CN107544832B

CN107544832B - Method, device and system for monitoring process of virtual machine

Info

Publication number: CN107544832B
Application number: CN201610500743.4A
Authority: CN
Inventors: 王长捷
Original assignee: Alibaba Group Holding Ltd
Current assignee: Alibaba Cloud Computing Ltd
Priority date: 2016-06-29
Filing date: 2016-06-29
Publication date: 2021-03-16
Anticipated expiration: 2036-06-29
Also published as: CN107544832A

Abstract

The embodiment of the application provides a method, a device and a system for monitoring a virtual machine process, wherein the system comprises an agent component, an agent service component and a log service component; the agent component comprises a service information acquisition unit, a log information acquisition unit, a service information sending unit and a log information sending unit, and acquires and sends service information and log information of a process in the virtual machine to the agent service component and the log service component; the proxy service component comprises a service information receiving unit and a first running state monitoring unit, and monitors the first running state of the process in the virtual machine according to the service information; the log service component comprises a log information receiving unit and a second running state monitoring unit, and the second running state of the process in the virtual machine is monitored according to the log information.

Description

Method, device and system for monitoring process of virtual machine

Technical Field

The present application relates to the field of computer processing technologies, and in particular, to a method, an apparatus, and a system for monitoring a virtual machine process.

Background

In IaaS (Infrastructure as a Service) of cloud computing, a cloud operator provides hosted physical machines, virtual machines and other facilities for different users to use according to actual needs of the users.

Virtual Machine (Virtual Machine) service is one of the core services of IaaS, and refers to a system Virtual Machine, i.e., a complete computer system that can be simulated, has complete hardware system functions, and runs in a completely isolated environment.

In order to monitor the processes in the virtual machines, an agent component is generally installed in each host, and the agent component acquires configuration information to be monitored from a monitoring server and applies the configuration information to the host to be monitored.

And the agent component collects the running states of the log files and the processes on the virtual machine, counts the running states of the log files and the processes, and uniformly sends the running states to the monitoring server.

When the cluster size to be monitored reaches hundreds or thousands of clusters and the data index to be monitored by each machine is very large, according to the processing architecture of the existing Client and Server, as the main processing can be carried out in the proxy component, more resources of the host can be occupied, so that the resources which can be used for business processing by the host become less, the problem of insufficient processing capability is obvious, and in the face of massive monitoring information indexes, the processing capability of the Server is seriously insufficient due to the centralized data processing architecture, so that the alarm is delayed or disabled.

Disclosure of Invention

In view of the foregoing, embodiments of the present application are provided to provide a monitoring method for a virtual machine process, a corresponding monitoring apparatus for a virtual machine process, and a monitoring system for a virtual machine process, which overcome or at least partially solve the foregoing problems.

In order to solve the above problem, an embodiment of the present application discloses a monitoring system for a virtual machine process, where the system includes an agent component, an agent service component, and a log service component; wherein the content of the first and second substances,

the proxy component includes:

the service information acquisition unit is used for acquiring service information of a process in the virtual machine;

the log information acquisition unit is used for acquiring log information of a process in the virtual machine;

the service information sending unit is used for sending the service information of the process in the virtual machine to the proxy service component;

the log information sending unit is used for sending the log information of the process in the virtual machine to the log service component;

the proxy service component comprises:

the service information receiving unit is used for receiving service information of a process in the virtual machine;

the first running state monitoring unit is used for monitoring the first running state of the process in the virtual machine according to the service information;

the log service component comprises: the log information receiving unit is used for receiving log information of a process in the virtual machine;

and the second running state monitoring unit is used for monitoring the second running state of the process in the virtual machine according to the log information.

Optionally, the service information sending unit includes:

the service information merging subunit is used for merging the service information of the processes in the virtual machine;

and the combined information sending subunit is used for sending the combined service information to the proxy service component.

Optionally, the service information sending unit includes:

a first individual sending subunit, configured to send service information of the process through the first process in the first transmission channel;

the service information receiving unit includes:

the first single receiving subunit is used for receiving the service information of the process sent by the first process of the proxy component in the virtual machine in the first transmission channel.

Optionally, the log information sending unit includes:

the second independent sending subunit is used for sending the log information of the process through a second process in a second transmission channel;

the log information receiving unit includes:

and the second independent receiving subunit is used for receiving the log information of the process sent by the second process of the proxy component in the virtual machine in the second transmission channel.

