CN112732640A - Method and device for detecting file descriptor leakage - Google Patents

Method and device for detecting file descriptor leakage Download PDF

Info

Publication number
CN112732640A
CN112732640A CN202011582830.1A CN202011582830A CN112732640A CN 112732640 A CN112732640 A CN 112732640A CN 202011582830 A CN202011582830 A CN 202011582830A CN 112732640 A CN112732640 A CN 112732640A
Authority
CN
China
Prior art keywords
file
target process
descriptor
file descriptor
time
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202011582830.1A
Other languages
Chinese (zh)
Other versions
CN112732640B (en
Inventor
汪庆权
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou DPTech Technologies Co Ltd
Original Assignee
Hangzhou DPTech Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou DPTech Technologies Co Ltd filed Critical Hangzhou DPTech Technologies Co Ltd
Priority to CN202011582830.1A priority Critical patent/CN112732640B/en
Publication of CN112732640A publication Critical patent/CN112732640A/en
Application granted granted Critical
Publication of CN112732640B publication Critical patent/CN112732640B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/11—File system administration, e.g. details of archiving or snapshots
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/302—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a software system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3409—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment
    • G06F11/3419—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment by assessing time
    • G06F11/3423—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment by assessing time where the assessed time is active or idle time
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Quality & Reliability (AREA)
  • Mathematical Physics (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Computer Hardware Design (AREA)
  • Storage Device Security (AREA)

Abstract

The application provides a file descriptor leak detection method and device, wherein the method comprises the following steps: based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage: sequentially reading file descriptors from a file descriptor set corresponding to the target process; acquiring time information in the file structure information, wherein the time information comprises a first timestamp corresponding to the moment when the target process accesses the file last time; determining whether the time interval between a second timestamp corresponding to the current moment and the first timestamp reaches a preset threshold value; if so, determining that the target process has file descriptor leakage. Through the technical scheme, the detection efficiency is improved, and the detection is more accurate and timely.

