CN113704179B - File monitoring method, device, computer system and storage medium - Google Patents

Abstract

The disclosure provides a file monitoring method, comprising the following steps: setting operation parameters of a functional module for realizing a file system notification mechanism in a kernel mode, wherein the operation parameters comprise processing functions for responding to file events; monitoring whether the file system responds to external operation within a predetermined period of time by calling a monitoring interface function of the functional module; in response to monitoring that the file system responds to external operation within a predetermined period of time, calling a processing function according to a file event triggered by the response of the file system to the external operation to obtain information of a file responding to the external operation in the file system, wherein the information of the file responding to the external operation comprises a path of the file and a type of the file event; and sending the information of the file responding to the external operation to the user-mode application program so that the application program can process the file responding to the external operation. The disclosure also provides a file monitoring device, a computer system and a storage medium.

Description

File monitoring method, device, computer system and storage medium

Technical field

The present disclosure relates to the field of computer technology, and more specifically, to a file monitoring method, device, computer system and storage medium.

Background technique

In computer applications, some applications need to sense file creation, file closing and other operations in the file system in order to process the files where these operations have occurred.

In the process of realizing the concept of the present disclosure, the inventor found that if a file monitoring notification application for direct use is provided in the user mode, when monitoring a file, calling the file monitoring notification application can monitor the specified file or directory.

However, user-mode file monitoring notification applications generally need to make clear settings for the directories or files that need to be monitored when monitoring. If there are many files or directories on the current file system, specifying the monitoring directories and files one by one is very time-consuming, and It consumes a lot of memory and causes a heavy system load.

Contents of the invention

In view of this, the present disclosure provides a file monitoring method, device, computer system and storage medium.

One aspect of the present disclosure provides a file monitoring method, including: setting operating parameters of a functional module in the kernel state for implementing a file system notification mechanism, where the operating parameters include a processing function for responding to file events; by calling a function The monitoring interface function of the module monitors whether the file system responds to external operations within a predetermined period of time; in response to monitoring that the file system responds to external operations within a predetermined period of time, call processing based on file events triggered by the file system's response to external operations. Function to obtain information about files in the file system that respond to external operations, where the information about files that respond to external operations includes the path of the file and the type of file event; and to send information about files that respond to external operations to user-mode applications. , to enable the application to process files in response to external operations.

According to an embodiment of the present disclosure, the monitoring interface function includes a first parameter and a second parameter. The first parameter is used to identify the first directory corresponding to the first parameter and all files in subdirectories at all levels under the first directory. The second parameter is used to identify the file in the second directory corresponding to the second parameter.

According to an embodiment of the present disclosure, the method further includes, after calling the monitoring interface function: setting the first parameter to the root directory of the file system, and setting the second parameter to empty, so that during the process of calling the monitoring interface function Monitor whether all files in subdirectories at all levels under the root directory of the file system respond to external operations.

According to an embodiment of the present disclosure, the method further includes: before calling the monitoring interface function of the functional module: calling the registration interface function of the functional module; registering with the functional module according to the operating parameters; and after successful registration, calling the monitoring interface function of the functional module Interface functions.

According to an embodiment of the present disclosure, sending the information of the file in response to the external operation to the user-mode application includes: sending the information of the file in which the operation occurs to a communication port number pre-agreed with the application, so that the application can communicate by monitoring The port number obtains information about the file that responds to external operations.

According to an embodiment of the present disclosure, the type of file event includes at least one of the following: file creation, file opening, file writing, file closing, file deletion, and file renaming.

Another aspect of the present disclosure provides a file monitoring device, including: a first setting module for setting operating parameters of a functional module for implementing a file system notification mechanism in the kernel state, wherein the operating parameters include a file system for responding to a file. The event processing function; the monitoring module, used to monitor whether the file system responds to external operations within a predetermined period of time by calling the monitoring interface function of the function module; the processing module, used to respond to monitoring that the file system responds to external operations within a predetermined period of time Operation, according to the file event triggered by the file system's response to the external operation, the processing function is called to obtain the information of the file in the file system that responds to the external operation, where the information of the file that responds to the external operation includes the path of the file and the name of the file event. type; and a sending module, used to send information about files responding to external operations to user-mode applications, so that the applications can process files responding to external operations.

According to an embodiment of the present disclosure, the monitoring interface function includes a first parameter and a second parameter. The first parameter is used to identify the first directory corresponding to the first parameter and all files in subdirectories at all levels under the first directory. The second parameter is used to identify the file in the second directory corresponding to the second parameter.

According to an embodiment of the present disclosure, the device further includes: a second setting module, configured to set the first parameter to the root directory of the file system after calling the monitoring interface function, and set the second parameter to empty, so that after calling the monitoring interface function, During the process of calling the monitoring interface function, monitor whether all files in subdirectories at all levels under the root directory of the file system respond to external operations.

Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions that, when executed, are used to implement the method as described above.

Another aspect of the present disclosure provides a computer program product comprising computer-executable instructions that, when executed, are used to implement the method as described above.

Another aspect of the present disclosure provides a computer system, including: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are processed by the one or more When executed by one or more processors, the one or more processors implement the method as described above.

According to the embodiment of the present disclosure, the operating parameters of the functional module used to implement the file system notification mechanism in the kernel mode are set, where the operating parameters include a processing function for responding to file events; by calling the monitoring interface function of the functional module, Monitor whether the file system responds to external operations within a predetermined period of time; in response to monitoring that the file system responds to external operations within a predetermined period of time, trigger file events, call processing functions to process file events, and obtain information about files in the file system that respond to external operations. , where the information of the file in response to external operations includes the path of the file and the type of file event; the technology of sending the information of the file in response to external operations to the user-mode application so that the application can process the file in response to external operations. means. Since the functional module of the kernel state for implementing the file system notification mechanism is used to monitor the file system, there is no need to specify the monitoring directories and files one by one. Therefore, the problem of large system load caused by specifying the monitoring directories and files one by one in the related technology is at least partially overcome. Technical problems, and then achieve the technical effect of having little impact on the system load.

Description of drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure with reference to the accompanying drawings, in which:

Figure 1 schematically illustrates an exemplary system architecture in which the file monitoring method and device of the present disclosure can be applied;

Figure 2 schematically shows a flow chart of a file monitoring method according to an embodiment of the present disclosure;

Figure 3 schematically shows a flow chart of a method for a processing module to register with a monitoring module according to an embodiment of the present disclosure;

Figure 4 schematically shows a block diagram of a file monitoring device according to an embodiment of the present disclosure; and

Figure 5 schematically shows a block diagram of a computer system suitable for file monitoring methods and devices according to embodiments of the present disclosure.

Detailed ways

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for convenience of explanation, numerous specific details are set forth to provide a comprehensive understanding of the disclosed embodiments. It will be apparent, however, that one or more embodiments may be practiced without these specific details. Furthermore, in the following description, descriptions of well-known structures and techniques are omitted to avoid unnecessarily confusing the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the disclosure. The terms "comprising," "comprising," and the like, as used herein, indicate the presence of stated features, steps, operations, and/or components but do not exclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used here should be interpreted to have meanings consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

Where an expression similar to "at least one of A, B, C, etc." is used, it should generally be interpreted in accordance with the meaning that a person skilled in the art generally understands the expression to mean (e.g., "having A, B and C "A system with at least one of" shall include, but is not limited to, systems with A alone, B alone, C alone, A and B, A and C, B and C, and/or systems with A, B, C, etc. ). Where an expression similar to "at least one of A, B or C, etc." is used, it should generally be interpreted in accordance with the meaning that a person skilled in the art generally understands the expression to mean (for example, "having A, B or C "A system with at least one of" shall include, but is not limited to, systems with A alone, B alone, C alone, A and B, A and C, B and C, and/or systems with A, B, C, etc. ).

In the process of implementing the present disclosure, it is found that a directly used file monitoring notification solution can be provided in the user mode. Monitoring solutions that can be used directly in user mode include inotify (inode notify, index node monitoring notification) and dnotify (directory notify, directory monitoring notification).

When monitoring, inotify or dnotify running in the user mode needs to make clear settings for the directories or files that need to be monitored, otherwise it will not be able to monitor, thus limiting it to only monitor changes in files or directories with specified identifiers.

At the same time, neither inotify nor dnotify can monitor files in subdirectories at all levels in the specified directory. When the corresponding directory and its subdirectories need to be monitored at the same time, all subdirectories need to be specified level by level, which limits its application. Monitoring of a small number of files or directories.

Furthermore, using inotify or dnotify to monitor the entire file system requires first scanning all files and directories on the current system, and then specifying the monitoring directories and files one by one, which is very troublesome and not very feasible. Because, if there are many files or directories on the current file system, scanning the entire file system is very time-consuming, and setting up monitoring for all directories and files requires a large amount of memory and file descriptor resources, which is very likely to cause problems. Failed due to insufficient memory or file descriptors.

Based on this, embodiments of the present disclosure provide a file monitoring method. The method includes setting operating parameters of a functional module in the kernel state for implementing a file system notification mechanism, where the operating parameters include a processing function for responding to file events; by calling a monitoring interface function of the functional module, monitoring whether the file system is scheduled Responded to an external operation within a period; in response to monitoring that the file system responded to an external operation within a predetermined period, based on the file event triggered by the file system's response to the external operation, the processing function was called to obtain the files in the file system that responded to the external operation. The information of the file in response to the external operation includes the path of the file and the type of the file event; and the information of the file in response to the external operation is sent to the user-mode application, so that the application can process the file in response to the external operation. deal with.

FIG. 1 schematically illustrates an exemplary system architecture 100 to which the file monitoring method and device of embodiments of the present disclosure can be applied. It should be noted that Figure 1 is only an example of a system architecture to which embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but does not mean that the embodiments of the present disclosure cannot be used in other applications. Device, system, environment or scenario.

As shown in Figure 1, the system architecture 100 according to this embodiment may include a monitoring module 101, a processing module 102 and an application program 103. Among them, the monitoring module 101 and the processing module 102 can run as functional modules in the kernel mode of the operating system, and the application program 103 can run as functional modules in the user mode of the operating system.

The kernel of the Linux operating system provides a file system notification mechanism (file system notify, fsnotify for short). The monitoring module 101 may be a functional module used to implement the file system notification mechanism.

The processing module 102 can be a functional module for calling the interface function of the monitoring module to implement file system monitoring. The processing module 102 can also communicate with the application program 103 in the kernel mode and the user mode. For example, the processing module 102 can monitor The result is notified to the application 103.

The application program 103 may be software that needs to be aware of the file system to respond to external operations. For example, the application program 103 may be anti-virus software that needs to be aware of file creation, writing, closing, renaming, etc. of the entire file system.

Figure 2 schematically shows a flow chart of a file monitoring method according to an embodiment of the present disclosure.

As shown in Figure 2, the method includes operations S201 to S204.

In operation S201, operating parameters of the functional module used to implement the file system notification mechanism in the kernel state are set, where the operating parameters include a processing function used to respond to the file event.

According to the embodiment of the present disclosure, operating parameters for implementing the file system notification mechanism may be preset in the processing module 102, so that the interface functions of the monitoring module 101 can be called using the operating parameters. The running parameter may be, for example, a structure, and the structure may include a processing function for processing file events. Among them, the file event can be the time when the file system is triggered in response to an external operation. For example, the file system triggers the corresponding file open event, file write event, etc. in response to the external operation such as file opening, writing, renaming, etc. File rename events, etc.

According to an embodiment of the present disclosure, the processing module 102 may call the processing function when a file event is triggered to process the corresponding file event. Various file events can also be filtered. For example, file deletion events do not need to be processed, and file events triggered by file deletion can be filtered. The processing result of the file event can also be notified to the user-mode application, for example, information such as the path of the file corresponding to the file event is sent to the application so that the application can process the file.

In operation S202, by calling the monitoring interface function of the function module, it is monitored whether the file system responds to the external operation within a predetermined period of time.

According to the embodiment of the present disclosure, the processing module 102 can call the monitoring interface function of the monitoring module 101 to implement monitoring of the file system during the running process of the monitoring interface function. For example, you can monitor whether files in the file system are opened, written, closed, etc.

According to an embodiment of the present disclosure, the monitoring interface function may include a first parameter and a second parameter, and the first parameter may be used to identify the first directory corresponding to the first parameter and all files in subdirectories at all levels under the first directory, The second parameter may be used to identify a file in the second directory corresponding to the second parameter.

After calling the monitoring interface function in operation S202, the embodiment of the present disclosure also includes:

Set the first parameter to the root directory of the file system, and set the second parameter to empty, so that during the process of calling the monitoring interface function, it can monitor whether all files in the subdirectories at all levels under the root directory of the file system have responded. External operations.

According to an embodiment of the present disclosure, the monitoring interface function may include a first parameter and a second parameter, wherein the first parameter may be an mnt parameter, the second parameter may be an inode parameter, and the mnt parameter may be specified as a mount point of the file system, The inode parameter can be specified as the corresponding file or directory.

According to the embodiment of the present disclosure, the mount point of the file system may be a directory corresponding to each partition of the operating system. Specifically, the operating system may include multiple partitions, such as C drive, D, etc., and each partition will be mapped to a directory. This directory can be, for example, the root directory, and the root directory corresponding to each partition is the "mount point" of the partition. The operating system can include multiple partitions. Correspondingly, the operating system can have multiple mount points. Each partition of the operating system can be an independent file system.

According to the embodiment of the present disclosure, inode is a data structure in the Linux operating system. Its essence is a structure, which contains some important information related to each file in the file system. When creating a file system in Linux, a large number of inodes will be created at the same time. Each file has a corresponding inode, which contains some information related to the file.

According to the embodiment of the present disclosure, the mnt parameter can be specified as the root directory, and the inode parameter can be specified as empty, so that in the process of calling the monitoring interface function, all files in subdirectories at all levels under the root directory can be monitored. Compared with the inotify or dnotify solution, which can only monitor specified directories or files, the embodiments of the present disclosure can realize the monitoring of all files, without the need to scan the entire file system to specify monitoring directories and files one by one, and have little impact on the system load.

According to the embodiment of the present disclosure, when there are multiple different mount points in the operating system, and the mount points are all in the root directory, all mount points need to call the above processing function to process the mnt parameter and inode Parameter settings.

In operation S203, in response to monitoring that the file system responds to an external operation within a predetermined period, a processing function is called according to a file event triggered by the file system's response to the external operation to obtain information about files in the file system that respond to the external operation, Among them, the information of the file responding to the external operation includes the path of the file and the type of the file event.

According to the embodiment of the present disclosure, when the monitoring module 101 monitors that a file in the file system has been opened, written, closed, etc., a corresponding file event will be triggered. In response to the file event, the processing module 102 may call a preset processing function, and this process may be called a callback of the processing function. In the process of calling back the processing function, the file event can be processed, and the path and file event type of the file where operations such as opening, writing, closing, etc. occur can be obtained.

According to embodiments of the present disclosure, the file event type may include at least one of the following: file creation, file opening, file writing, file closing, file deletion, and file renaming.

For example, the file event type of a file where an open operation occurs may be file open, the type of file event of a file where a create operation occurs may be file creation, and the type of file event of a file where a write operation occurs may be file write. The type of the file event of the file in which the closing operation occurs may be file closing, the type of the file event of the file in which the deletion operation occurs may be file deletion, and the type of the file event of the file in which the renaming operation occurs may be file renaming.

In operation S204, information about the file that responds to the external operation is sent to the user-mode application program, so that the application program processes the file that responds to the external operation.

According to the embodiment of the present disclosure, the path and file event type of the file where the operation occurs can be sent to the user-mode application 103, so that the application 103 processes the file where the operation occurs. For example, the application 103 performs processing on the file. Check and kill etc.

According to the embodiment of the present disclosure, the interface function of the functional module for implementing the file system notification mechanism is called in the kernel mode to monitor whether files in the file system are opened, closed, etc., and trigger file events when these operations occur. In response to the file event, call the file event processing function preset in the kernel mode to obtain the path and file event type of the file where the operation occurred, and notify the file path and event type to the user-mode application so that the application can perform operations on the file where the operation occurred. deal with. It can achieve precise monitoring of the file system in the kernel mode without specifying monitoring directories and files one by one, and has little impact on the system load.

According to the embodiment of the present disclosure, the execution subject of the embodiment of the present disclosure may be the processing module 102. The processing module 102 can be directly integrated with the operating system kernel, and uses the file system notification mechanism provided in the kernel to flexibly and efficiently implement notifications for file creation, closing, writing, deletion and other operations.

Figure 3 schematically shows a flow chart of a method for a processing module to register with a monitoring module.

As shown in Figure 3, the method may include operations S301 to S303.

In operation S301, the registration interface function of the function module is called.

According to the embodiment of the present disclosure, before calling the monitoring interface function of the monitoring module 101, the processing module 102 may call the registration interface function of the monitoring module 101 to register.

In operation S302, register with the function module according to the operating parameters.

According to the embodiment of the present disclosure, the operating parameters preset in the processing module 102 for implementing the file system notification mechanism can be passed into the registration interface function to realize the registration of the processing module 102 with the monitoring module 101 .

In operation S303, after successful registration, the monitoring interface function of the functional module is called.

According to the embodiment of the present disclosure, after the processing module 102 successfully registers with the monitoring module 101, it can call the monitoring interface function of the monitoring module 101.

According to an embodiment of the present disclosure, operation S204 may include: sending the information of the file on which the operation occurs to a communication port number pre-agreed with the application program, so that the application program obtains the information of the file in response to the external operation by monitoring the communication port number.

According to the embodiment of the present disclosure, the processing module 102 can also communicate with the application program 103 in the kernel state and the user state, for example, through a predetermined communication port number, where the communication port number can be, for example, a netlink port number.

According to the embodiment of the present disclosure, the processing module 102 can send the path and file event type of the file where the operation occurs to a predetermined communication port number, and the user-mode application 103 can obtain the operation occurrence by monitoring the predetermined communication port number. The path of the file and the file event type, so that the application 103 can perceive file creation, file closing, file renaming and other operations in the file system.

FIG. 4 schematically shows a block diagram of a file monitoring device according to an embodiment of the present disclosure.

As shown in FIG. 4 , the file monitoring device 400 includes a first setting module 410 , a monitoring module 420 , a processing module 430 and a sending module 440 .

The first setting module 410 is used to set the operating parameters of the functional module used to implement the file system notification mechanism in the kernel state, where the operating parameters include a processing function for responding to file events.

The monitoring module 420 is used to monitor whether the file system responds to external operations within a predetermined period of time by calling the monitoring interface function of the function module.

The processing module 430 is configured to, in response to monitoring that the file system responds to an external operation within a predetermined period of time, call a processing function according to a file event triggered by the file system's response to the external operation, to obtain the file information of the file in the file system that responds to the external operation. Information, wherein the information about the file in response to the external operation includes the path of the file and the type of file event; and

The sending module 440 is used to send the information of the file in response to the external operation to the user-mode application program, so that the application program processes the file in response to the external operation.

According to an embodiment of the present disclosure, the monitoring interface function includes a first parameter and a second parameter. The first parameter is used to identify the first directory corresponding to the first parameter and all files in subdirectories at all levels under the first directory. The second parameter The parameter is used to identify the file in the second directory corresponding to the second parameter.

According to an embodiment of the present disclosure, the file monitoring device 400 further includes: a second setting module.

The second setting module is used to set the first parameter to the root directory of the file system after calling the monitoring interface function, and set the second parameter to empty, so that the root directory of the file system is monitored during the process of calling the monitoring interface function. Whether all files in subdirectories at all levels under the directory respond to external operations.

According to an embodiment of the present disclosure, the monitoring module 420 includes: a first calling unit and a registration unit.

The first calling unit calls the registration interface function of the function module.

The registration unit is used to register with the function module according to the operating parameters.

According to an embodiment of the present disclosure, the sending module 440 is specifically configured to send information about files that respond to external operations to user-mode applications, so that the applications process the files that respond to external operations.

Any number of modules, sub-modules, units, sub-units according to embodiments of the present disclosure, or at least part of the functions of any number of them, may be implemented in one module. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure may be split into multiple modules for implementation. Any one or more of the modules, sub-modules, units, and sub-units according to embodiments of the present disclosure may be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLA), System-on-a-chip, system-on-substrate, system-on-package, application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuits that can be implemented in hardware or firmware, or in a combination of software, hardware, and firmware Any one of these implementation methods or an appropriate combination of any of them. Alternatively, one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure may be at least partially implemented as a computer program module, and when the computer program module is executed, corresponding functions may be performed.

For example, any one of the first setting module 410, the monitoring module 420, the processing module 430 and the sending module 440 can be combined and implemented in one module/unit/sub-unit, or any one of the modules/units/sub-units can be implemented by Split into multiple modules/units/sub-units. Alternatively, at least part of the functionality of one or more of these modules/units/subunits may be combined with at least part of the functionality of other modules/units/subunits and combined in one module/unit/subunit realized in. According to an embodiment of the present disclosure, at least one of the first setting module 410, the monitoring module 420, the processing module 430 and the sending module 440 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable A logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuits that can be implemented in hardware or firmware, or in It can be implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the first setting module 410, the monitoring module 420, the processing module 430 and the sending module 440 may be at least partially implemented as a computer program module, and when the computer program module is executed, corresponding functions may be performed.

It should be noted that the file monitoring device part in the embodiment of the present disclosure corresponds to the file monitoring method part in the embodiment of the present disclosure. For the description of the file monitoring device part, please refer to the file monitoring method part and will not be described again here.

Figure 5 schematically illustrates a block diagram of a computer system suitable for implementing the method described above, according to an embodiment of the present disclosure. The computer system shown in FIG. 5 is only an example and should not impose any limitations on the functions and scope of use of the embodiments of the present disclosure.

As shown in FIG. 5 , a computer system 500 according to an embodiment of the present disclosure includes a processor 501 that can be loaded into a random access memory (RAM) 503 according to a program stored in a read-only memory (ROM) 502 or from a storage portion 508 program to perform various appropriate actions and processes. Processor 501 may include, for example, a general-purpose microprocessor (eg, a CPU), an instruction set processor and/or associated chipset, and/or a special-purpose microprocessor (eg, an application specific integrated circuit (ASIC)), among others. Processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiments of the present disclosure.

In the RAM 503, various programs and data required for the operation of the system 500 are stored. The processor 501, ROM 502, and RAM 503 are connected to each other through a bus 504. The processor 501 performs various operations according to the method flow of the embodiment of the present disclosure by executing programs in the ROM 502 and/or RAM 503. It should be noted that the program may also be stored in one or more memories other than ROM 502 and RAM 503. The processor 501 may also perform various operations according to the method flow of embodiments of the present disclosure by executing programs stored in the one or more memories.

According to embodiments of the present disclosure, system 500 may also include an input/output (I/O) interface 505 that is also connected to bus 504 . System 500 may also include one or more of the following components connected to I/O interface 505: an input portion 506 including a keyboard, mouse, etc.; including a cathode ray tube (CRT), liquid crystal display (LCD), etc.; and a speaker. an output section 507, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. Driver 510 is also connected to I/O interface 505 as needed. Removable media 511, such as magnetic disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

According to embodiments of the present disclosure, the method flow according to the embodiments of the present disclosure may be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product including a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the method illustrated in the flowchart. In such embodiments, the computer program may be downloaded and installed from the network via communication portion 509 and/or installed from removable media 511 . When the computer program is executed by the processor 501, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to embodiments of the present disclosure, the systems, devices, devices, modules, units, etc. described above may be implemented by computer program modules.

The present disclosure also provides a computer-readable storage medium. The computer-readable storage medium may be included in the device/device/system described in the above embodiments; it may also exist independently without being assembled into the device/system. in the device/system. The above computer-readable storage medium carries one or more programs. When the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. Examples may include but are not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In this disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device.

For example, according to embodiments of the present disclosure, the computer-readable storage medium may include the ROM 502 and/or RAM 503 and/or one or more memories other than the ROM 502 and RAM 503 described above.

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more logic functions that implement the specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown one after another may actually execute substantially in parallel, or they may sometimes execute in the reverse order, depending on the functionality involved. It will also be noted that each block in the block diagram or flowchart illustration, and combinations of blocks in the block diagram or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or may be implemented by special purpose hardware-based systems that perform the specified functions or operations. Achieved by a combination of specialized hardware and computer instructions. Those skilled in the art will understand that the features recited in the various embodiments and/or claims of the present disclosure may be combined and/or combined in various ways, even if such combinations or combinations are not explicitly recited in the present disclosure. In particular, various combinations and/or combinations of features recited in the various embodiments and/or claims of the disclosure may be made without departing from the spirit and teachings of the disclosure. All such combinations and/or combinations fall within the scope of this disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment is described separately above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims (7)

1. A file monitoring method, including: Set the operating parameters of the functional module used to implement the file system notification mechanism in the kernel state, where the operating parameters include a processing function used to respond to file events; By calling the monitoring interface function of the functional module, monitor whether the file system responds to external operations within a predetermined period; In response to monitoring that the file system responds to an external operation within a predetermined period, the processing function is called according to a file event triggered by the file system's response to the external operation to obtain the file information of the file in the file system that responds to the external operation. Information, wherein the information about the file in response to the external operation includes the path of the file and the type of the file event; and Send the information of the file that responds to the external operation to the user-mode application program, so that the application program processes the file that responds to the external operation; Wherein, the monitoring interface function includes a first parameter and a second parameter. The first parameter is used to identify the first directory corresponding to the first parameter and all the subdirectories at all levels under the first directory. file, the second parameter is used to identify the file in the second directory corresponding to the second parameter; After calling the monitoring interface function, it also includes: The first parameter is set to the root directory of the file system, and the second parameter is set to empty, so that in the process of calling the monitoring interface function, all levels of sub-directories under the root directory of the file system are monitored. Whether all files in the directory respond to external operations. 2. The method according to claim 1, further comprising, before calling the monitoring interface function of the functional module: Call the registration interface function of the functional module; Register with the functional module according to the operating parameters; and After successful registration, the monitoring interface function of the functional module is called. 3. The method according to claim 1, wherein said sending the information of the file in response to an external operation to a user-mode application includes: The information of the file on which the operation occurs is sent to a communication port number pre-agreed with the application program, so that the application program obtains the information of the file in response to the external operation by monitoring the communication port number. 4. The method according to claim 1, wherein the type of the file event includes at least one of the following: File creation, file opening, file writing, file closing, file deletion and file renaming. 5. A file monitoring device, including: The first setting module is used to set the operating parameters of the functional module used to implement the file system notification mechanism in the kernel state, where the operating parameters include a processing function for responding to file events; A monitoring module, configured to monitor whether the file system responds to external operations within a predetermined period of time by calling the monitoring interface function of the functional module; A processing module configured to, in response to monitoring that the file system responds to an external operation within a predetermined period of time, call the processing function according to a file event triggered by the file system's response to the external operation to obtain a response in the file system Information about files operated externally, wherein the information about files responding to external operations includes the path of the file and the type of the file event; and A sending module, configured to send the information of the file responding to the external operation to the user-mode application program, so that the application program processes the file responding to the external operation; Wherein, the monitoring interface function includes a first parameter and a second parameter. The first parameter is used to identify the first directory corresponding to the first parameter and all the subdirectories at all levels under the first directory. file, the second parameter is used to identify the file in the second directory corresponding to the second parameter; The device also includes: A second setting module, configured to set the first parameter to the root directory of the file system after calling the monitoring interface function, and set the second parameter to empty, so that after calling the monitoring interface function During the process, it is monitored whether all files in subdirectories at all levels under the root directory of the file system respond to external operations. 6. A computer system comprising: one or more processors; memory for storing one or more programs, Wherein, when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method described in any one of claims 1 to 4. 7. A computer-readable storage medium having executable instructions stored thereon, which when executed by a processor causes the processor to implement the method according to any one of claims 1 to 4.