Optionally, the first operating state has a first abnormal state and a first normal state, and the second operating state has a second abnormal state and a second normal state;

wherein the degree of abnormality of the first abnormal state is higher than the degree of abnormality of the second abnormal state.

Optionally, the first operation state monitoring unit includes:

the non-service information inquiry subunit is used for inquiring the non-service information from the service information;

the first quantity counting subunit is used for counting the first quantity of the information which cannot be served by the process in the virtual machine within a certain time;

the first determining subunit is configured to determine that the first running state of the process of the virtual machine is a first abnormal state when the first number exceeds a preset first threshold.

Optionally, the second operation state monitoring unit includes:

an abnormal keyword query subunit, configured to query an abnormal keyword from the log information;

the second quantity counting subunit is used for counting the second quantity of the abnormal keywords of the process in the virtual machine within a certain time;

and the second determining subunit is configured to determine that the second running state of the process in the virtual machine is a second abnormal state when the second quantity exceeds a preset second threshold.

Optionally, the system further comprises a monitoring alarm component;

the proxy service component further comprises:

the first notification unit is used for sending a first abnormal notification message to the monitoring alarm component when the first running state is monitored to be a first abnormal state;

the logging service component further comprises:

the second notification unit is used for sending a second abnormal notification message to the monitoring alarm component when the second running state is monitored to be a second abnormal state;

the monitoring alarm assembly comprises:

the first alarm unit is used for executing first alarm operation after receiving the first abnormal notification message;

and the second alarm unit is used for executing second alarm operation after receiving the second abnormal notification message.

Optionally, the system further comprises a streaming processing component;

the second operation state monitoring unit includes:

the log information sending subunit is used for sending the log information to the streaming processing component;

the running state reading subunit is used for reading a second running state obtained by the detection of the streaming processing component;

the streaming processing assembly comprises:

the log information segmentation unit is used for segmenting the log information into log text data blocks at certain intervals when the log information is a data stream;

the log text data block conversion unit is used for converting the log text data blocks into an elastic distributed data set;

and the parallel detection unit is used for detecting the running state of the process in the virtual machine by adopting a plurality of elastic distributed data sets in parallel.

Optionally, the log service component further comprises:

the log file writing unit is used for writing the log information into a log file;

an index information generating unit configured to generate index information for the log file;

and the index information synchronization unit is used for synchronizing the index information to the monitoring alarm component.

The embodiment of the present application further discloses a monitoring device for a virtual machine process, including:

the log information receiving unit is used for receiving log information of a process in the virtual machine;

Optionally, the service information receiving unit includes:

the first single receiving subunit is used for receiving the service information of the process sent by the first process of the proxy component in the virtual machine in the first transmission channel;

the log information receiving unit includes:

Optionally, the first operation state monitoring unit includes:

Optionally, the second operation state monitoring unit includes:

Optionally, the method further comprises:

and the second notification unit is used for sending a second abnormity notification message to the monitoring alarm component when the second running state is monitored to be a second abnormal state.

Optionally, the method further comprises:

The embodiment of the application also discloses a method for monitoring the process of the virtual machine, which comprises the following steps:

receiving service information of a process in the virtual machine, which is sent by an agent component in the virtual machine through a first transmission channel;

receiving log information of a process in the virtual machine, which is sent by an agent component in the virtual machine through a second transmission channel;

monitoring a first running state of a process in the virtual machine according to the service information;

and monitoring a second running state of the process in the virtual machine according to the log information.

Optionally, the step of monitoring the first running state of the process in the virtual machine according to the service information includes:

inquiring non-service information from the service information;

counting a first quantity of information which cannot be served by a process in the virtual machine within a certain time;

and when the first quantity exceeds a preset first threshold value, determining that the first running state of the process of the virtual machine is a first abnormal state.

Optionally, the step of monitoring the second running state of the process in the virtual machine according to the log information includes:

querying abnormal keywords from the log information;

counting a second number of abnormal keywords of the process in the virtual machine within a certain time;

and when the second quantity exceeds a preset second threshold value, determining that the second running state of the process in the virtual machine is a second abnormal state.

Optionally, the method further comprises:

when the first operation state is monitored to be a first abnormal state, sending a first abnormal notification message to the monitoring alarm component;

and when the second operation state is monitored to be a second abnormal state, sending a second abnormal notification message to the monitoring alarm component.

when the log information is a data stream, cutting the log information into log text data blocks at certain intervals;

converting the log text data block into an elastic distributed data set;

and detecting the running state of the process in the virtual machine by adopting a plurality of elastic distributed data sets in parallel.

