CN115328736A

CN115328736A - Probe deployment method, device, equipment and storage medium

Info

Publication number: CN115328736A
Application number: CN202211017013.0A
Authority: CN
Inventors: 程捷
Original assignee: Beijing Bo Hongyuan Data Polytron Technologies Inc
Current assignee: Beijing Bo Hongyuan Data Polytron Technologies Inc
Priority date: 2022-08-22
Filing date: 2022-08-22
Publication date: 2022-11-11

Abstract

The invention discloses a probe deployment method, a device, equipment and a storage medium, wherein the method comprises the following steps: when the application program is monitored to be started, reading and analyzing a monitoring rule character string from a local file to obtain a monitoring rule list; traversing regular expressions in the monitoring rule list, and determining a target expression matched with the application program from the regular expressions; wherein the regular expression comprises: monitoring attributes, feature names, operational characters and expression key values; and performing probe deployment on the application program according to the target expression. By the method, the labor cost for deploying the probe for the application program is saved, and the probe deployment efficiency and the probe deployment precision are improved.

Description

Probe deployment method, device, equipment and storage medium

Technical Field

The embodiment of the invention relates to the field of computers, in particular to a probe deployment method, a probe deployment device, probe deployment equipment and a storage medium.

Background

The probe technology can realize the detection of script files of the sensitive information of the server and the purpose of monitoring the application program on the server. At present, when probes are configured for application programs, workers need to deploy the probes for different application programs according to configuration files, and the probe deployment efficiency is low. When a worker faces a large number of server clusters, a large number of repeated operations are performed, and probe deployment errors are easy to occur. Therefore, how to improve the efficiency and accuracy of probe deployment is a problem to be solved.

Disclosure of Invention

The invention provides a probe deployment method, a probe deployment device, equipment and a storage medium, which save the labor cost for deploying a probe for an application program and improve the probe deployment efficiency and the probe deployment precision.

According to an aspect of the present invention, there is provided a probe deployment method comprising:

when the application program is monitored to be started, reading and analyzing a monitoring rule character string from a local file to obtain a monitoring rule list;

traversing regular expressions in the monitoring rule list, and determining a target expression matched with the application program from the regular expressions; wherein the regular expression comprises: monitoring attributes, feature names, operational characters and expression key values;

and performing probe deployment on the application program according to the target expression.

According to another aspect of the present invention, there is provided a probe deployment device, the device comprising:

the monitoring rule list acquisition module is used for reading and analyzing a monitoring rule character string from a local file when the application program is monitored to be started to obtain a monitoring rule list;

the target expression acquisition module is used for traversing the regular expressions in the monitoring rule list and determining a target expression matched with the application program from the regular expressions; wherein the regular expression comprises: monitoring attributes, feature names, operational characters and expression key values;

and the probe deployment module is used for carrying out probe deployment on the application program according to the target expression.

According to another aspect of the present invention, there is provided an electronic apparatus including:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the probe deployment method of any of the embodiments of the invention.

According to another aspect of the present invention, there is provided a computer readable storage medium having stored thereon computer instructions for causing a processor to execute a method of probe deployment according to any one of the embodiments of the present invention.

According to the technical scheme of the embodiment of the invention, when the application program is monitored to be started, the monitoring rule character string is read and analyzed from the local file, and a monitoring rule list is obtained; traversing regular expressions in the monitoring rule list, and determining a target expression matched with the application program from the regular expressions; wherein the regular expression comprises: monitoring attributes, feature names, operational characters and expression key values; and performing probe deployment on the application program according to the target expression. By the scheme, the problems that when the probe is deployed for the application program in a mode that a worker modifies the configuration file, deployment efficiency is low and probe deployment errors are easy to occur are solved. The method and the device have the advantages that the probe deployment mode of the application program is determined by monitoring the rule expression in the rule list, labor cost for deploying the probe for the application program is saved, and probe deployment efficiency and probe deployment precision are improved.

It should be understood that the statements in this section are not intended to identify key or critical features of the embodiments of the present invention, nor are they intended to limit the scope of the invention. Other features of the present invention will become apparent from the following description.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a flowchart of a probe deployment method according to an embodiment of the present invention;

fig. 2 is a flowchart of a probe deployment method according to a second embodiment of the present invention;

fig. 3 is a schematic structural diagram of a probe deployment apparatus according to a third embodiment of the present invention;

fig. 4 is a schematic structural diagram of an electronic device according to a fourth embodiment of the present invention.