Description

Method and device for detecting file descriptor leakage
Technical Field
The present application relates to the field of communications technologies, and in particular, to a method and an apparatus for detecting file descriptor leakage.
Background
In the Linux operating system, all can be regarded as files, for example, a common file, a directory, a link and a device are regarded as one file. When a process in the Linux system opens or creates a file, the kernel returns a file descriptor to the process, wherein the file descriptor is an index created by the kernel for efficiently managing the file opened by the process and is a nonnegative integer.
In the Linux kernel, each process has a file descriptor table corresponding to each process, which represents all files opened by the process, the file descriptor table of each process is independent, a file descriptor fd and a file pointer are important contents of the file descriptor table, the file descriptor fd is an index of the file descriptor table, and the file pointer points to a struct file structure corresponding to an opened file. The file structure represents an opened file, each opened file in the system has an associated struct file in a kernel space, the struct file is created by a kernel when the file is opened and is transmitted to any function which operates on the file, and important information such as the opening mode, the reading and writing position and the like of the file is described in the structure.
In the file descriptor table, the first 3 file descriptors are occupied by default, 0 is the standard input, 1 is the standard output, and 2 is the standard error. If a new file is opened at this time, its file descriptor would be 3, and if a file is opened again, the file descriptor fd would be incremented. Typically, the default maximum number of file descriptors occupied by a process is 1024. When a file is opened, a text descriptor is occupied, if the file which is not needed is opened and not closed, the file descriptor is still occupied, the file descriptor is continuously increased until the upper limit is reached, no new file descriptor is available, and the new file descriptor cannot be allocated to the file at the moment, so that an application program cannot open the new file, and abnormal business and even breakdown are caused. The phenomenon that the file is not closed in time but continuously occupies the file descriptor is called that the file descriptor is leaked.
Disclosure of Invention
In view of this, the present application provides a method and an apparatus for detecting a file descriptor leak, which are used to detect a file descriptor leak.
According to a first aspect of embodiments of the present application, there is provided a method of file descriptor leak detection, the method comprising:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage:
sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by files opened by the target process; the file descriptor information corresponding to the file descriptor is used for determining the file structure information of the opened file;
acquiring time information in the file structure information, wherein the time information comprises a first timestamp corresponding to the moment when the target process accesses the file last time;
determining whether the time interval between a second timestamp corresponding to the current moment and the first timestamp reaches a preset threshold value; if so, determining that the target process has file descriptor leakage.
According to a second aspect of embodiments of the present application, there is provided an apparatus for file descriptor leak detection, the apparatus comprising:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage:
the first reading unit is used for sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by files opened by the target process; the file descriptor information corresponding to the file descriptor is used for determining the file structure information of the opened file;
the acquisition unit is used for acquiring time information in the file structure body information, wherein the time information comprises a first timestamp corresponding to the moment when the target process accesses the file last time;
the comparison unit is used for determining whether the time interval between a second timestamp corresponding to the current moment and the first timestamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage.
According to a third aspect of embodiments of the present application, there is provided an apparatus for file descriptor leak detection, the apparatus comprising:
a processor; a memory for storing the processor-executable instructions;
wherein the processor is configured to:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage:
sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by files opened by the target process; the file descriptor information corresponding to the file descriptor is used for determining the file structure information of the opened file;
acquiring time information in the file structure information, wherein the time information comprises a first timestamp corresponding to the moment when the target process accesses the file last time;
determining whether the time interval between a second timestamp corresponding to the current moment and the first timestamp reaches a preset threshold value; if so, determining that the target process has file descriptor leakage.
According to the technical scheme, the Linux kernel struct file structure is expanded, and the mode of reading and writing two fields at the time is increased, so that the process can record the reading and writing time on the structure when the process performs the reading and writing operation of the opened file. And determining the time closest to the current time in the latest reading time and the latest writing time, comparing the latest reading time and the latest writing time with the current time, judging whether the latest reading time and the latest writing time exceed a preset time threshold value according to a comparison result to detect whether the file descriptor is leaked or not, and timely finding out the problem of the leakage of the file descriptor. And when leakage occurs, alarm information is sent to the user, and hidden dangers are eliminated in advance. Meanwhile, according to the file descriptor leakage condition, the sleep time is automatically set to adjust the detection period, and the occupancy rate of the CPU is reduced.
Drawings
FIG. 1 is a flow diagram of a method for file descriptor leak detection in accordance with an illustrative embodiment;
FIG. 2 is a diagram of a hardware architecture of a device in which a file descriptor leakage detection apparatus according to an exemplary embodiment is located;