Optionally, the method further comprises:

writing the log information into a log file;

generating index information for the log file;

and synchronizing the index information to a monitoring alarm component.

The embodiment of the application has the following advantages:

the embodiment of the application divides a transmission channel of monitoring data into two channels, namely service information of a process of a virtual machine to be monitored and log information with large data volume are separately and independently reported, and the service information of the process can be directly reported to a server side through simple processing; the log information of the process is not processed and is directly sent to the server side in real time through the transmission channel, the running state of the process in the virtual machine is detected by the server side according to the service information and the log information reported by the virtual machine, the calculated amount is concentrated in the server side, and the calculated amount in the virtual machine can be greatly reduced, so that the resource consumption of a host machine where the virtual machine is located is greatly reduced, the resource which can be used for service processing by the host machine is ensured, and the processing capacity is improved.

In addition, the monitoring and processing of the log information are centralized at the server, the high-performance processing characteristic of the loss processing system can be fully utilized, the real-time aggregation of the log information is realized, the processing capacity can be horizontally expanded, the processing capacity for monitoring the multidimensional indexes of the large-scale cluster is greatly improved, the real-time performance of alarming is improved, and the alarming delay or invalidity is avoided.

Drawings

FIG. 1 is a flowchart illustrating steps of an embodiment of a method for monitoring a virtual machine process according to the present application;

FIG. 2 is a system architecture diagram according to an embodiment of the present application;

FIG. 3 is a block diagram of an embodiment of a monitoring apparatus for a virtual machine process according to the present application;

fig. 4 is a block diagram of a monitoring system of a virtual machine process according to an embodiment of the present disclosure.

Detailed Description

In order to make the aforementioned objects, features and advantages of the present application more comprehensible, the present application is described in further detail with reference to the accompanying drawings and the detailed description.

Referring to fig. 1, a flowchart illustrating steps of an embodiment of a method for monitoring a virtual machine process according to the present application is shown, which may specifically include the following steps:

step 101, receiving service information of a process in a virtual machine, which is sent by an agent component in the virtual machine through a first transmission channel.

Generally, Virtual Machine technology implements virtualization by adding a layer of Virtual Machine Monitor (VMM) on a physical device (also called a host), such as a virtualized processor, a Virtual Memory Management Unit (MMU), a Virtual I/O system, and the like.

In the same physical equipment, a plurality of different virtual machines can be generated, and a plurality of different or same operating systems can be respectively operated

The virtual machine monitor is also called Hypervisor (Hypervisor), and from the perspective of the application program, the program runs on the virtual machine as well as on the host.

In practical applications, the Virtual Machine may include Hyper-V, Xen, KVM (Kernel-based Virtual Machine), Vmware, etc.

In order to make the embodiment of the present application better understood by those skilled in the art, Xen is described as an example of a virtual machine in the present specification.

Xen, which is an implementation of hardware virtualization technology, is essentially a virtual machine monitor that can run on multiple platforms, such as IA-32, x86-64, and ARM.

Xen allows multiple virtual systems to run concurrently on the same hardware environment, managing and allocating virtual system behavior, hardware resources, and other computer resources.

The Xen Hypervisor is one of the most important parts in the Xen system, runs in the virtual system and the physical platform, and is the part closest to the physical layer and with the highest priority. The Hypervisor is responsible for scheduling the virtual systems running on top of it.

In an embodiment of the application, an Agent component (Agent) may be deployed in a virtual machine for collecting service information of a process (Daemon) in the virtual machine.

Further, the service information collected by the agent component may indicate whether the process in the virtual machine can provide the service, i.e., whether the process is alive.

Currently, a ps command can be executed on a virtual machine, and the ps command can be used to determine which processes are running and running states, whether the processes are finished, whether the processes are dead, which processes occupy excessive resources, and the like, and whether the processes are alive is determined by analyzing a return result of the ps command.

In the embodiment of the present application, the proxy component may send the service information of the virtual machine process to the server, for example, an AgentServer (AgentServer).

The proxy service component may be an independent server or a server cluster, or may be a unit in the server or the server cluster, which is not limited in this embodiment of the present application.

The term "separate" refers to log information, that is, service information and log information are transmitted separately, and may be embodied as:

1. a separate process;

the first process in the proxy component is responsible for sending service information to the proxy service component.