Detailed Description

In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It should be noted that the terms "candidate" and "target" and the like in the description and claims of the present invention and the above drawings are used for distinguishing similar objects and are not necessarily used for describing a particular order or sequence. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Example one

Fig. 1 is a flowchart of a probe deployment method according to an embodiment of the present invention, which is applicable to a situation of probe deployment for an application. The method may be performed by a probe deployment apparatus, which may be implemented in hardware and/or software, which may be configured in an electronic device, such as a probe deployment system of the electronic device. The probe deployment system includes: the system comprises a monitoring rule synchronization module, a driving module and an identification module.

As shown in fig. 1, the method includes:

and S110, when the application program is monitored to be started, reading and analyzing the monitoring rule character string from the local file to obtain a monitoring rule list.

The application program can be any process started on the device monitored by the probe deployment system. The local file refers to a file used for storing the monitoring rule character string in a local storage space of the probe deployment system. A monitoring rule string is a string that can be used to characterize a monitoring rule. The monitoring rule list is a list for recording regular expressions, which are expressions for characterizing monitoring rule information.

Specifically, the monitoring rule synchronization module requests the back-end server to acquire monitoring rule information corresponding to each application program stored in the back-end server, converts the acquired monitoring rule information into a monitoring rule character string according to a specified data conversion format, and stores the monitoring rule character string in a local file.

When it is monitored that the device starts the application program, an identification module is loaded for the application program, the monitoring rule character string in the local file is read through the identification module, the monitoring rule character string is analyzed, a monitoring rule expression and monitoring rule information are obtained, and the monitoring rule expression and the monitoring rule information are correspondingly stored in a monitoring rule list. The monitoring rule list is shown in table 1:

TABLE 1

For example, the loading method of the identification module may be: creating a message according to the process by a driving module to add a mark to the application program; loading a kernel dynamic library to the application program added with the mark through a kernel module, generating a kernel dynamic library loading completion message, and sending the kernel dynamic library loading completion message to a drive module; adding the code segment of the loading identification module into a specified kernel function when the driver module determines that the kernel dynamic library loading completion message is received; and calling a specified kernel function through the kernel module to load the identification module for the application program.

And S120, traversing the regular expressions in the monitoring rule list, and determining a target expression matched with the application program from the regular expressions.

Wherein the regular expression comprises: monitoring attributes, feature names, operators and expression key values. Monitoring attributes refer to data that can characterize whether an application is monitored. The feature name refers to the name of the application program corresponding to the regular expression. The expression key value refers to the value of the monitoring rule character string corresponding to the rule expression. The operator refers to the expression key value specified in the regular expression and the data of the incidence relation required by the application program. The operators and their corresponding descriptions are shown in table 2.

TABLE 2

Specifically, metadata of the application is extracted, and the metadata refers to data for describing data attributes. And traversing the regular expressions in the monitoring rule list, and determining a target expression matched with the application program from the regular expressions according to the metadata of the application program, the monitoring attributes, the feature names, the operational characters and the expression key values of the regular expressions.

And S130, deploying the probe for the application program according to the target expression.

Wherein the probe deployment for the application comprises: probe insertion and probe non-insertion in the application.

Specifically, according to the target expression, a program monitoring rule of the application program specified in the target expression is determined. If the program monitoring rule is to monitor the application program, inserting a probe into the application program; and if the program monitoring rule is that the application program is not monitored, not inserting a probe into the application program.

For example, probe deployment may be performed on an application according to the monitored attributes of the target expression. Specifically, the method can be realized by the following substeps:

s1301, determining whether to monitor the application program according to the monitoring attribute of the target expression.

Specifically, the corresponding relationship between the monitoring attribute of the target expression and the program monitoring rule is preset, and whether the application program is monitored or not is determined according to the monitoring attribute of the target expression and the corresponding relationship between the monitoring attribute and the program monitoring rule.

For example, if the monitoring attribute of the target expression is ENABLE, determining to monitor the application program; and if the monitoring attribute of the target expression is DISABLE, determining not to monitor the application program.

Specifically, the monitoring attribute of the target expression comprises ENABLE and DISABLE, and if the monitoring attribute of the target expression is ENABLE, the program monitoring rule is to monitor the application program; and if the monitoring attribute of the target expression is DISABLE, the program monitoring rule is that the application program is not monitored.

And S1302, if so, inserting the probe into the application program when the probe is deployed to the application program.

Correspondingly, if the application program is determined not to be monitored according to the monitoring attribute of the target expression, the probe is not inserted into the application program when the probe deployment is carried out on the application program.