fig. 3 is a block diagram of a file descriptor leak detection apparatus according to an exemplary embodiment.
Detailed Description
Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.
It is to be understood that although the terms first, second, third, etc. may be used herein to describe various information, such information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present application. The word "if" as used herein may be interpreted as "at … …" or "when … …" or "in response to a determination", depending on the context.
In the related art, when a file descriptor leaks, a process cannot open or create a file, causing a program exception or even a crash. Therefore, in order to ensure the normal operation of the system, the file descriptor needs to be checked manually, and the problem of file descriptor leakage is timely reflected.
When the process is implemented, when whether the file descriptor of the process leaks is checked, the state of the current process can be displayed through a ps command to obtain a process ID, then all files opened by the process are checked through a/proc/process ID/fd command, the number of the files in a directory is counted, the number of the file descriptors opened by the process is determined, and whether the file descriptor leaks is manually judged.
If the number of the file descriptors in the directory is extremely large, and the number of the file descriptors always shows an increasing trend in the process of multiple times of checking, the file descriptors are likely to leak, and manual statistics and judgment are still needed for determining whether the file descriptors leak.
In addition, if the file descriptor leakage problem occurs slowly, it takes a long time to find the file descriptor leakage problem, and even the file descriptor leakage problem may not be found easily, so that the file descriptor leakage problem cannot be found in time. In this case, it is necessary to perform manual statistics many times to determine whether or not leakage occurs.
Moreover, manual statistics cannot determine the detection period, if the period is too short, the detection frequency is too high, and for the case that file leakage is slow to send, a lot of useless work is done. If the detection period is increased and the detection frequency is reduced, when a large amount of file descriptors are leaked, and the leakage of the file descriptors is detected, the leakage is likely to occur for a long time, and the detection is not timely enough.
Therefore, whether the leakage of the file descriptor is sent or not is judged according to the number of the file descriptors, and the efficiency of detecting the leakage problem of the file descriptor in a manual mode is low and is not accurate and timely enough.
In view of this, the present application provides a method for detecting file descriptor leakage, which periodically obtains a file descriptor in a file descriptor set corresponding to a target process to be detected, reads a first timestamp that a file pointed by the file descriptor was accessed last time, and determines whether the file descriptor is leaked by comparing whether a time interval between the first timestamp and a second timestamp corresponding to a current time reaches a preset threshold.
In the implementation process, two fields of reading time and writing time are added by expanding a struct file structure body in a kernel, when a process reads a file each time, a file reading time record can be updated through functions such as kernels vfs _ read and vfs _ reads, when the process writes the file each time, a file writing time record can be updated through functions such as kernels vfs _ write and vfs _ writes, and when the process reads and writes the file each time, a file reading time record and a file writing time record can be updated through functions such as kernels do _ sendfile.
In addition, the process descriptor detailed information fdDetail is added through an extension/proc/process id/fd command, the file descriptor detailed information can be obtained through the extension/proc/process id/fdDetail command, and the file descriptor fd, the latest reading time and the latest writing time are output.
Based on a preset detection period, aiming at each process in a monitoring process set, acquiring a file descriptor set corresponding to the process according to a process ID, sequentially reading file descriptors in the file descriptor set, acquiring a first time stamp corresponding to the time when a file corresponding to the file descriptor is accessed last time, determining whether the time interval between a second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value, and if so, determining that the file descriptor is leaked in the process.
In the technical scheme, the read-write time information is recorded by expanding the struct file structure in the kernel, the first timestamp of the latest access of the file is acquired by adding the process descriptor detailed information fdDetail to output the file descriptor detailed information, and whether the time interval between the first timestamp and the second timestamp corresponding to the current time reaches the preset threshold value or not can be compared, so that whether the file descriptor leaks or not is judged, the detection efficiency of the leakage of the file descriptor is improved, and the detection is more accurate and timely.
Next, examples of the present application will be described in detail.
Referring to fig. 1, fig. 1 is a flowchart of a file descriptor leak detection method according to an exemplary embodiment of the present application, where the method is applicable to a device installed with a Linux system.
It should be further noted that the file descriptor leak detection method is executed periodically, and since the flow of file descriptor leak detection performed in each period is the same, the file descriptor leak detection flow executed in only one period is described in detail here.
The file descriptor leakage detection process may include the following steps:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage:
step 101, reading file descriptors in sequence from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by files opened by the target process; the file descriptor information corresponding to the file descriptor is used for determining the file structure information of the opened file;
102, acquiring time information in the file structure information, wherein the time information comprises a first timestamp corresponding to the moment when the target process accesses the file last time;