The independent process means that a first process for transmitting service information in the proxy component and a second process for transmitting log information in the proxy component are independent of each other.

2. A separate transmission channel;

the proxy component sends service information to the proxy service component through a first Transmission channel, such as long connection of a Transmission Control Protocol (TCP), that is, a client (client) and a server (server) are connected first and are not disconnected after connection is established, and then message sending and receiving are performed.

The independent transmission means that a first transmission channel for transmitting the service information in the proxy component and a second transmission channel for transmitting the log information in the proxy component are independent from each other.

Namely, the agent component sends the service information of the process through the first process in the first transmission channel, and in contrast, the agent service component can receive the service information of the process sent by the first process of the agent component in the virtual machine in the first transmission channel.

In a specific implementation, the proxy component may merge service information of processes in the virtual machine, and send the merged service information to the proxy service component, on one hand, service information of some processes needs to be judged by integrating service information of multiple processes, for example, in a MapReduce distributed system, whether resource manager processes and nodemanager processes are normal is comprehensively judged to judge whether yarn (resource manager) is normal. On the other hand, the reported information amount is reduced, so that the calculation amount of the proxy service component is reduced.

In contrast, the service information of the process in the virtual machine received by the proxy service component is obtained by merging the original service information.

Of course, in order to ensure the privacy and the right of awareness of the user, whether the user of the virtual machine authorizes the collection of the service information may be checked first, if the user has authorized the collection of the service information, the sending process of the service information may be continued, and if the user has authorized the collection of the service information, the sending process of the service information may be terminated.

And 102, receiving the log information of the process in the virtual machine, which is sent by the agent component in the virtual machine through the second transmission channel.

In an embodiment of the application, an agent component may be deployed in a virtual machine for collecting log information of processes in the virtual machine.

In an application system (e.g. host), a log is usually a very important functional component, and records all behaviors generated by the application system, including business operation behaviors and the behaviors of the system framework itself, and expresses the behaviors according to a certain specification.

In the present embodiment, the log information refers to log data that is originally generated, and is generally in units of lines, and is not subjected to processing such as writing a file.

Furthermore, when a process is specified to be started in the virtual machine, log information generated by the process running can be redirected to the execution directory, and then the execution directory is scanned in real time through the agent component deployed in the virtual machine to read the log information.

In the embodiment of the present application, the proxy component may send the log information to the server separately, for example, a log service component (LogServer).

The log service component may be an individual server or a server cluster, or may also be a certain unit in the server or the server cluster, which is not limited in this embodiment of the present application.

The so-called stand-alone is relative to the service information, that is, the service information is transmitted separately from the log information, and may be embodied as:

1. a separate process;

a second process in the proxy component is responsible for sending log information to the log service component.

2. A separate transmission channel;

the proxy component sends the log information to a log service component, such as a TCP long connection, through a second transmission channel.

That is, the agent component may send the log information of the process through the second process in the second transmission channel, and in contrast, the log service component may receive the log information of the process sent by the second process of the agent component in the virtual machine in the second transmission channel.

Of course, in order to ensure the privacy and the right of awareness of the user, whether the user of the virtual machine authorizes the collection of the log information may be checked first, if the user has authorized the collection of the log information, the sending process of the log information may be continued, and if the user has authorized the collection of the log information, the sending process of the log information may be terminated.

And 103, monitoring the first running state of the process in the virtual machine according to the service information.

Since the service information of the process is data generated during running, in a server (such as a proxy service component), a first running state of the process can be monitored by analyzing the data, wherein the first running state has a first abnormal state and a first normal state, namely information indicating that the process runs abnormally and information indicating that the process runs normally.

In one embodiment of the present application, step 103 may comprise the following sub-steps:

a substep S11 of inquiring non-service information from the service information;

in the embodiment of the present application, the service information may include serviceable information and non-serviceable information.

The serviceable information represents that the process in the virtual machine runs normally and can provide services.

The non-service information indicates that the process in the virtual machine is abnormally closed and cannot provide service.

Generally, if a process exists in the ps list of the virtual machine, the process is considered to run normally, and if the process does not exist in the ps list of the virtual machine, the process is considered to be closed abnormally.

Substep S12, counting a first amount of non-serviceable information of a process in the virtual machine within a certain time;

in a server (such as a proxy service component), service information with discrete processes can be summarized, and the peer node determines the number of non-service information of the processes within a certain time, such as the latest 5min, 15min, 30min, and the like.