It can be understood that, according to the monitoring attribute of the target expression, whether the application program is monitored or not is determined, and when the application program needs to be monitored, a probe is inserted into the application program. The technical effect of automatically deploying the probe for the application program can be achieved, and the probe deployment efficiency is improved.

According to the technical scheme provided by the embodiment, when the starting of the application program is monitored, the monitoring rule character string is read and analyzed from the local file, and a monitoring rule list is obtained; traversing regular expressions in the monitoring rule list, and determining a target expression matched with the application program from the regular expressions; wherein the regular expression comprises: monitoring attributes, feature names, operational characters and expression key values; and performing probe deployment on the application program according to the target expression. By the scheme, the problems that when the probe is deployed for the application program in a mode of modifying the configuration file by a worker, the deployment efficiency is low, and probe deployment errors are easy to occur are solved. The probe deployment mode of the application program is determined by monitoring the rule expression in the rule list, the labor cost for deploying the probe for the application program is saved, and the probe deployment efficiency and the probe deployment precision are improved.

For example, on the basis of the above embodiment, the updated update rule information in the back-end server may also be obtained at intervals of a time period; and updating the monitoring rule character string stored in the local file according to the updating rule information.

The time period refers to the interval time between two times of acquiring the updated update rule information in the back-end server by the probe deployment system. The update rule information refers to monitoring rule information updated by the back-end server, and the back-end server can update the monitoring rule information of the application program in real time according to the actual situation of the application program.

Specifically, a time period is set according to actual requirements, and the probe deployment system acquires update rule information updated by the back-end server in the time period from the back-end server every other time period. And converting the updating rule information into an updating rule character string according to a specified data conversion format, and storing the updating rule character string in a local file so as to update the monitoring rule character string stored in the local file. The update rule string refers to a string that can be used to characterize update rule information.

The probe deployment system updates the monitoring rule character string stored in the local file according to the updated updating rule information in the back-end server every other time period, can realize synchronous updating of the monitoring rule character string in the local file and the monitoring information in the back-end server, and ensures the integrity of the monitoring rule character string in the local file.

Example two

Fig. 2 is a flowchart of a probe deployment method provided in the second embodiment of the present invention, and this embodiment performs optimization based on the above embodiments, and provides a preferred implementation of traversing the regular expressions in the monitoring rule list and determining the target expression matched with the application program from the regular expressions. Specifically, as shown in fig. 2, the method includes:

s210, when the application program is monitored to be started, reading and analyzing the monitoring rule character string from the local file to obtain a monitoring rule list.

S220, determining the data characteristics of the application program, and determining the metadata of the application program according to the data characteristics.

Wherein, the data characteristics of the application program comprise: the feature name and feature value of the application. The feature value refers to a value of a corresponding feature of the application. The corresponding meanings of the feature names and feature values of the application are shown in table 3:

TABLE 3

Specifically, the data characteristics of the application program are determined according to a starting command line of the application program, the name of the application program, the content of the configuration file and the executable file, the data characteristics of the application program are arranged into a characteristic list, and the characteristic list is used as metadata of the application program.

And S230, traversing the rule expressions in the monitoring rule list, determining the rule expressions matched with the data characteristics according to the data characteristics, the characteristic names, the operational characters and the expression key values of the rule expressions, and taking the rule expressions matched with the data characteristics as target expressions matched with the application programs.

Specifically, the regular expressions in the monitoring rule list are traversed, the feature names and expression key values of the data features and the regular expressions are matched based on the operational characters of the regular expressions, the regular expressions matched with the data features are determined, and the regular expressions matched with the data features are used as target expressions matched with the application programs.

For example, the target expression matched with the application program may be determined from the regular expression according to the regular expression in the monitoring rule list, the application name and the program key value of the application program in the data feature. Specifically, the method can be realized by the following substeps:

s2301, determining the application name and the program key value of the application program according to the data characteristics.

Specifically, the data characteristics include an application name and a program key value of the application program, so that the application name and the program key value of the application program can be determined directly according to the data characteristics.

S2302, traversing the regular expressions in the monitoring rule list, matching the application names with the feature names in the regular expressions, determining target names consistent with the application names from the feature names, and determining the regular expressions corresponding to the target names as candidate expressions.

The target name refers to a feature name consistent with the application name in the regular expression.

Specifically, the regular expressions in the monitoring rule list are traversed, feature names in the regular expressions are determined, the application names are matched with the feature names in the regular expressions, target names are selected from the feature names, and the regular expressions corresponding to the target names are used as candidate expressions.

S2303, determining whether the data characteristics are matched with the candidate expressions or not according to the program key values of the application programs, the operational characters in the candidate expressions and the expression key values.

For example, the method for determining whether the data feature matches the candidate expression may be: and determining whether the incidence relation between the program key value and the expression key value accords with the definition of the operational character, and if so, determining that the data characteristic is successfully matched with the candidate expression.

Specifically, whether the incidence relation between the program key value of the application program and the expression key value of the candidate expression accords with the definition of an operational character in the candidate expression is determined, and if yes, the data characteristic is determined to be matched with the candidate expression; if not, determining that the data features are not matched with the candidate expressions.

For example, traversing the rule expressions in the monitoring rule list, and if the candidate expression is DISABLE, EXE _ NAME, EQUALS, php-cgi, wherein EXE _ NAME is the target NAME, and php-cgi is the expression key value of the candidate expression. EQUALS is an operator in the candidate expression, indicating "equal". Matching the characteristic NAME of the application program with the characteristic value of EXE _ NAME and the expression key value of the candidate expression, and matching the data characteristic with the candidate expression if the corresponding characteristic value of the application program is equal to php-cgi; if the corresponding feature value of the application is not equal to php-cgi, the data feature does not match the candidate expression.

And S2304, if so, taking the candidate expression as a target expression matched with the application program.

Specifically, if the data features are matched with the candidate expression, the candidate expression is used as a target expression matched with the application program.

According to the scheme, the candidate expression is determined from the regular expression according to the application name in the data characteristic and the characteristic name in the regular expression, and whether the candidate expression can be used as the target expression or not is determined according to the program key value of the application program, so that the accuracy of selecting the target expression is improved.

And S240, deploying the probe for the application program according to the target expression.

According to the technical scheme of the embodiment, when the application program is monitored to be started, the monitoring rule character string is read and analyzed from the local file, and a monitoring rule list is obtained; determining metadata of an application program, and extracting data characteristics of the metadata; traversing the regular expressions in the monitoring rule list, determining the regular expressions matched with the data characteristics according to the data characteristics, the characteristic names, the operational characters and the expression key values of the regular expressions, and taking the regular expressions matched with the data characteristics as target expressions matched with the application programs; and performing probe deployment on the application program according to the target expression. According to the scheme, the target expression is determined from the regular expression according to the data characteristics of the metadata of the application program and the matching result of the regular expression, the probe deployment is carried out on the application program according to the target expression, the probe deployment is automatically carried out on the application program according to the metadata of the application program and the regular expression in the monitoring rule list, the labor cost is saved, and meanwhile the accuracy of the probe deployment is further improved.

EXAMPLE III

Fig. 3 is a schematic structural diagram of a probe deployment apparatus according to a fourth embodiment of the present invention. The embodiment can be applied to the situation of probe deployment of the application program. As shown in fig. 3, the probe deployment device includes: a monitoring rule list acquisition module 310, a target expression acquisition module 320, and a probe deployment module 330.

The monitoring rule list obtaining module 310 is configured to, when it is monitored that the application program is started, read and analyze a monitoring rule character string from a local file to obtain a monitoring rule list;

a target expression obtaining module 320, configured to traverse the rule expressions in the monitoring rule list, and determine a target expression matching the application program from the rule expressions; wherein the regular expression comprises: monitoring attributes, feature names, operational characters and expression key values;

and the probe deployment module 330 is configured to perform probe deployment on the application according to the target expression.

Illustratively, the target expression obtaining module 320 includes:

the data characteristic extraction unit is used for determining metadata of the application program and extracting data characteristics of the metadata;

and the target expression determining unit is used for traversing the regular expressions in the monitoring rule list, determining the regular expressions matched with the data characteristics according to the data characteristics, the characteristic names, the operational characters and the expression key values of the regular expressions, and taking the regular expressions matched with the data characteristics as target expressions matched with the application programs.

Further, the target expression determining unit is specifically configured to:

determining an application name and a program key value of an application program according to the data characteristics;

traversing the regular expressions in the monitoring rule list, matching the application names with the feature names in the regular expressions, determining target names consistent with the application names from the feature names, and determining the regular expressions corresponding to the target names as candidate expressions;

determining whether the data characteristics are matched with the candidate expression according to a program key value of the application program, an operational character in the candidate expression and an expression key value;

and if so, taking the candidate expression as a target expression matched with the application program.

Determining whether the data characteristics are matched with the candidate expression according to a program key value of the application program, an operational character in the candidate expression and an expression key value, wherein the determining comprises the following steps:

and determining whether the incidence relation between the program key value and the expression key value accords with the definition of the operational character, and if so, determining that the data characteristic is successfully matched with the candidate expression.

Illustratively, the probe deployment module 330 includes:

the monitoring attribute acquisition unit is used for determining whether to monitor the application program according to the monitoring attribute of the target expression;

and the probe deployment unit is used for inserting the probe into the application program when the probe deployment is carried out on the application program if the application program is determined to be monitored.

Illustratively, the monitoring attribute obtaining unit is specifically configured to:

if the monitoring attribute of the target expression is ENABLE, determining to monitor the application program;

and if the monitoring attribute of the target expression is DISABLE, determining not to monitor the application program.

The probe deployment device provided by the embodiment can be applied to the probe deployment method provided by any embodiment, and has corresponding functions and beneficial effects.

Example four

FIG. 4 shows a schematic block diagram of an electronic device 10 that may be used to implement an embodiment of the invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.

As shown in fig. 4, the electronic device 10 includes at least one processor 11, and a memory communicatively connected to the at least one processor 11, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, and the like, wherein the memory stores a computer program executable by the at least one processor, and the processor 11 can perform various suitable actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from a storage unit 18 into the Random Access Memory (RAM) 13. In the RAM 13, various programs and data necessary for the operation of the electronic apparatus 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.

A number of components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, or the like; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.

The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, or the like. The processor 11 performs the various methods and processes described above, such as the probe deployment method.

In some embodiments, the probe deployment method may be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the probe deployment method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the probe deployment method by any other suitable means (e.g. by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), system on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, receiving data and instructions from, and transmitting data and instructions to, a storage system, at least one input device, and at least one output device.

A computer program for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be performed. A computer program can execute entirely on a machine, partly on a machine, as a stand-alone software package partly on a machine and partly on a remote machine or entirely on a remote machine or server.

In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which a user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic, speech, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the Internet.

The computing system may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical host and VPS service are overcome.

It should be understood that various forms of the flows shown above may be used, with steps reordered, added, or deleted. For example, the steps described in the present invention may be executed in parallel, sequentially, or in different orders, and are not limited herein as long as the desired results of the technical solution of the present invention can be achieved.

The above-described embodiments should not be construed as limiting the scope of the invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may be made in accordance with design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A probe deployment method, comprising:

2. The method of claim 1, wherein traversing the regular expressions in the monitoring rule list, and determining a target expression from the regular expressions that matches the application comprises:

determining data characteristics of the application program, and determining metadata of the application program according to the data characteristics;

and traversing the regular expressions in the monitoring rule list, determining the regular expressions matched with the data characteristics according to the data characteristics, the characteristic names, the operational characters and the expression key values of the regular expressions, and taking the regular expressions matched with the data characteristics as target expressions matched with the application programs.

3. The method of claim 2, wherein traversing the regular expressions in the monitoring rule list, determining the regular expression matching the data feature according to the data feature, the feature name of the regular expression, an operator and an expression key value, and using the regular expression matching the data feature as a target expression matching the application program comprises:

determining an application name and a program key value of the application program according to the data characteristics;

determining whether the data characteristics are matched with the candidate expression according to a program key value of the application program, an operational character and an expression key value in the candidate expression;

4. The method of claim 3, wherein determining whether the data feature matches the candidate expression based on a program key of the application, operators in the candidate expression, and an expression key comprises:

and determining whether the incidence relation between the program key value and the expression key value accords with the definition of the operational character, if so, determining that the data characteristic is successfully matched with the candidate expression.

5. The method of claim 1, wherein said probe deploying the application according to the target expression comprises:

determining whether to monitor the application program according to the monitoring attribute of the target expression;

and if so, inserting a probe into the application program when the probe deployment is carried out on the application program.

6. The method of claim 5, wherein determining whether to monitor the application according to the monitoring attribute of the target expression comprises:

7. The method of claim 1, further comprising:

acquiring updated updating rule information in a back-end server every other time period;

and updating the monitoring rule character string stored in the local file according to the updating rule information.

8. A probe deployment device, comprising:

9. An electronic device, characterized in that the electronic device comprises:

at least one processor; and

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the probe deployment method of any one of claims 1-7.

10. A computer readable storage medium having stored thereon computer instructions for causing a processor to execute a method of probe deployment according to any of claims 1-7.