step 103, determining whether the time interval between a second timestamp corresponding to the current time and the first timestamp reaches a preset threshold value; if so, determining that the target process has file descriptor leakage.
In the Linux system kernel, when an existing file is opened or a new file is created, the kernel returns a file descriptor to the process for subsequent read and write operations on the file. In each process, a file descriptor table is stored, the file descriptor is the index of the table, the index is represented by a file descriptor fd, each entry has a file pointer pointing to an opened file, and the file pointer points to the struct file structure. The file structure body represents an opened file, each opened file in the system has an associated struct file structure body in a kernel, and the file structure body is created by the kernel when the file is opened and is transferred to any function which operates on the file.
In this embodiment, the set of file descriptor information corresponding to the target process is a file descriptor table corresponding to the target process, where the file descriptor table includes a file descriptor table entry corresponding to a file descriptor occupied by a file already opened by the target process, where the file descriptor id is a file descriptor fd occupied by a file already opened by the target process, and the file pointer points to the opened file. And periodically acquiring a file descriptor set corresponding to a target process to be detected based on a preset detection period, wherein the set comprises file descriptors corresponding to file descriptors occupied by files opened by the target process, and the file descriptor information comprises file descriptor identifications and pointers pointing to file structures of the files corresponding to the file descriptors. And fd is equivalent to the index of the array in the file descriptor table, a file pointer is equivalent to the content of the array and points to a file structure, and file descriptor information is used for determining the file structure information of the opened file.
It is worth to be noted that, by extending the struct file structure in the kernel, the read time field and the write time field are added. When the file is read by the process each time, the file reading time record can be updated through functions such as kernel vfs _ read and vfs _ reads, when the file is written by the process each time, the file writing time record can be updated through functions such as kernel vfs _ write and vfs _ write, and when the file is read and written by the process each time, the file reading time record and the file writing time record can be updated through functions such as kernel do _ sendfile. By extending the field of the file structure, the time information is stored in the file structure.
In this embodiment, for file descriptors sequentially read from a file descriptor set, a file structure body pointed by a pointer associated with the file descriptor is obtained, and time information stored in the file structure body is obtained, where the time information is a time when a process has last accessed a file corresponding to the file descriptor, and the time is a first timestamp.
It should be noted that, by means of the extended/proc/process id/fd command, the detailed process descriptor fdDetail information fdDetail is added, and for each file descriptor, since the read-write time information is recorded in the pointed file structure, the detailed file descriptor detail information can be output by the/proc/process id/fdDetail command, the file descriptor fd is obtained, and the time when the process reads and writes the file corresponding to the file descriptor for the last time is obtained. The time information is output by adding the process descriptor detail information fdDetail.
Specifically, after the time when the target process reads and writes the file for the last time is read, the maximum value of the latest reading time and the latest writing time is compared, and the maximum value is used as the first time stamp when the process accesses the file for the last time.
In this embodiment, after obtaining the first timestamp of the last time that the process accesses the file, the first timestamp is compared with the second timestamp corresponding to the current time, and whether the time interval between the first timestamp and the second timestamp reaches the preset threshold is determined. And if the preset threshold value is reached, determining that the file descriptor is leaked by the target process.
Furthermore, according to the descriptor leakage condition, the detection period can be adjusted, the detection frequency can be flexibly changed, and the CPU occupancy rate is reduced.
In one embodiment shown, if it is determined that the file descriptor is leaked, the detection period is decreased to increase the detection frequency; if it is determined that the file descriptor is not revealed, the detection period is increased to reduce the detection frequency. In addition, the default sleep time is one hour, and the sleep time can be adjusted by self-definition, which is not limited in the application.
In an embodiment shown in the foregoing, the device may create a monitoring process set, where the monitoring process set includes a plurality of target processes to be detected, and the processes may be processes corresponding to a program that is being scanned by the device and may also be designated processes that are manually added. When the device detects that a process in the monitoring set stops running, the device may delete the process that stops running from the monitoring set.
The identifier of any target process to be detected can be obtained from the monitoring process set corresponding to the current detection period, the process identifier can be a process ID, and the file descriptor set corresponding to the process is obtained through a/proc/process ID/fd command.
In an embodiment shown, when it is determined that the target process has a file descriptor leak, generating alarm information of the target process having the file descriptor leak, and sending the alarm information to a relevant user.
The alarm information may include a process identification of a target process where file descriptor leakage occurs, such as a process name and a process ID, and time interval information. Meanwhile, the user can be warned in the modes of short messages, WeChat, mails, syslog and the like.
According to the file descriptor leakage detection method, the device can periodically acquire the file descriptor sets corresponding to all processes, the first time stamp of the opened file accessed by the target process to be detected for the last time is acquired according to the time information stored in the file structure body associated with the file descriptors, and whether the file descriptors are leaked or not is judged by comparing whether the time interval between the second time stamp corresponding to the current time and the first time stamp reaches the preset threshold value or not. By automatically detecting the leakage of the file descriptor and judging the reading and writing time record added in the file structure, the detection efficiency of the leakage of the file descriptor is improved, and the detection is more accurate and timely.
Referring to fig. 2, the present application further provides a hardware architecture diagram of a device in which the file descriptor leak detection apparatus is located, where the device includes: a communication interface 201, a processor 202, a memory 203, and a bus 204; wherein, the communication interface 201, the processor 202 and the memory 203 complete the communication with each other through the bus 204.
The processor 202 may be a CPU, the memory 203 may be a non-volatile memory, and the memory 203 stores logic instructions for detecting leakage of file descriptors, and the processor 202 may execute the logic instructions for detecting leakage of file descriptors stored in the memory 203 to implement the function of detecting leakage of file descriptors.
Thus, the description of the hardware configuration shown in fig. 2 is completed.
Referring to fig. 3, fig. 3 is a block diagram illustrating a file descriptor leakage detecting apparatus according to an exemplary embodiment of the present application. The device may comprise the following elements:
a first reading unit 301, configured to sequentially read file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by files opened by the target process; the file descriptor information corresponding to the file descriptor is used for determining the file structure information of the opened file;
an obtaining unit 302, configured to obtain time information in the file structure information, where the time information includes a first timestamp corresponding to a time when the target process accessed the file last time;
a comparing unit 303, configured to determine whether a time interval between a second timestamp corresponding to the current time and the first timestamp reaches a preset threshold; if so, determining that the target process has file descriptor leakage.
Optionally, the apparatus further comprises:
the period unit is used for reducing the detection period when the file descriptor is leaked from the target process; and when the descriptor is not leaked, increasing the detection period.
Optionally, the apparatus further comprises:
a second reading unit: the process identification of the target process to be detected is acquired from a monitoring process set corresponding to the current detection period; the monitoring process set comprises process identifications of processes needing to be subjected to file descriptor leakage detection; and acquiring a corresponding file descriptor set according to the identifier of the target process.
Optionally, the time when the target process accessed the file last time includes:
the moment when the target process reads the file for the last time;
the moment when the target process writes the file into the file last time;
accordingly, the first timestamp comprises: a maximum value of a time at which the file is read and a time at which the file is written.
Optionally, the file structure includes a first field for recording a time when the file is read and a second field for recording a time when the file is written; the device further comprises:
the first updating unit is used for responding to a reading command of the target process for the file, and calling a first kernel function in an operating system to update the moment of reading the file recorded by the first field;
the second updating unit is used for responding to a write-in command of the target process aiming at the file, and calling a second kernel function in an operating system to update the moment of the file write-in of the second field record;
and/or the presence of a gas in the gas,
and the third updating unit is used for responding to the read-write command of the target process for the file, and calling a third kernel function in an operating system to update the time of reading the file recorded in the first field and the time of writing the file recorded in the second field.
Optionally, the operating system is a Linux operating system; the first kernel function is a vfs _ read or a vfs _ readv function; the second kernel function is a vfs _ write or a vfs _ write function; the third kernel function is a do _ sendfile function.
Optionally, the apparatus further comprises:
and the alarm unit is used for generating alarm information of the leakage of the file descriptor of the target process when the leakage of the file descriptor of the target process is determined, and sending the alarm information to a related user.
The implementation process of the functions and actions of each module in the above device is specifically described in the implementation process of the corresponding step in the above method, and is not described herein again.
For the device embodiments, since they substantially correspond to the method embodiments, reference may be made to the partial description of the method embodiments for relevant points. The above-described embodiments of the apparatus are merely illustrative, wherein the modules described as separate parts may or may not be physically separate, and the parts displayed as modules may or may not be physical modules, may be located in one place, or may be distributed on a plurality of network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of the application. One of ordinary skill in the art can understand and implement it without inventive effort.
The foregoing description of specific embodiments of the present application has been presented. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.
Other embodiments of the present application will be readily apparent to those skilled in the art from consideration of the present application and practice of the invention as claimed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.
It will be understood that the present application is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.
The above description is only for the purpose of illustrating the preferred embodiments of the present application and is not to be construed as limiting the present application, and any modifications, equivalents, improvements, etc. made within the spirit and principle of the present application should be included in the scope of the present application.

Claims (9)

1. A method for file descriptor leak detection, the method comprising:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage:
sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by files opened by the target process; the file descriptor information corresponding to the file descriptor is used for determining the file structure information of the opened file;
acquiring time information in the file structure information, wherein the time information comprises a first timestamp corresponding to the moment when the target process accesses the file last time;
determining whether the time interval between a second timestamp corresponding to the current moment and the first timestamp reaches a preset threshold value; if so, determining that the target process has file descriptor leakage.
2. The method of claim 1, further comprising:
if the target process is determined to have file descriptor leakage, reducing the detection period;
increasing the detection period if it is determined that the descriptor is not revealed.
3. The method of claim 1, wherein reading file descriptors in sequence from a set of file descriptors corresponding to the target process further comprises:
acquiring a process identifier of the target process to be detected from a monitoring process set corresponding to the current detection period; the monitoring process set comprises process identifications of processes needing to be subjected to file descriptor leakage detection;
and acquiring a corresponding file descriptor set according to the identifier of the target process.
4. The method of claim 1, wherein the time when the target process last accessed the file comprises:
the moment when the target process reads the file for the last time;
the moment when the target process writes the file into the file last time;
accordingly, the first timestamp comprises: a maximum value of a time at which the file is read and a time at which the file is written.
5. The method according to claim 4, wherein the file structure body comprises a first field for recording the time of reading the file and a second field for recording the time of writing the file;
the method further comprises the following steps:
responding to a reading command of the target process for the file, and calling a first kernel function in an operating system to update the moment of reading the file recorded by the first field;
responding to a write-in command of the target process for the file, and calling a second kernel function in an operating system to update the moment of the file write-in of the second field record;
and/or the presence of a gas in the gas,
and responding to the read-write command of the target process for the file, and calling a third kernel function in an operating system to update the moment of reading the file recorded in the first field and the moment of writing the file recorded in the second field.
6. The method of claim 5, the operating system being a Linux operating system; the first kernel function is a vfs _ read or a vfs _ readv function; the second kernel function is a vfs _ write or a vfs _ write function; the third kernel function is a do _ sendfile function.
7. The method of claim 1, further comprising:
and when determining that the file descriptor is leaked from the target process, generating alarm information of the file descriptor leakage from the target process, and sending the alarm information to a related user.
8. An apparatus for file descriptor leak detection, the apparatus comprising:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage:
the first reading unit is used for sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by files opened by the target process; the file descriptor information corresponding to the file descriptor is used for determining the file structure information of the opened file;
the acquisition unit is used for acquiring time information in the file structure body information, wherein the time information comprises a first timestamp corresponding to the moment when the target process accesses the file last time;
the comparison unit is used for determining whether the time interval between a second timestamp corresponding to the current moment and the first timestamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage.
9. An apparatus for file descriptor leak detection, comprising:
a processor; a memory for storing the processor-executable instructions;
wherein the processor is configured to:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage:
sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by files opened by the target process; the file descriptor information corresponding to the file descriptor is used for determining the file structure information of the opened file;
acquiring time information in the file structure information, wherein the time information comprises a first timestamp corresponding to the moment when the target process accesses the file last time;
determining whether the time interval between a second timestamp corresponding to the current moment and the first timestamp reaches a preset threshold value; if so, determining that the target process has file descriptor leakage.
CN202011582830.1A 2020-12-28 2020-12-28 Method and device for detecting leakage of file descriptor Active CN112732640B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011582830.1A CN112732640B (en) 2020-12-28 2020-12-28 Method and device for detecting leakage of file descriptor

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011582830.1A CN112732640B (en) 2020-12-28 2020-12-28 Method and device for detecting leakage of file descriptor

Publications (2)

Publication Number Publication Date
CN112732640A true CN112732640A (en) 2021-04-30
CN112732640B CN112732640B (en) 2023-07-25

Family

ID=75606954

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011582830.1A Active CN112732640B (en) 2020-12-28 2020-12-28 Method and device for detecting leakage of file descriptor

Country Status (1)

Country Link
CN (1) CN112732640B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116126577A (en) * 2022-02-28 2023-05-16 北京基调网络股份有限公司 File handle monitoring and leakage analysis method and device and electronic equipment

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001022644A2 (en) * 1999-09-20 2001-03-29 Harkins Paul H Real-time program audit software
US20110238940A1 (en) * 2010-03-25 2011-09-29 Fujitsu Limited Operation processing device and method of detecting memory leak
JP2013246463A (en) * 2012-05-23 2013-12-09 Tani Electronics Corp Method and system for preventing information leakage
US8996821B1 (en) * 2004-12-15 2015-03-31 Emc Corporation Methods and systems for providing resource sharing through file descriptor isomorphism
CN107423213A (en) * 2017-04-11 2017-12-01 腾讯科技（深圳）有限公司 A kind of filec descriptor distribution detection method and device
CN108628740A (en) * 2018-04-10 2018-10-09 杭州迪普科技股份有限公司 A kind of filec descriptor leakage detection method and device
CN109144872A (en) * 2018-08-20 2019-01-04 杭州迪普科技股份有限公司 Detection method, device, terminal device and the readable storage medium storing program for executing of memory overflow
CN110795400A (en) * 2019-10-12 2020-02-14 苏州浪潮智能科技有限公司 File management method, device, equipment and medium
CN110837465A (en) * 2019-10-15 2020-02-25 珠海金山网络游戏科技有限公司 Android-based handle leakage detection method and system

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001022644A2 (en) * 1999-09-20 2001-03-29 Harkins Paul H Real-time program audit software
US8996821B1 (en) * 2004-12-15 2015-03-31 Emc Corporation Methods and systems for providing resource sharing through file descriptor isomorphism
US20110238940A1 (en) * 2010-03-25 2011-09-29 Fujitsu Limited Operation processing device and method of detecting memory leak
JP2013246463A (en) * 2012-05-23 2013-12-09 Tani Electronics Corp Method and system for preventing information leakage
CN107423213A (en) * 2017-04-11 2017-12-01 腾讯科技（深圳）有限公司 A kind of filec descriptor distribution detection method and device
CN108628740A (en) * 2018-04-10 2018-10-09 杭州迪普科技股份有限公司 A kind of filec descriptor leakage detection method and device
CN109144872A (en) * 2018-08-20 2019-01-04 杭州迪普科技股份有限公司 Detection method, device, terminal device and the readable storage medium storing program for executing of memory overflow
CN110795400A (en) * 2019-10-12 2020-02-14 苏州浪潮智能科技有限公司 File management method, device, equipment and medium
CN110837465A (en) * 2019-10-15 2020-02-25 珠海金山网络游戏科技有限公司 Android-based handle leakage detection method and system

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116126577A (en) * 2022-02-28 2023-05-16 北京基调网络股份有限公司 File handle monitoring and leakage analysis method and device and electronic equipment
CN116126577B (en) * 2022-02-28 2024-03-12 北京基调网络股份有限公司 File handle monitoring and leakage analysis method and device and electronic equipment

Also Published As

Publication number Publication date
CN112732640B (en) 2023-07-25

Similar Documents

Publication Publication Date Title
US6721847B2 (en) Cache hints for computer file access
CN109656779A (en) Internal memory monitoring method, device, terminal and storage medium
US7698690B2 (en) Identifying code that wastes time performing redundant computation
CN104424030B (en) Method and device for sharing memory by multi-process operation
KR20200003164A (en) Database synchronization
EP1961012B1 (en) Detector of abnormal destruction of memory sectors
EP3438845A1 (en) Data updating method and device for a distributed database system
US20110066897A1 (en) Methods and apparatuses for determining permanent memory growth
CN100392606C (en) Method for leaking memory of positioning virtual operation system
CN112732640A (en) Method and device for detecting file descriptor leakage
US20110276770A1 (en) Method and system for analysing most recently used registry keys
CN113312322B (en) STDF file reading and writing method, medium, equipment and device
CN112130759A (en) Parameter configuration method, system and related device of storage system
CN110795031A (en) Data deduplication method, device and system based on full flash storage
CN112181275A (en) Data processor and data processing method
CN112114987B (en) Abnormality detection method and device for operation environment, intelligent terminal and storage medium
CN114443339A (en) Error log recording method based on double-timestamp circular queue
CN113971977A (en) Method, device and equipment for detecting read interference influence of memory and storage medium
CN114356912A (en) Method for writing data into database and computer equipment
CN102156631A (en) Method and system for managing indicator in programming language
CN111338956A (en) Automatic pressure measurement method, device, equipment and storage medium
CN112506736B (en) Method and device for monitoring open state of office file
CN110990267A (en) Data processing method and device
CN111651466A (en) Data sampling method and device
EP3557422A1 (en) Method for accessing code sram, and electronic device

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant