in the present application.

[0124] In terms of the method processes shown in Figure 6 and Figure 7, when a host does not include a collection agent, a virtual machine or a virtual switch may report API call information directly to the topology discovery server. ways defined in Figure 6 and Figure 7.

[0125] According to the method for discovering an application topology relationship provided by this application, in a packet transmission process, API call information is recorded, and, if there is interaction between two virtual machines corresponding to two API call information sets is determined by correlating whether the two API call information sets meet a first condition. Using the previously mentioned manner, a topology discovery server can determine the frequency of interaction, involved in the collected API call information, of virtual machines and an application topology relationship between the virtual machines is determined according to the frequency of interaction of virtual machines. The previously mentioned solution provides a method for discovering an application topology relationship between virtual machines in a virtualization situation, where API call information needs to be registered by only two ends performing packet transmission, and therefore the complexity of solution is relatively low.

[0126] As shown in Figure 8, Figure 8 shows a system for discovering an application topology relationship in accordance with an embodiment of the present invention, wherein the system 80 includes a topology discovery server 81 and at least one host 82 and multiple virtual machines running on at least one host 82.

[0127] When a virtual machine 822 of the multiple virtual machines sends a packet or a VMM at least one host 82 forwards a packet to a virtual machine 822 of the multiple virtual machines, API application programming interface call information is generated.

[0128] Topology discovery server 81 is configured to collect at least two sets of API application programming interface call information, wherein each set of API call information corresponds to an API call and each set of API call information includes an identifier of a virtual machine that corresponds to the API call, an occurrence time of the API call, and a packet flow direction of the API call.

[0129] Topology discovery server 81 is further configured to analyze the at least two sets of API call information and determine first API call information and second API call information that meet a first condition, wherein the fact that the first API call information and the second API call information meet the first condition includes: a packet flow direction in the first API call information and a packet flow direction in the second information of API calls are mutually opposite and a difference between an occurrence time of an API call in the first API call information and an occurrence time of an API call in the second API call information is less than or equal to one predefined limit.

[0130] Topology discovery server 81 is further configured to determine whether the interaction frequency of a first virtual machine 822 indicated by the first API call information and a second virtual machine 822 indicated by the second API call information meets a second condition; and if it is determined that the frequency of interaction of the first virtual machine 822 and the second virtual machine 822 meets the second condition, determining that an application topology relationship exists between the first virtual machine 822 and the second virtual machine 822.

[0131] Additionally, each set of API call information further includes a communications protocol; and correspondingly, the fact that the first API call information and the second API call information meet the first condition further includes: a communications protocol on the first API call information and a communications protocol on the second API call information is the same.

[0132] Topology discovery server 81 is specifically configured to analyze at least two sets of API call information on the first virtual machine 822 and at least two sets of API call information on the second virtual machine 822, determine the frequency of interaction of the first virtual machine 822 and the second virtual machine 822, compare the interaction frequency with predefined frequency, and, when the interaction frequency is greater than the predefined frequency, determine that the interaction frequency meets the second condition.

[0133] Topology discovery server 81 is specifically configured to determine whether the first virtual machine 822 and the second virtual machine 822 are on the same network segment, and when the first virtual machine 822 and the second virtual machine 822 are on the same network segment. same network segment, correct one of the interaction frequency or the predefined frequency according to a predefined weighting coefficient and compare the corrected interaction frequency with the predefined frequency; or compare the interaction frequency with the corrected predefined frequency.

[0134] The topology discovery server 81 is specifically configured to separately read the at least two sets of API call information from a log file on the deployed host 82 of the multiple virtual machines; or the topology discovery server 81 is specifically configured to receive the at least two sets of API call information reported by an agent module on the deployed host of the multiple virtual machines.

[0135] Additionally, the API call includes an input API function call and an output API function call.

[0136] The system 80 for discovering an application topology further includes: the virtual machine 822, further configured to: when an API is called to send a packet to a VMM in which the virtual machine 822 is located or to receive a packet forwarded by VMM, writing API call information to a log file on the deployed host 82 of virtual machine 822; or an agent module in the deployed virtual machine 822 configured to write API call information corresponding to an API call in a packet transmission process to the log file in the deployed host 82 of the virtual machine 822.

[0137] Corresponding to the aforementioned system as shown in Figure 9, Figure 9 shows a topology discovery server in accordance with an embodiment of the present invention, wherein the topology discovery server includes: a get unit 91, configured to collect at least two sets of API application programming interface call information, wherein each set of API call information corresponds to an API call and each set of API call information includes an identifier of a machine virtual that corresponds to the API call, an occurrence time of the API call, and a packet flow direction of the API call; and an analysis unit 92, configured to analyze the at least two sets of API application programming interface call information and determine first API call information and second API call information that meet a first condition, wherein the fact that the first API call information and the second API call information meet the first condition includes: a packet flow direction in the first API call information and a packet flow direction in the second call information of APIs are mutually opposite and a difference between an occurrence time of an API call in the first API call information and an occurrence time of an API call in the second API call information is less than or equal to a predefined threshold .

[0138] The analysis unit 92 is further configured to determine whether the interaction frequency of a first virtual machine indicated by the first API call information and a second virtual machine indicated by the second API call information meets a second condition; and if the interaction frequency of the first virtual machine and the second virtual machine meets the second condition, determine that an application topology relationship exists between the first virtual machine and the second virtual machine.

[0139] Additionally, each set of API call information further includes a communications protocol; and correspondingly, the fact that the first API call information and the second API call information meet the first condition further includes: a communications protocol on the first API call information and a communications protocol on the second API call information is the same.

[0140] Analysis unit 92 is specifically configured to analyze at least two sets of API call information on the first virtual machine and at least two sets of API call information on the second virtual machine, determine the interaction frequency of the first virtual machine and the second virtual machine, compare the interaction frequency with the predefined frequency, and, when the interaction frequency is greater than the predefined frequency, determine that the interaction frequency meets the second condition.

[0141] The analysis unit 92 is specifically configured to determine whether the first virtual machine and the second virtual machine are on the same network segment, and, when the first virtual machine and the second virtual machine are on the same network segment, correct one of the interaction frequency or the predefined frequency according to a predefined weighting coefficient.

[0142] Analysis unit 92 is specifically configured to compare the corrected interaction frequency with the predefined frequency; or compare the interaction frequency with the corrected predefined frequency.

[0143] The obtaining unit 91 is specifically configured to separately read the at least two sets of API call information from a log file on a deployed host of the multiple virtual machines; or the obtaining unit 91 is specifically configured to receive the at least two sets of API call information reported by an agent module on a deployed host of the multiple virtual machines.

[0144] The API call includes an input API function call and an output API function call.

[0145] According to the method, apparatus and system for discovering an application topology relationship provided by this embodiment of the present invention, API call information in a packet transmission process is collected and if interaction exists between two virtual machines that match two sets of API call information is determined by correlating whether the two sets of API call information meet a first condition. By using the previously mentioned way, a topology discovery server can determine the frequency of interaction, involved in the API call information collected from virtual machines, and an application topology relationship between the virtual machines is determined according to the frequency interaction of virtual machines. The aforementioned solution provides a method for discovering an application topology relationship between virtual machines in a virtualization case, wherein an application topology relationship between virtual machines is determined by analyzing API call information generated in a streaming process of package and therefore the complexity of the solution is relatively low.

[0146] In embodiments corresponding to Figure 8 and Figure 9, the virtual machine, a collection agent, a virtual switch, and the topology discovery server are presented in the form of a functional unit/functional module. The “unit/module” in this document may refer to an application-specific integrated circuit (ASIC), a circuit, a processor configured to execute one or more software or firmware programs, and a memory, an integrated logic circuit and/or other device that can provide the aforementioned functions. In a simple embodiment, persons skilled in the art may think that a virtual machine, a collection agent, a virtual switch, and a topology discovery server may use a form shown in Figure 2. For example, the collection unit 901 and a processing unit 902 can be implemented using the processor and memory in Figure 2.

[0147] An embodiment of the present invention further provides a computer storage medium, wherein the computer storage medium is configured to store a computer software instruction used by the devices shown in Figure 8 and Figure 9 and includes a program designed to execute the modalities of the aforementioned method. A method for discovering an application topology relationship can be implemented by executing the stored program.

[0148] Although the present invention is described in the present document with reference to the embodiments, in a process of implementing the present invention that is necessary to be protected, persons skilled in the art can understand and implement other changes of the disclosed embodiments by viewing the drawings in attached, the disclosed contents and the attached claims. In the claims, the word “comprises” does not exclude other constituent parts or steps and “one” or “one piece” does not exclude a case of multiples. A single processor or other unit can implement multiple functions listed in the claims. Some measures are recorded in mutually different dependent claims, however, this does not mean that these measures cannot be combined to generate a satisfactory effect.

[0149] Persons skilled in the art should understand that embodiments of the present invention may be provided as a method, an apparatus (device) or a computer program product. Therefore, the present invention may use a form of hardware-only embodiments, software-only embodiments, or embodiments with a combination of software and hardware. Furthermore, the present invention may use a form of a computer program product that is implanted on one or more computer-usable storage media (including, but not limited to, a disk memory, a CD-ROM, an optical memory, and similar) that include computer-usable program code. A computer program is stored/distributed on an appropriate medium and is provided with other hardware or serves as a part of hardware and may also use other means of distribution, such as using the Internet or other wired or wireless telecommunications system. wire.

[0150] The present invention is described with reference to the flowcharts and/or block diagrams of the method, the apparatus (device) and other computer program product in accordance with embodiments of the present invention. It should be understood that computer program instructions can be used to implement each process and/or each block in the flowcharts and/or block diagrams and a combination of a process and/or a block in the flowcharts and/or diagrams. of blocks. These computer program instructions may be provided to a general purpose computer, a dedicated computer, an integrated processor, or a processor of any other programmable data processing device to generate a machine, so that the instructions executed by a computer or a processor of any other programmable data processing device generates an apparatus for implementing a specific function in one or more processes in the flowcharts and/or in one or more blocks in the block diagrams.

[0151] These computer program instructions may also be stored in a computer-readable memory that may instruct the computer or any other programmable data processing device to function in a specific manner, such that the instructions stored in the computer-readable memory computer generate an artifact that includes an instructional device. The instruction apparatus implements a specific function in one or more processes in the flowcharts and/or in one or more blocks in the block diagrams.

[0152] These computer program instructions may also be loaded into a computer or other programmable data processing device such that a series of operations and steps are performed on the computer or other programmable device, thereby generating implanted processing. by computer. Therefore, instructions executed on the computer or other programmable device provide steps to implement a specific function in one or more processes in the flowcharts and/or in one or more blocks in the block diagrams.

[0153] Although the present invention is described with reference to specific features and embodiments thereof, apparently, various modifications and combinations can be made to the present invention without departing from the scope of the present invention. Correspondingly, the specification and attached drawings are merely an exemplary description of the present invention defined by the attached claims and are considered to cover any and all modifications, alterations, combinations or equivalences within the scope of the present invention. Naturally, persons skilled in the art may make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. The present invention aims to cover these modifications and variations as long as they fall within the scope of protection defined by the following claims and their equivalent technologies.

Claims (16)

1. Method for discovering an application topology relationship running on a topology discovery server, CHARACTERIZED by the fact that the method comprises: collecting at least two sets of application programming interface, API, call information, wherein each set of API call information corresponds to an API call, wherein the at least two sets of API call information comprise first API call information and second API call information, the first API call information comprising an identifier of a first virtual machine that receives or sends a packet, an occurrence time of a first API call, and a packet flow direction of the first API that indicates that a packet is sent from the first virtual machine to a Monitor. Virtual Machine, VMM, or from the VMM to the first virtual machine, and the second API call information comprises an identifier of a second virtual machine that sends or receives a packet, an occurrence time of a second API call, and a packet flow direction of the second API indicating that a packet is sent from the second virtual machine to the VMM or from the VMM to the second virtual machine; analyze the at least two sets of API call information; For the first API call information and for the second API call information, determining whether a first condition is met, the first condition comprises conditions (1) and (2): (1) the difference between the occurrence time of the first API call and the occurrence time of the second API call is less than or equal to a predefined threshold; (2) the packet flow direction of the first API and the packet flow direction of the second API are mutually opposite; when it is determined that conditions (1) and (2) are both met for the first API call information and for the second API information, determine that the first API call information and the second API call information meet to the first condition; wherein meeting the first condition means presence of an interaction between the first virtual machine and the second virtual machine; When it is determined that the first condition is met for the first API call information and for the second API call information, further determine whether interaction frequency of the first virtual machine and the second virtual machine meets a second condition, wherein the interaction frequency of the first virtual machine and the second virtual machine meeting the second condition comprises: the interaction frequency of the first virtual machine and the second virtual machine being greater than a predefined frequency; and if the interaction frequency of the first virtual machine and the second virtual machine meets the second condition, determine that an application topology relationship exists between the first virtual machine and the second virtual machine. 2. Method, according to claim 1, CHARACTERIZED by the fact that the first set of API call information additionally comprises a first communications protocol, the second set of API call information additionally comprises a second communications protocol; and, correspondingly, that the first API call information and the second API call information meet the first condition further comprises: the first communications protocol in the first API call information and the second communications protocol in the second information of API calls are the same. 3. Method, according to claim 1 or 2, CHARACTERIZED by the fact that determining whether the frequency of interaction of the first virtual machine and the second virtual machine meets a second condition comprises: analyzing at least two sets of information from API call on the first virtual machine and at least two sets of API call information on the second virtual machine, wherein the at least two sets of API call information on the first virtual machine comprise the first and third API call information API call information, the at least two sets of API call information in the second virtual machine comprise the second API call information and fourth API call information; determine the interaction frequency of the first virtual machine and the second virtual machine, compare the interaction frequency with predefined frequency, and when the interaction frequency is greater than the predefined frequency, determine that the interaction frequency meets the second condition. 4. Method, according to claim 3, CHARACTERIZED by the fact that before comparing the interaction frequency with a predefined frequency, the method additionally comprises: determining whether the first virtual machine and the second virtual machine are on the same network segment , and when the first virtual machine and the second virtual machine are on the same network segment, correct one of the interaction frequency or the predefined frequency according to a predefined weighting coefficient; and comparing the interaction frequency with the predefined frequency comprises: comparing the corrected interaction frequency with the predefined frequency; or compare interaction frequency with corrected predefined frequency. 5. Method according to any one of claims 1 to 4, CHARACTERIZED by the fact that collecting at least two sets of API call information comprises: separately reading the at least two sets of API call information from a log file on a deployed host of multiple virtual machines; or receiving the at least two sets of API call information reported by an agent module on a deployed host of the multiple virtual machines. 6. Method, according to claim 5, CHARACTERIZED by the fact that, before separately reading the at least two sets of API call information from a log file on a deployed host of the multiple virtual machines, the method further comprises at least one of the following: way 1: When a virtual machine calls an API to send a packet to a Virtual Machine Monitor, VMM, in which the virtual machine is located, write, through any of the virtual machine, a switch virtual in VMM, or the VMM, API call information in the log file on the virtual machine's deployed host; way 2: writing, through an agent module on the deployed host of a virtual machine to the log file on the deployed host of the virtual machine, API call information corresponding to an API call in a packet transmission process; or way 3: when a VMM of a virtual machine calls an API to send a packet to the virtual machine, write, through any of the virtual machine, a virtual switch in the VMM, or the VMM, API call information to the log file on the virtual machine's deployed host. 7. Method, according to claim 5, CHARACTERIZED by the fact that before receiving the at least two sets of API call information reported by an agent module on a deployed host of the multiple virtual machines, the method further comprises: monitoring, through a deployed host agent module of a virtual machine, a transmission process of a packet in the host, and recording API call information corresponding to an API call in the transmission process; or receiving, through a deployed host agent module of a virtual machine, API call information that corresponds to an API call in an on-host packet transmission process and that is sent by the virtual machine, a virtual switch, or a VMM. 8. Topology Discovery Server, CHARACTERIZED by the fact that it comprises: a getting unit, configured to collect at least two sets of application programming interface, API, call information, wherein each set of API call information corresponds to an API call, wherein the at least two sets of API call information comprise first API call information and second API call information, the first API call information comprises an identifier of a first virtual machine that is configured to receive or send a packet, a time of occurrence of a first API call, and a packet flow direction of the first API that indicates that a packet is sent from the first virtual machine to a Virtual Machine Monitor, VMM , or from the VMM to the first virtual machine, and the second API call information comprises an identifier of a second virtual machine that is configured to send or receive a packet, an occurrence time of a second API call, and a direction packet flow of the second API indicates that a packet is sent from the second virtual machine to the VMM or from the VMM to the second virtual machine; and an analysis unit, configured to analyze the at least two sets of API call information, and determine whether a first condition is met for the first API call information and for the second API call information, the first condition comprises conditions (1) and (2): (1) the difference between the occurrence time of the first API call and the occurrence time of the second API call is less than or equal to a predefined threshold; (2) the packet flow direction of the first API and the packet flow direction of the second API are mutually opposite; the unit of analysis being adapted in these conditions are implemented in a way that when it is determined that conditions (1) and (2) are both met for the first API call information and for the second API call information, the unit analysis is configured to determine that the first API call information and the second API call information meet the first condition; wherein meeting the first condition means presence of an interaction between the first virtual machine and the second virtual machine; the unit of analysis is further configured to determine whether the frequency of interaction of the first virtual machine and the second virtual machine meets a second condition when it is determined that the first condition is met for the first API call information and for the second information of an API call, wherein the interaction frequency of the first virtual machine and the second virtual machine meeting a second condition comprises: the interaction frequency of the first virtual machine and the second virtual machine being greater than a predefined frequency; and if the interaction frequency of the first virtual machine and the second virtual machine meets the second condition, determine that an application topology relationship exists between the first virtual machine and the second virtual machine. 9. Topology discovery server according to claim 8, wherein the first set of API call information further comprises a first communications protocol, the second set of API call information further comprises a second communications protocol; and correspondingly, that the first API call information and the second API call information meet the first condition further comprises: a communications protocol on the first API call information and a communications protocol on the second API call information. API are the same. 10. Topology discovery server according to claim 8 or 9, CHARACTERIZED by the fact that the analysis unit is specifically configured to analyze at least two sets of API call information in the first virtual machine and at least two sets of API call information in the second virtual machine, determine the interaction frequency of the first virtual machine and the second virtual machine, compare the interaction frequency with predefined frequency, and, when the interaction frequency is greater than the predefined frequency, determine that the frequency of interaction meets the second condition, wherein the at least two sets of API call information in the first virtual machine comprise the first API call information and third API call information, the at least two sets of information API call information in the second virtual machine comprises the second API call information and fourth API call information. 11. Topology discovery server according to any one of claims 8 to 10, CHARACTERIZED by the fact that the analysis unit is specifically configured to determine whether the first virtual machine and the second virtual machine are on the same network segment , and when the first virtual machine and the second virtual machine are on the same network segment, correct one of the interaction frequency or the predefined frequency according to a predefined weighting coefficient; and the unit of analysis is specifically configured to compare corrected interaction frequency with the predefined frequency; or compare interaction frequency with corrected predefined frequency. 12. Topology discovery server according to any one of claims 8 to 11, CHARACTERIZED by the fact that the obtaining unit is specifically configured to separately read the at least two sets of API call information from a log file on a deployed host of multiple virtual machines; or the obtaining unit is specifically configured to receive the at least two sets of API call information reported by an agent module on a deployed host of the multiple virtual machines. 13. System for discovering an application topology relationship, CHARACTERIZED by the fact that the system comprises a topology discovery server and at least one host, and multiple virtual machines are run on the at least one host; when a virtual machine among the multiple virtual machines sends a packet or a Virtual Machine Monitor, VMM, from the at least one host forwards a packet to a virtual machine among the multiple virtual machines, application programming interface call information, API , are generated; The topology discovery server is configured to collect at least two sets of API call information, wherein each set of API call information corresponds to an API call, wherein the at least two sets of API call information APIs comprise first API call information and second API call information, the first API call information comprises an identifier of a first virtual machine that is configured to receive or send a packet, an occurrence time of a first call API and a packet flow direction of the first API that indicates that a packet is sent from the first virtual machine to the VMM or from the VMM to the first virtual machine, and the second API call information comprises an identifier of a second virtual machine that is configured to receive or send a packet, a time of occurrence of a second API call, and a packet flow direction of the second API that indicates that a packet is sent from the second virtual machine to the VMM or from the VMM to the second virtual machine; the topology discovery server is further configured to analyze the at least two sets of API call information, and determine whether a first condition is met for the first API call information and for the second API call information, the first condition comprises conditions (1) and (2): (1) the difference between the occurrence time of the first API call and the occurrence time of the second API call is less than or equal to a predefined threshold; (2) the packet flow direction of the first API and the packet flow direction of the second API are mutually opposite; the unit of analysis being adapted in these conditions are implemented in a way that when it is determined that conditions (1) and (2) are both met for the first API call information and for the second API call information, the unit analysis is configured to determine that the first API call information and the second API call information meet the first condition; wherein meeting the first condition means presence of an interaction between the first virtual machine and the second virtual machine; and the topology discovery server is further configured to determine whether the interaction frequency of the first virtual machine and the second virtual machine meets a second condition when it is determined that the first condition is met for the first API call information and for the second API call information, and if the interaction frequency of the first virtual machine and the second virtual machine meets the second condition, determine that an application topology relationship exists between the first virtual machine and the second virtual machine, where the interaction frequency of the first virtual machine and the second virtual machine meeting a second condition comprises: the interaction frequency of the first virtual machine and the second virtual machine being greater than a predefined frequency. 14. System, according to claim 13, CHARACTERIZED by the fact that the first set of API call information additionally comprises a first communications protocol, the second set of API call information additionally comprises a second communications protocol; and correspondingly, that the first API call information and the second API call information meet the first condition further comprises: a communications protocol on the first API call information and a communications protocol on the second API call information. API are the same. 15. System, according to claim 13 or 14, CHARACTERIZED by the fact that the topology discovery server is specifically configured to analyze at least two sets of API call information in the first virtual machine and at least two sets of information API call on the second virtual machine, determine the interaction frequency of the first virtual machine and the second virtual machine, compare the interaction frequency with predefined frequency, and when the interaction frequency is greater than the predefined frequency, determine that the frequency of interaction meets the second condition, wherein the at least two sets of API call information in the first virtual machine comprise first API call information and third API call information, the at least two sets of API call information API in the second virtual machine comprises the second API call information and fourth API call information. 16. System, according to any one of claims 13 to 15, CHARACTERIZED by the fact that the topology discovery server is specifically configured to determine whether the first virtual machine and the second virtual machine are on the same network segment, and when the first virtual machine and the second virtual machine are on the same network segment, correct one of the interaction frequency or the predefined frequency according to a predefined weighting coefficient, and compare the corrected interaction frequency with the predefined frequency; or compare interaction frequency with corrected predefined frequency.