CN112732640B - Method and device for detecting leakage of file descriptor - Google Patents
Method and device for detecting leakage of file descriptor Download PDFInfo
- Publication number
- CN112732640B CN112732640B CN202011582830.1A CN202011582830A CN112732640B CN 112732640 B CN112732640 B CN 112732640B CN 202011582830 A CN202011582830 A CN 202011582830A CN 112732640 B CN112732640 B CN 112732640B
- Authority
- CN
- China
- Prior art keywords
- file
- time
- target process
- descriptor
- reading
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/11—File system administration, e.g. details of archiving or snapshots
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/302—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a software system
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3409—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment
- G06F11/3419—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment by assessing time
- G06F11/3423—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment by assessing time where the assessed time is active or idle time
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Quality & Reliability (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Mathematical Physics (AREA)
- Computer Hardware Design (AREA)
- Storage Device Security (AREA)
Abstract
The application provides a file descriptor leakage detection method and device, wherein the method comprises the following steps: based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage or not: sequentially reading file descriptors from a file descriptor set corresponding to the target process; acquiring time information in the file structure body information, wherein the time information comprises a first time stamp corresponding to the latest time when the target process accesses the file; determining whether the time interval between a second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage. Through the technical scheme, the detection efficiency is improved, and the detection is more accurate and timely.
Description
Technical Field
The present disclosure relates to the field of communications technologies, and in particular, to a method and an apparatus for detecting leakage of a file descriptor.
Background
In the Linux operating system, everything can be seen as a file, such as a general file, a directory, a link, and a device are all seen as one file. When a process in a Linux system opens or creates a file, the kernel returns a file descriptor to the process, where the file descriptor is an index created by the kernel for efficiently managing the file opened by the process, and is a non-negative integer.
In the Linux kernel, there is a file descriptor table corresponding to each process, which indicates all the files opened by the process, the file descriptor table of each process is independent, the file descriptor fd and the file pointer are important contents of the file descriptor table, the file descriptor fd is the index of the table, and the file pointer points to the struct file structure corresponding to the opened file. The file structure represents an open file, each open file in the system has an associated struct file in kernel space, which is created by the kernel when the file is opened and passed to any function operating on the file, and the structure describes important information such as the file's open mode, read-write location, etc.
In the file descriptor table, the first 3 file descriptors are occupied by default, 0 is the standard input, 1 is the standard output, and 2 is the standard error. If a new file is opened at this time, its file descriptor will be 3, and then a file is opened, the file descriptor fd will be incremented. Typically, the file descriptor occupied by a process defaults to 1024. Each time a file is opened, a text descriptor is occupied, if an unnecessary file is always opened and not closed, the file descriptor is still occupied, the file descriptor is continuously increased until the upper limit, no new file descriptor is available, at this time, a new file descriptor cannot be allocated to the file, and therefore an application program cannot open the new file, and service abnormality and even breakdown are caused. This phenomenon, in which the file is not closed in time, but instead continues to occupy the file descriptor, is called file descriptor leakage.
Disclosure of Invention
In view of the foregoing, the present application provides a method and apparatus for detecting leakage of a file descriptor, which are used for detecting leakage of the file descriptor.
According to a first aspect of embodiments of the present application, there is provided a method of file descriptor leak detection, the method comprising:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage or not:
sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by the opened files of the target process; the file descriptor information corresponding to the file descriptor is used for determining file structure information of the opened file;
acquiring time information in the file structure body information, wherein the time information comprises a first time stamp corresponding to the latest time when the target process accesses the file;
determining whether the time interval between a second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage.
According to a second aspect of embodiments of the present application, there is provided an apparatus for file descriptor leak detection, the apparatus comprising:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage or not:
the first reading unit is used for sequentially reading file descriptors from the file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by the opened files of the target process; the file descriptor information corresponding to the file descriptor is used for determining file structure information of the opened file;
an obtaining unit, configured to obtain time information in the file structure body information, where the time information includes a first timestamp corresponding to a time when the target process accesses the file last time;
the comparison unit is used for determining whether the time interval between the second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage.