And a substep S13, determining that the first running state of the process of the virtual machine is a first abnormal state when the first number exceeds a preset first threshold.

If the first quantity of the process closing information exceeds a preset first threshold value within a certain time, the abnormal frequency of the process can be considered to be high, and the first running state of the process is determined to be a first abnormal state.

Otherwise, the first running state of the process may be the first normal state.

Further, if the agent service component monitors that the first running state of the process is the first abnormal state, an alarm operation, such as a popup window, an email, a short message, and the like, may be triggered to notify the user to perform an abnormal process.

In an alarm mode, when monitoring that the first operating state is a first abnormal state, the proxy service component sends a first abnormal notification message to the monitoring alarm component to notify the monitoring alarm component to execute a first alarm operation.

The monitoring alarm component can be connected with a front-end UI (User Interface) component to interact with a User.

The monitoring alarm component may be an individual server or a server cluster, or may also be a certain unit in the server or the server cluster, which is not limited in this embodiment of the present application

And the monitoring alarm component executes a first alarm operation after receiving the first abnormity notification message, and notifies a user to perform abnormity processing at the front end.

Of course, the proxy service component may also directly perform the alarm operation, which is not limited in this embodiment of the present application.

And 104, monitoring a second running state of the process in the virtual machine according to the log information.

Since the log information of the process is data generated during the running process, in a server (such as a log service component), the first running state of the process can be monitored by analyzing the data, wherein the second running state has a second abnormal state and a second normal state, namely information indicating that the process runs abnormally and information indicating that the process runs normally.

In one embodiment of the present application, step 104 may include the following sub-steps:

a substep S21, querying abnormal keywords from the log information;

in a specific implementation, the log information of each row that is sent may be matched with a preset abnormal keyword (i.e., a keyword for characterizing an operation abnormality), and a matching process may be understood as whether the log information includes the abnormal keyword, that is, whether the keyword is a substring of the log information.

For example, if an abnormal keyword register exception occurs in the log information, it may be considered that the proxy component cannot be registered on the proxy service component.

For example, if an abnormal keyword filenotfoundation exception occurs in the log information, it can be considered that the target file expected by the task program is not generated.

Substep S22, counting a second number of abnormal keywords of the process in the virtual machine within a certain time;

in the log service component, log information with discrete processes can be summarized, and the number of abnormal keywords of the processes can be determined at the same level within a certain time, such as the latest 5min, 15min, 30min and the like.

And a substep S23, determining that the second running state of the process in the virtual machine is the second abnormal state when the second quantity exceeds a preset second threshold.

If the second number of the abnormal keywords of the process exceeds a preset second threshold value within a certain time, the abnormal frequency of the process is considered to be high, and the second running state of the process is determined to be a second abnormal state. Otherwise, the second running state of the process may be the second normal state.

It should be noted that the degree of abnormality of the first abnormal state may be higher than that of the second abnormal state, and if the process of the virtual machine is in the first abnormal state, the service generally cannot be provided, but if the process of the virtual machine is in the second abnormal state, the service may also be provided.

In addition, generally, if a process survives, the process always prints log information, and the agent component can always send the log information to form a data stream.

When the log information is a data stream, a streaming processing component, such as Storm, Spark, Samza, and the like, may be deployed in the system, the log service component may send the log information to the streaming processing component, the streaming processing component detects a second running state of a process in the virtual machine using the log information, and the log service component reads a geothermal running state obtained by detection by the streaming processing component.

The streaming processing component may be an individual server or a server cluster, or may also be a certain unit in the server or the server cluster, which is not limited in this embodiment of the present application.

In order to make the person skilled in the art better understand the embodiments of the present application, in the present specification, a spark streaming built based on spark is described as an example of a streaming processing component.

Spark Streaming is an extension of Spark core API (Application Programming Interface) that is pre-segmented into batch jobs at intervals before processing.

An abstraction of Spark for persistent data streams is called DStream (decentralized stream), one is RDD (elastic distributed data set) of micro-batching (micro-batching); RDD is a distributed data set that can operate in parallel in two ways, namely, conversion of arbitrary functions and sliding window data.

Specifically, a listener can be started in the streaming processing component to listen whether a message stream is written through the network channel within a certain time window, and if so, the task is positioned to have a data stream written, and if not, the task is marked as not.

For the written data Stream (i.e. the log information), the log information may be cut into log text data blocks (partitioned Stream) of one segment at certain intervals (batch size, e.g. 1 second).

Converting each log text data block into a Spark elastic Distributed data set (DDR);

and then changing the Transformation operation on the DSstream in Spark Streaming into the Transformation operation on the RDD in Spark, and detecting a second running state of the process in the virtual machine by adopting a plurality of elastic distributed data sets in parallel.

The RDD is changed into an intermediate result through operation and is stored in a memory, and the intermediate result can be superposed or stored in an external device through the whole streaming calculation according to the service requirement.

Of course, if the streaming processing component detects the running state of the process in the virtual machine by using the log information, it may use from in addition to Spark, and this is not limited in this embodiment of the present application.

Besides, besides the streaming processing component, the log information may also be used by the centralized processing cluster to detect the running state of the process in the virtual machine, which is similar to the identifier, and this is not limited in this embodiment of the present application. Further, if the agent service component monitors that the first running state of the process is the first abnormal state, an alarm operation, such as a popup window, an email, a short message, and the like, may be triggered to notify the user to perform an abnormal process.

In an alarm mode, when monitoring that the first operating state is a first abnormal state, the proxy service component sends a first abnormal notification message to the monitoring alarm component.

And the monitoring alarm component executes a first alarm operation after receiving the first abnormity notification message.

Further, if the log service component monitors that the second running state is an abnormal state, an alarm operation, such as a popup window, an email, a short message and the like, can be triggered to notify the user of abnormal processing.

In an alarm mode, if the log service component monitors that the second running state is the second abnormal state, a second abnormal notification message is sent to the monitoring alarm component to notify the monitoring alarm component to execute the second alarm operation.

And the monitoring alarm component executes a second alarm operation after receiving the second abnormal notification message, and notifies a user to perform abnormal processing at the front end.

Of course, the log service component may also directly perform the alarm operation, which is not limited in this embodiment of the present application.

In addition, the log service component can write the log information into a log file, generate index information aiming at the log file, and synchronize the index information to the monitoring alarm component, so that a user can check the index information at the front end.

In addition, the monitoring processing of the log information is centralized at the server, the high-performance processing characteristic of the loss processing system can be fully utilized, the real-time aggregation of the monitoring data is realized, the processing capacity can be horizontally expanded, the processing capacity for processing the multi-dimensional indexes of large-scale cluster monitoring is greatly improved, the real-time performance of alarming is improved, and the alarming delay or invalidity is avoided.

In order to make those skilled in the art better understand the embodiment of the present application, the following describes a monitoring method for a virtual machine process in the embodiment of the present application by using a specific example.

As shown in fig. 2, an agent component 201 is deployed in the virtual machine, collects service information of processes in the virtual machine, and collects log information of processes in the virtual machine.

After the service information is merged, the service information of the process is sent to the proxy service component 202 through the first process in the first transmission channel.

The log information is sent to the log service component 203 via the second process in the second transmission channel without being processed.

The proxy service component 202 queries the non-serviceable information from the service information, counts a first number of the non-serviceable information within 5min, and determines that the process is in a first abnormal state since the first number is greater than the first threshold, assuming that the first number is 20 and the first threshold is 10.

Accordingly, the proxy service component 202 can send a first exception notification message to the monitoring alert component 205 notifying the monitoring alert component 205 of the alert operation.

The log service component 203 calls the stream processing component 204, that is, spark streaming, to query the abnormal keyword from the log information, and counts a second number of the abnormal keyword within 5min, assuming that the second number of the abnormal keyword filenotfound exception is 7 and the second threshold is 5, since the second number is greater than the second threshold, it can be determined that the process is in the second abnormal state.

Accordingly, the log service component 203 can send a second exception notification message to the monitoring alarm component 205 informing the monitoring alarm component 205 of the alarm operation.

In addition, the log service component 203 can write log information into a log file and generate index information for the log file, synchronizing the index information to the monitoring alarm component 205.

It should be noted that, for simplicity of description, the method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the embodiments are not limited by the order of acts described, as some steps may occur in other orders or concurrently depending on the embodiments. Further, those skilled in the art will also appreciate that the embodiments described in the specification are presently preferred and that no particular act is required of the embodiments of the application.

Referring to fig. 3, a block diagram of a monitoring apparatus embodiment of a virtual machine process according to the present application is shown, which may specifically include the following units:

a service information receiving unit 301, configured to receive service information of a process in a virtual machine;

a log information receiving unit 302, configured to receive log information of a process in a virtual machine;

a first running state monitoring unit 303, configured to monitor a first running state of a process in the virtual machine according to the service information;

a second running state monitoring unit 304, configured to monitor a second running state of the process in the virtual machine according to the log information.

In an embodiment of the present invention, the service information receiving unit 301 may include the following sub-units:

the log information receiving unit 302 may include the following sub-units:

In a specific implementation, the first operation state has a first abnormal state and a first normal state, and the second operation state has a second abnormal state and a second normal state;

In an embodiment of the present invention, the first operation state monitoring unit 303 may include the following sub-units:

In an embodiment of the present invention, the second operation status monitoring unit 304 may include the following sub-units:

In one embodiment of the present invention, the following units may be further included:

the log information segmentation subunit is used for segmenting the log information into log text data blocks at certain intervals when the log information is a data stream;

the log text data block conversion subunit is used for converting the log text data blocks into an elastic distributed data set;

and the parallel detection subunit is used for detecting the running state of the process in the virtual machine by adopting a plurality of elastic distributed data sets in parallel.

Referring to FIG. 4, a block diagram of an embodiment of a monitoring system for a virtual machine process of the present application is shown, which may include a proxy component 410, a proxy service component 420, and a log service component 430; wherein the content of the first and second substances,

the proxy component 410 may include the following elements:

a service information collecting unit 411, configured to collect service information of a process in a virtual machine;

a log information collecting unit 412, configured to collect log information of a process in a virtual machine;

a service information sending unit 413, configured to send service information of a process in a virtual machine to the proxy service component;

a log information sending unit 414, configured to send log information of a process in a virtual machine to the log service component;

the proxy service component 420 may include the following elements:

a service information receiving unit 421, configured to receive service information of a process in a virtual machine;

a first running state monitoring unit 422, configured to monitor a first running state of a process in the virtual machine according to the service information;

the log service component 430 may include the following elements:

a log information receiving unit 431 configured to receive log information of a process in a virtual machine;

a second running state monitoring unit 432, configured to monitor a second running state of the process in the virtual machine according to the log information.

In an embodiment of the present application, the service information sending unit 413 may include the following sub-units:

the service information receiving unit 421 may include the following sub-units:

In an embodiment of the present application, the log information sending unit 414 may include the following sub-units:

the log information receiving unit 431 may include the following units:

In an embodiment of the present application, the first operation state monitoring unit 422 may include the following sub-units:

In an embodiment of the present application, the second operation state monitoring unit 432 may include the following units:

In one embodiment of the present application, the system may further comprise a monitoring alarm component;

the proxy service component may further include the following elements:

the logging service component may further comprise the following elements:

the monitoring alarm assembly may include the following elements:

In one embodiment of the present application, the system may further comprise a streaming processing component;

the second operation state monitoring unit may include the following units:

the streaming processing component may comprise the following elements:

In an embodiment of the present application, the log service component may further include the following units:

For the device and system embodiments, since they are basically similar to the method embodiments, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiments.

The embodiments in the present specification are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other.

As will be appreciated by one of skill in the art, embodiments of the present application may be provided as a method, apparatus, or computer program product. Accordingly, embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

In a typical configuration, the computer device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory. The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium. Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable media (fransitory media), such as modulated data signals and carrier waves.

Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing terminal to cause a series of operational steps to be performed on the computer or other programmable terminal to produce a computer implemented process such that the instructions which execute on the computer or other programmable terminal provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

While preferred embodiments of the present application have been described, additional variations and modifications of these embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including the preferred embodiment and all such alterations and modifications as fall within the true scope of the embodiments of the application.

Finally, it should also be noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or terminal. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or terminal that comprises the element.

The detailed description is given above on the monitoring method of the virtual machine process, the monitoring device of the virtual machine process, and the monitoring system of the virtual machine process, and a specific example is applied in this document to explain the principle and the implementation of the present application, and the description of the above embodiments is only used to help understanding the method and the core idea of the present application; meanwhile, for a person skilled in the art, according to the idea of the present application, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present application.

Claims

1. The monitoring system of the process of the virtual machine is characterized in that the virtual machine runs on a host machine, and the system comprises an agent component, an agent service component and a log service component; wherein the content of the first and second substances,

the proxy component includes:

the service information sending unit is used for sending the service information of the process in the virtual machine to the proxy service component; the service information is the service information processed by the host machine;

the log information sending unit is used for sending the log information of the process in the virtual machine to the log service component; wherein a process for sending the service information is different from a process for sending the log information; the log information comprises originally generated log data and is log information which is not processed by the host machine; the proxy service component comprises:

the log service component comprises:

the second running state monitoring unit is used for monitoring the second running state of the process in the virtual machine according to the log information; the proxy service component and the log service component are service ends.

2. The system according to claim 1, wherein the service information transmitting unit comprises:

3. The system according to claim 1, wherein the service information transmitting unit comprises:

the service information receiving unit includes:

4. The system according to claim 1, wherein the log information transmitting unit includes:

the log information receiving unit includes:

5. The system of claim 1, wherein the first operational state has a first abnormal state and a first normal state, and the second operational state has a second abnormal state and a second normal state;

6. The system of claim 1, wherein the first operational status monitoring unit comprises:

7. The system of claim 1, wherein the second operational status monitoring unit comprises:

8. The system of claim 1 or 2 or 3 or 4 or 5 or 6 or 7, further comprising a monitoring alarm component;

the proxy service component further comprises:

the logging service component further comprises:

the monitoring alarm assembly comprises:

9. The system of claim 1, 5 or 7, further comprising a streaming processing component;

the second operation state monitoring unit includes:

the streaming processing assembly comprises:

10. The system of claim 8, wherein the log service component further comprises:

11. The utility model provides a monitoring device of virtual machine process which is characterized in that, is applied to the server, the server includes agent service subassembly and log service subassembly, agent service subassembly and the log service subassembly are connected with agent subassembly respectively, include:

the service information receiving unit is positioned in the proxy service component and used for receiving service information of a process in the virtual machine; the received service information of the process in the virtual machine is acquired through a service information acquisition unit of the proxy component and is sent through a service information sending unit of the proxy component; the service information is processed by the host machine where the virtual machine is located;

the log information receiving unit is positioned in the log service component and used for receiving the log information of the process in the virtual machine; the received log information of the process in the virtual machine is collected through a log information collecting unit of the agent component and is sent through a log information sending unit of the agent component; wherein a process for sending the service information is different from a process for sending the log information; the log information comprises originally generated log data and is log information which is not processed by the host machine; the first running state monitoring unit is positioned in the proxy service component and used for monitoring the first running state of the process in the virtual machine according to the service information;

and the second running state monitoring unit is positioned in the log service component and used for monitoring the second running state of the process in the virtual machine according to the log information.

12. The apparatus of claim 11,

the service information receiving unit includes:

the log information receiving unit includes:

13. The apparatus of claim 11, wherein the first operating condition has a first abnormal condition and a first normal condition, and the second operating condition has a second abnormal condition and a second normal condition;

14. The apparatus according to claim 11, 12 or 13, wherein the first operation state monitoring unit includes:

15. The apparatus according to claim 11, 12 or 13, wherein the second operation state monitoring unit includes:

16. The apparatus of claim 11, 12 or 13, further comprising:

17. A monitoring method of a virtual machine process is applied to a server, the server comprises an agent service component and a log service component, the agent service component and the log service component are respectively connected with the agent component, and the monitoring method comprises the following steps:

receiving service information of a process in the virtual machine, which is sent by an agent component in the virtual machine through a first transmission channel, through the agent service component; the received service information of the process in the virtual machine is acquired through a service information acquisition unit of the proxy component and is sent through a service information sending unit of the proxy component; the service information is processed by the host machine where the virtual machine is located;

receiving, by the log service component, log information of a process in the virtual machine, which is sent by the proxy component in the virtual machine via a second transmission channel; the received log information of the process in the virtual machine is collected through a log information collecting unit of the agent component and is sent through a log information sending unit of the agent component; wherein a process for sending the service information is different from a process for sending the log information; the log information comprises originally generated log data and is log information which is not processed by the host machine;

monitoring a first running state of a process in the virtual machine according to the service information through the proxy service component;

and monitoring a second running state of the process in the virtual machine according to the log information through the log service component.

18. The method of claim 17, wherein the step of monitoring the first running state of the process in the virtual machine according to the service information comprises:

inquiring non-service information from the service information;

19. The method of claim 17, wherein the step of monitoring the second running state of the process in the virtual machine according to the log information comprises:

querying abnormal keywords from the log information;