According to a third aspect of embodiments of the present application, there is provided an apparatus for file descriptor leak detection, the apparatus comprising:
a processor; a memory for storing the processor-executable instructions;
wherein the processor is configured to:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage or not:
sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by the opened files of the target process; the file descriptor information corresponding to the file descriptor is used for determining file structure information of the opened file;
acquiring time information in the file structure body information, wherein the time information comprises a first time stamp corresponding to the latest time when the target process accesses the file;
determining whether the time interval between a second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage.
According to the technical scheme, by expanding the Linux kernel struct file structure body and adding the two fields of reading and writing time, the reading and writing time can be recorded on the structure body when the process performs the reading and writing operation of the opened file. And determining the time closest to the current time in the latest read time and the latest write time, comparing the latest read time and the latest write time with the current time, judging whether a preset time threshold is exceeded according to the comparison result to detect whether the file descriptor leaks, and timely finding the leakage problem of the file descriptor. And when leakage occurs, alarm information is sent to a user, so that hidden danger is eliminated in advance. Meanwhile, according to the leakage condition of the file descriptor, the sleep time adjustment detection period is automatically set, so that the occupancy rate of the CPU is reduced.
Drawings
FIG. 1 is a flow chart of a method for file descriptor leak detection provided by an exemplary embodiment;
FIG. 2 is a hardware architecture diagram of an apparatus in which a file descriptor leak detection device is located, in accordance with one illustrative embodiment;
FIG. 3 is a block diagram of a file descriptor leak detection apparatus provided by an exemplary embodiment.
Detailed Description
Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numbers in different drawings refer to the same or similar elements, unless otherwise indicated. The implementations described in the following exemplary examples are not representative of all implementations consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with some aspects of the present application as detailed in the accompanying claims.
The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in this application and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items.
It should be understood that although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, a first message may also be referred to as a second message, and similarly, a second message may also be referred to as a first message, without departing from the scope of the present application. The word "if" as used herein may be interpreted as "at … …" or "at … …" or "responsive to a determination", depending on the context.
In the related art, when a file descriptor leaks, a process cannot open or create a file, causing a program exception or even crash. Therefore, in order to ensure the normal operation of the system, the file descriptor needs to be checked manually, and the problem of leakage of the file descriptor is timely and returned.
When the method is realized, when whether the file descriptor of the process leaks or not is checked, the state of the current process can be displayed through ps commands to obtain a process ID, then all the files opened by the process are checked through/proc/process ID/fd commands, the number of the files under the directory is counted, the number of the file descriptors opened by the process is determined, and whether the file descriptor leaks or not is judged manually.
If the number of file descriptors under the directory is particularly large, the number of the file descriptors always presents a growing trend when being checked for multiple times, so that the file descriptors are likely to leak, and if whether the file descriptors leak or not is determined, manual statistics and judgment are still needed.
In addition, if the problem of file descriptor leakage occurs slowly, it takes a long time to find, and it may not be easily found, so that the problem of file descriptor leakage cannot be found in time. In this case, a plurality of times of manual statistics are required to determine whether leakage has occurred.
Moreover, the detection period cannot be determined by manual statistics, and if the period is too short, the detection frequency is too high, so that a lot of idle work is performed under the condition that file leakage is slow to send. If the detection period is increased and the detection frequency is decreased, then when a large number of file descriptors leak, it is likely that the leak has occurred for a long time when the file descriptor leak is detected, and the detection is not timely enough.
Therefore, whether the file descriptor leakage is sent or not is judged according to the number of the file descriptors, and the problem of the file descriptor leakage is detected manually with low efficiency, and the method is not accurate and timely.
In view of this, the present application proposes a method for detecting leakage of a file descriptor, by periodically obtaining a file descriptor in a file descriptor set corresponding to a target process to be detected, reading a first timestamp of a file pointed by the file descriptor that is accessed last time, and comparing whether a time interval between the first timestamp and a second timestamp corresponding to a current moment reaches a preset threshold value, so as to determine whether the file descriptor leaks.
When the method is implemented, two fields of reading time and writing time are added by expanding a struct file structure body in a kernel, when a process reads a file each time, the reading file time record can be updated through functions such as a kernel vfs_read and a vfs_reads, when the process writes the file each time, the writing file time record can be updated through functions such as a kernel vfs_write and a vfs_write, and when the process reads and writes the file each time, the reading file time record and the writing file time record can be updated through functions such as a kernel do_sendfile.
In addition, the process descriptor detailed information fdDetail is added through an expansion/proc/process id/fd command, and the file descriptor detailed information can be acquired through a/proc/process id/fdDetail command, and the file descriptor fd, the latest reading time and the latest writing time are output.
Based on a preset detection period, for each process in a monitoring process set, acquiring a file descriptor set corresponding to the process according to a process ID, sequentially reading file descriptors in the file descriptor set, acquiring a first time stamp corresponding to the last accessed time of a file corresponding to the file descriptor, determining whether the time interval between a second time stamp corresponding to the current time and the first time stamp reaches a preset threshold, and if so, determining that the process has file descriptor leakage.
In the technical scheme, the read-write time information is recorded by expanding the struct file structure in the kernel, and the first time stamp accessed by the file last time is obtained by increasing the process descriptor detailed information fdDetail to output the file descriptor detailed information, so that whether the time interval between the first time stamp and the second time stamp corresponding to the current time reaches a preset threshold value can be compared, whether the file descriptor leaks or not is judged, the detection efficiency of the file descriptor leakage is improved, and the detection is more accurate and timely.
Next, embodiments of the present application will be described in detail.
Referring to fig. 1, fig. 1 is a flowchart of a file descriptor leak detection method according to an exemplary embodiment of the present application, which is applicable to a device installed with a Linux system.
It should be noted that the file descriptor leak detection method is periodically executed, and since the flow of file descriptor leak detection performed in each period is the same, the file descriptor leak detection flow performed in only one period is described in detail here.
The file descriptor leak detection flow may include the following steps:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage or not:
step 101, sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by the opened files of the target process; the file descriptor information corresponding to the file descriptor is used for determining file structure information of the opened file;
102, acquiring time information in the file structure body information, wherein the time information comprises a first timestamp corresponding to the latest time when the target process accesses the file;
step 103, determining whether the time interval between the second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value; if so, determining that the target process has file descriptor leakage.
In the Linux system kernel, when an existing file is opened or a new file is created, the kernel returns a file descriptor to the process for subsequent read and write operations on the file. In each process, a table of file descriptors is maintained, the file descriptors being the index of the table, the index being represented by file descriptor fd, each entry having a file pointer to the opened file, the file pointer pointing to the struct file structure. The file structure represents an open file, each open file in the system has an associated struct file structure in the kernel, which is created by the kernel when the file is opened and passed to any function operating on the file.
In this embodiment, the file descriptor information set corresponding to the target process, that is, the file descriptor table corresponding to the target process, where the file descriptor table includes a file descriptor table entry corresponding to a file descriptor occupied by an opened file of the target process, where the file descriptor identifier is a file descriptor fd occupied by an opened file of the target process, and a file pointer points to the opened file. Based on a preset detection period, periodically acquiring a file descriptor set corresponding to a target process to be detected, wherein the set comprises file descriptors corresponding to file descriptors occupied by files opened by the target process, and file descriptor information comprises file descriptor identifiers and pointers pointing to file structures of the files corresponding to the file descriptors. In the file descriptor table fd corresponds to an index of the array, the file pointer corresponds to the content of the array, and points to a file structure body, and the file descriptor information is used for determining file structure body information of the opened file.
It should be noted that, by expanding the struct file structure in the kernel, the read time field and the write time field are added. When a process reads a file each time, the read file time record can be updated through functions such as a kernel vfs_read and a kernel vfs_ready, when the process writes the file each time, the write file time record can be updated through functions such as a kernel vfs_write and a kernel vfs_write, and when the process reads the file each time, the read file time record and the write file time record can be updated through functions such as a kernel do_sendfile. By expanding the field of the file structure, the time information is stored in the file structure.
In this embodiment, for file descriptors sequentially read in a file descriptor set, a file structure body pointed by a pointer associated with the file descriptor is obtained, and time information stored in the file structure body is obtained, where the time information is a time when a process accesses a file corresponding to the file descriptor last time, and the time is a first timestamp.
It should be noted that, by extending/proc/process id/fd command, the detailed information fdDetail of the process descriptor is added, and for each file descriptor, since the read-write time information is recorded in the pointed file structure body, the detailed information of the file descriptor can be output through the proc/process id/fdDetail command, the file descriptor fd is obtained, and the time of last reading and writing of the file corresponding to the file descriptor by the process is obtained. By adding the process descriptor detailed information fdDetail, the time information is output.
Specifically, after the time when the target process reads and writes the file last time, comparing the maximum value of the last read time and the last write time, and taking the maximum value as the first timestamp of the last access of the process to the file.
In this embodiment, after the first timestamp of the last access to the file by the process is obtained, the first timestamp is compared with the second timestamp corresponding to the current time, and whether the time interval between the first timestamp and the second timestamp reaches the preset threshold is determined. If the preset threshold value is reached, determining that the target process has file descriptor leakage.
Furthermore, according to the leakage condition of the descriptors, the detection period can be adjusted, the detection frequency can be flexibly changed, and the CPU occupancy rate can be reduced.
In one embodiment shown, if it is determined that the file descriptor leaks, the detection period is reduced to increase the detection frequency; if it is determined that the file descriptor is not revealed, the detection period is increased to decrease the detection frequency. In addition, the default sleep time is one hour, and can be adjusted in a self-defined way, which is not limited in the application.
In one embodiment, a device may create a set of monitoring processes that includes multiple target processes to be detected, where the processes may be corresponding to a program that scans for the device running, or may be designated processes that are manually added. When the device detects that a process in the monitoring set stops running, the device can delete the running process from the monitoring set.
Any object process to be detected identification can be obtained from the monitoring process set corresponding to the current detection period, the process identification can be a process ID, and then the file descriptor set corresponding to the process is obtained through a/proc/process ID/fd command.
In one embodiment, when it is determined that the target process has a file descriptor leak, alarm information that the target process has the file descriptor leak is generated, and the alarm information is sent to a relevant user.
The alert information may include a process identification of the target process, such as a process name and a process ID, and time interval information, where the file descriptor leakage occurs. Meanwhile, the alarm can be given to the user through short messages, weChat, mails, syslog and other modes.
According to the file descriptor leakage detection method, equipment can periodically acquire a file descriptor set corresponding to each process, a first time stamp of a file which is opened and accessed by a target process to be detected for the last time is acquired according to time information stored in a file structure body associated with the file descriptor, and whether the file descriptor is leaked is judged by comparing whether a time interval between a second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value or not. By automatically detecting the leakage of the file descriptor and judging the record of the read-write time added in the file structure, the detection efficiency of the leakage of the file descriptor is improved, and the detection is more accurate and timely.
Referring to fig. 2, the present application further provides a hardware architecture diagram of an apparatus in which the file descriptor leakage detecting device is located, where the apparatus includes: a communication interface 201, a processor 202, a memory 203, and a bus 204; wherein the communication interface 201, the processor 202 and the memory 203 perform communication with each other via a bus 204.
The processor 202 may be a CPU, the memory 203 may be a nonvolatile memory, and the memory 203 stores a file descriptor leak detection logic instruction, and the processor 202 may execute the file descriptor leak detection logic instruction stored in the memory 203 to implement a function of file descriptor leak detection.
Thus, the description of the hardware configuration shown in fig. 2 is completed.
Referring to fig. 3, fig. 3 is a block diagram of a file descriptor leakage detecting apparatus according to an exemplary embodiment of the present application. The device may comprise the following units:
a first reading unit 301, configured to sequentially read file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by the opened files of the target process; the file descriptor information corresponding to the file descriptor is used for determining file structure information of the opened file;
an obtaining unit 302, configured to obtain time information in the file structure body information, where the time information includes a first timestamp corresponding to a time when the target process accesses the file last time;
a comparing unit 303, configured to determine whether a time interval between a second timestamp corresponding to the current time and the first timestamp reaches a preset threshold; if so, determining that the target process has file descriptor leakage.
Optionally, the apparatus further includes:
a period unit, configured to reduce the detection period when the target process has a file descriptor leak; and when the descriptor is not leaked, increasing the detection period.
Optionally, the apparatus further includes:
a second reading unit: the process identification of the target process to be detected is obtained from a monitoring process set corresponding to the current detection period; the monitoring process set comprises process identifiers of processes needing to be subjected to file descriptor leakage detection; and acquiring a corresponding file descriptor set according to the identification of the target process.
Optionally, the time when the target process last accesses the file includes:
the target process carries out file reading on the file at the latest moment;
the target process performs file writing on the file at the latest moment;
correspondingly, the first timestamp includes: the maximum value of the time of reading the file and the time of writing the file.
Optionally, the file structure body includes a first field for recording a time of reading the file and a second field for recording a time of writing the file; the apparatus further comprises:
a first updating unit, which is used for responding to a reading command of the target process for the file and calling a first kernel function in an operating system to update the reading moment of the file recorded in the first field;
a second updating unit, which responds to the writing command of the target process for the file, and calls a second kernel function in an operating system to update the writing moment of the file recorded in the second field;
and/or the number of the groups of groups,
and the third updating unit is used for responding to the read-write command of the target process for the file, and calling a third kernel function in an operating system to update the time of reading the file recorded in the first field and the time of writing the file recorded in the second field.
Optionally, the operating system is a Linux operating system; the first kernel function is a vfs_read or a vfs_readv function; the second kernel function is a vfs_write or a vfs_write function; the third kernel function is a do_sendfile function.
Optionally, the apparatus further includes:
and the alarm unit is used for generating alarm information of the file descriptor leakage of the target process when the file descriptor leakage of the target process is determined, and sending the alarm information to related users.
The implementation process of the functions and roles of each module in the above device is specifically shown in the implementation process of the corresponding steps in the above method, and will not be described herein again.
For the device embodiments, reference is made to the description of the method embodiments for the relevant points, since they essentially correspond to the method embodiments. The apparatus embodiments described above are merely illustrative, wherein the modules illustrated as separate components may or may not be physically separate, and the components shown as modules may or may not be physical, i.e., may be located in one place, or may be distributed over a plurality of network modules. Some or all of the modules may be selected according to actual needs to achieve the purposes of the present application. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
The foregoing describes specific embodiments of the present application. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the application pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.
It is to be understood that the present application is not limited to the precise arrangements and instrumentalities shown in the drawings, which have been described above, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the application is limited only by the appended claims.
The foregoing description of the preferred embodiments is provided for the purpose of illustration only, and is not intended to limit the invention to the particular embodiments disclosed, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.
Claims (7)
1. A method of file descriptor leak detection, the method comprising:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage or not:
sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by the opened files of the target process; the file descriptor information corresponding to the file descriptor is used for determining file structure information of the opened file; the file structure body comprises a first field for recording the time of reading the file and a second field for recording the time of writing the file;
responding to a reading command of the target process for the file, and calling a first kernel function in an operating system to update the reading moment of the file recorded in the first field;
responding to a writing command of the target process for the file, and calling a second kernel function in an operating system to update the writing moment of the file recorded in the second field;
responding to a read-write command of the target process for the file, and calling a third kernel function in an operating system to update the time of reading the file recorded in the first field and the time of writing the file recorded in the second field;
for the read file descriptor, acquiring a file structure body pointed by a pointer associated with the file descriptor, and acquiring time information in the file structure body information, wherein the time information comprises a first time stamp corresponding to the latest time when the target process accesses the file; the time when the target process accesses the file last time includes: the target process carries out file reading on the file at the latest moment; the target process performs file writing on the file at the latest moment; the first timestamp includes: the maximum value of the time of reading the file and the time of writing the file;
determining whether the time interval between a second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage.
2. The method according to claim 1, wherein the method further comprises:
if the target process is determined to have file descriptor leakage, reducing the detection period;
if it is determined that the file descriptor is not revealed, the detection period is increased.
3. The method of claim 1, wherein prior to sequentially reading file descriptors from the set of file descriptors corresponding to the target process, the method further comprises:
acquiring a process identifier of the target process to be detected from a monitoring process set corresponding to the current detection period; the monitoring process set comprises process identifiers of processes needing to be subjected to file descriptor leakage detection;
and acquiring a corresponding file descriptor set according to the identification of the target process.
4. The method of claim 1, wherein the operating system is a Linux operating system; the first kernel function is a vfs_read or a vfs_readv function; the second kernel function is a vfs_write or a vfs_write function; the third kernel function is a do_sendfile function.
5. The method according to claim 1, wherein the method further comprises:
when the target process is determined to have the file descriptor leaked, generating alarm information of the target process having the file descriptor leaked, and sending the alarm information to related users.
6. An apparatus for file descriptor leak detection, the apparatus comprising:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage or not:
the first reading unit is used for sequentially reading file descriptors from the file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by the opened files of the target process; the file descriptor information corresponding to the file descriptor is used for determining file structure information of the opened file; the file structure body comprises a first field for recording the time of reading the file and a second field for recording the time of writing the file;
a first updating unit, configured to respond to a read command of the target process for the file, and call a first kernel function in an operating system to update a time of reading the file recorded in the first field;
a second updating unit, configured to respond to a write command of the target process for the file, and call a second kernel function in an operating system to update a time of writing the file recorded in the second field;
a third updating unit, configured to respond to a read-write command of the target process for the file, and call a third kernel function in an operating system to update a time of reading the file recorded in the first field and a time of writing the file recorded in the second field;
the acquiring unit is used for acquiring a file structure body pointed by a pointer associated with the file descriptor aiming at the read file descriptor, and acquiring time information in the file structure body information, wherein the time information comprises a first time stamp corresponding to the latest time when the target process accesses the file; the time when the target process accesses the file last time includes: the target process carries out file reading on the file at the latest moment; the target process performs file writing on the file at the latest moment; the first timestamp includes: the maximum value of the time of reading the file and the time of writing the file;
the comparison unit is used for determining whether the time interval between the second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage.
7. An apparatus for file descriptor leak detection, comprising:
a processor; a memory for storing the processor-executable instructions;
wherein the processor is configured to:
based on a preset detection period, periodically detecting a target process to be detected as follows to determine whether the target process has file descriptor leakage or not:
sequentially reading file descriptors from a file descriptor set corresponding to the target process; the file descriptor set comprises file descriptors occupied by the opened files of the target process; the file descriptor information corresponding to the file descriptor is used for determining file structure information of the opened file; the file structure body comprises a first field for recording the time of reading the file and a second field for recording the time of writing the file;
responding to a reading command of the target process for the file, and calling a first kernel function in an operating system to update the reading moment of the file recorded in the first field;
responding to a writing command of the target process for the file, and calling a second kernel function in an operating system to update the writing moment of the file recorded in the second field;
responding to a read-write command of the target process for the file, and calling a third kernel function in an operating system to update the time of reading the file recorded in the first field and the time of writing the file recorded in the second field;
for the read file descriptor, acquiring a file structure body pointed by a pointer associated with the file descriptor, and acquiring time information in the file structure body information, wherein the time information comprises a first time stamp corresponding to the latest time when the target process accesses the file; the time when the target process accesses the file last time includes: the target process carries out file reading on the file at the latest moment; the target process performs file writing on the file at the latest moment; the first timestamp includes: the maximum value of the time of reading the file and the time of writing the file;
determining whether the time interval between a second time stamp corresponding to the current time and the first time stamp reaches a preset threshold value or not; if so, determining that the target process has file descriptor leakage.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011582830.1A CN112732640B (en) | 2020-12-28 | 2020-12-28 | Method and device for detecting leakage of file descriptor |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011582830.1A CN112732640B (en) | 2020-12-28 | 2020-12-28 | Method and device for detecting leakage of file descriptor |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112732640A CN112732640A (en) | 2021-04-30 |
| CN112732640B true CN112732640B (en) | 2023-07-25 |
Family
ID=75606954
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011582830.1A Active CN112732640B (en) | 2020-12-28 | 2020-12-28 | Method and device for detecting leakage of file descriptor |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112732640B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113886171A (en) * | 2021-08-27 | 2022-01-04 | 阿里云计算有限公司 | Process monitoring method, computer program product and electronic device |
| CN116126577B (en) * | 2022-02-28 | 2024-03-12 | 北京基调网络股份有限公司 | File handle monitoring and leakage analysis method and device and electronic equipment |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2013246463A (en) * | 2012-05-23 | 2013-12-09 | Tani Electronics Corp | Method and system for preventing information leakage |
| US8996821B1 (en) * | 2004-12-15 | 2015-03-31 | Emc Corporation | Methods and systems for providing resource sharing through file descriptor isomorphism |
| CN107423213A (en) * | 2017-04-11 | 2017-12-01 | 腾讯科技（深圳）有限公司 | A kind of filec descriptor distribution detection method and device |
| CN110795400A (en) * | 2019-10-12 | 2020-02-14 | 苏州浪潮智能科技有限公司 | File management method, device, equipment and medium |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP1354270A4 (en) * | 1999-09-20 | 2004-09-15 | Paul H Harkins | Real-time program audit software |
| JP5459009B2 (en) * | 2010-03-25 | 2014-04-02 | 富士通株式会社 | Arithmetic processing device and memory leak detection method |
| CN108628740A (en) * | 2018-04-10 | 2018-10-09 | 杭州迪普科技股份有限公司 | A kind of filec descriptor leakage detection method and device |
| CN109144872A (en) * | 2018-08-20 | 2019-01-04 | 杭州迪普科技股份有限公司 | Detection method, device, terminal device and the readable storage medium storing program for executing of memory overflow |
| CN110837465A (en) * | 2019-10-15 | 2020-02-25 | 珠海金山网络游戏科技有限公司 | Android-based handle leakage detection method and system |
-
2020
- 2020-12-28 CN CN202011582830.1A patent/CN112732640B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8996821B1 (en) * | 2004-12-15 | 2015-03-31 | Emc Corporation | Methods and systems for providing resource sharing through file descriptor isomorphism |
| JP2013246463A (en) * | 2012-05-23 | 2013-12-09 | Tani Electronics Corp | Method and system for preventing information leakage |
| CN107423213A (en) * | 2017-04-11 | 2017-12-01 | 腾讯科技（深圳）有限公司 | A kind of filec descriptor distribution detection method and device |
| CN110795400A (en) * | 2019-10-12 | 2020-02-14 | 苏州浪潮智能科技有限公司 | File management method, device, equipment and medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112732640A (en) | 2021-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112732640B (en) | Method and device for detecting leakage of file descriptor | |
| CN107066390B (en) | Dynamic memory leak detection method and system | |
| CN109656779A (en) | Internal memory monitoring method, device, terminal and storage medium | |
| CN112148699B (en) | Log management method, device, equipment and medium | |
| CN115639971B (en) | Data writing method, data writing device, electronic device, storage medium, and program product | |
| CN112445686A (en) | Memory leak detection method, device and computer-readable storage medium | |
| US8010834B2 (en) | Failure information monitoring apparatus and failure information monitoring method | |
| CN113064919B (en) | Data processing method, data storage system, computer device and storage medium | |
| CN117290557A (en) | Data loading method, related device, equipment and readable storage medium | |
| CN111752715A (en) | System optimization method, device, equipment and storage medium under large quantity of requests | |
| CN106874191B (en) | Intelligent database execution method and system | |
| CN115713962A (en) | Memory test method, system and computer readable storage medium | |
| CN115422008A (en) | Non-invasive process monitoring method, device, equipment and storage medium | |
| CN112114987B (en) | Abnormality detection method and device for operation environment, intelligent terminal and storage medium | |
| CN110471623B (en) | Hard disk file writing method, device, computer equipment and storage medium | |
| CN112579571B (en) | Monitoring data configuration, data monitoring method, device, equipment and storage medium | |
| CN114003339A (en) | Detection method and device for zombie virtual machine, computer equipment and storage medium | |
| CN112783866A (en) | Data reading method and device, computer equipment and storage medium | |
| CN108874560B (en) | Method and communication device for communication | |
| CN112800123A (en) | Data processing method, data processing device, computer equipment and storage medium | |
| CN109753325B (en) | Desktop unread number updating method, device, application and terminal | |
| CN111124814A (en) | SOC memory access monitoring method and device and computer equipment | |
| CN118035042B (en) | Application program performance analysis method and device, electronic equipment and storage medium | |
| CN112199195B (en) | Process resource processing method and device | |
| CN112506736B (en) | Method and device for monitoring open state of office file |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |