CN117667604A

CN117667604A - Data monitoring method, device, electronic equipment and storage medium for tracking event

Info

Publication number: CN117667604A
Application number: CN202410134669.3A
Authority: CN
Inventors: 孙浩天; 彭向阳; 罗程; 李斌
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2024-01-31
Filing date: 2024-01-31
Publication date: 2024-03-08

Abstract

The embodiment of the application provides a data monitoring method, a device, electronic equipment and a storage medium for tracking events, and relates to the field of data processing. The method comprises the following steps: displaying a target interface, wherein the target interface comprises at least one selection frame and a first input frame; responding to a first selection frame selected from at least one selection frame and a target monitoring time period input by a first input frame, and taking a kernel event corresponding to the first selection frame as a first kernel event to be filtered; and acquiring event data of each tracking event in the target monitoring time period, deleting the event data of the first kernel event from the event data of each tracking event, and displaying the event data of each target tracking event acquired in the target monitoring time period. According to the embodiment of the application, the event data of the unnecessary tracking event is filtered according to the actual demand, the flexibility is high, the data size of the event data to be analyzed can be reduced, and the difficulty of data analysis is reduced.

Description

Data monitoring method, device, electronic equipment and storage medium for tracking event

Technical Field

The present application relates to the field of data processing technologies, and in particular, to a method and an apparatus for monitoring data of a tracking event, and an electronic device.

Background

Event tracking refers to tracking and recording event data generated by a tracked event (referred to as a tracked event), one event data including a data type, a data content, a data size, stack data, and the like.

When capturing event data in an operating system, the prior proposal is quite complicated and bloated in the captured event data and contains all tracking events of all running processes (or sub-processes and threads) and event data of all tracking events, which leads to huge data to be analyzed, increases the difficulty of data analysis and is difficult to quickly find abnormal data.

Disclosure of Invention

The embodiment of the application provides a data monitoring method, a device, electronic equipment, a computer readable storage medium and a computer program product for tracking events, which are used for solving the technical problems in the background technology.

According to a first aspect of embodiments of the present application, there is provided a data monitoring method for tracking an event, the method comprising:

displaying a target interface, wherein the target interface comprises at least one selection frame and a first input frame; each selection box corresponds to a kernel event; the first input box is used for inputting a monitoring time period;

Responding to a first selection frame selected from at least one selection frame and a target monitoring time period input by a first input frame, and taking a kernel event corresponding to the first selection frame as a first kernel event to be filtered;

acquiring event data of each tracking event in a target monitoring time period, wherein the type of the tracking event comprises kernel events, deleting the event data of a first kernel event from the event data of each tracking event, and acquiring the event data of the target tracking event; the target tracking event is other events except each first kernel event in various tracking events;

event data of each target tracking event obtained during the target monitoring period is presented.

According to a second aspect of embodiments of the present application, there is provided a data monitoring apparatus for tracking events, the apparatus comprising:

the first display module is used for displaying a target interface, and the target interface comprises at least one selection frame and a first input frame; each selection box corresponds to a kernel event; the first input box is used for inputting a monitoring time period;

the first response module is used for responding to a first selected frame in the at least one selected frame and a target monitoring time period input by the first input frame, and taking a kernel event corresponding to the first selected frame as a first kernel event to be filtered;

The deleting module is used for acquiring event data of each tracking event in the target monitoring time period, wherein the type of the tracking event comprises kernel events, and deleting the event data of the first kernel event from the event data of each tracking event to acquire the event data of the target tracking event; the target tracking event is other events except each first kernel event in various tracking events;

and the second display module is used for displaying the event data of each target tracking event obtained in the target monitoring time period.

In one possible implementation, the monitoring device further includes:

a first determining submodule for determining each reference resource allocation unit; the reference resource allocation units are other resource allocation units except the resource allocation unit to which the first kernel event belongs in the resource allocation units contained in the operating system;

the second determining submodule is used for determining the occupation result of each reference resource allocation unit on the CPU of the central processing unit at each moment of the target monitoring time period;

the target determining sub-module is used for regarding any one reference resource allocation unit, if the occupation result of the reference resource allocation unit on the CPU at the time of the continuous preset number is determined to be not in accordance with the preset condition, the reference resource allocation unit is used as a target resource allocation unit, and the starting time in the time of the continuous preset number is used as a target time;

The prompting sub-module is used for prompting the alarm information, and the alarm information is used for prompting the target resource allocation unit to start to abnormally occupy the CPU at the target moment.

In one possible implementation, the targeting submodule includes:

the setting unit is used for setting a plurality of time window sequences in a target monitoring time period, and the starting moments of two adjacent time window sequences are separated by a target duration; each time window sequence comprises a continuous preset number of moments;

the weight determining unit is used for determining the target weight of each reference resource allocation unit occupying the CPU in the time window sequence at the end time of each time window sequence, wherein the target weight represents the proportion of the reference resource allocation unit at the first time in a plurality of times contained in the time window sequence; the occupation result of the reference resource allocation unit at the first moment is a preset result; the preset result represents that the reference resource allocation unit occupies the CPU;

and the determining unit is used for determining that the occupation result of the reference resource allocation unit on the time window sequence does not accord with the preset condition for any one reference resource allocation unit and any time window sequence if the target weight of the reference resource allocation unit on the time window sequence is larger than the preset threshold value.

In one possible implementation manner, the weight determining unit is specifically configured to determine, for any one reference resource allocation unit, a number of first moments corresponding to the reference resource allocation unit from a preset number of moments included in the time window sequence; and determining the ratio between the number of the first moments and the total number of the plurality of moments in the time window sequence, and taking the ratio as the target weight of the reference resource allocation unit at the moments.

In one possible implementation manner, the second determining submodule is specifically configured to obtain a target snapshot at each moment in the target monitoring period; the target snapshot records each resource allocation unit occupying the CPU at the corresponding moment; and determining the occupation result of each reference resource allocation unit on the CPU at each moment from the target snapshot at each moment.

In one possible implementation manner, the deletion module is specifically configured to jointly declare a configuration object for each first kernel event, where the configuration object includes identification information of a resource allocation unit to which each first kernel event belongs and an event operation code of each first kernel event; acquiring event data of each tracking event from a pre-declared tracking event stream; the event data comprises identification information of a resource allocation unit to which the corresponding tracking event belongs and an event operation code of the tracking event; and for each event data, if the identification information and the event operation code in the event data are determined to be positioned in the configuration object, deleting the event data as the event data of the first kernel event.

In one possible implementation, the trace event further includes a custom event; the device also comprises a registration module, wherein the registration module is used for registering and tracking the custom event through the following submodules:

the second display sub-module is used for displaying a configuration interface, and the configuration interface comprises a second input frame;

the second response sub-module is used for responding to the input of the start mark, the end mark, the event name and the identification of the event provider of the custom event to the second input box to generate a target program of the custom event; the target program comprises a program of an event provider, a start mark, an end mark and an event name; the event provider is any one of a driver, a system component, and an application;

the acquisition sub-module is used for acquiring a loading program in the operating system, loading the program of the custom event to a preset monitoring process through the loading program so as to register and track the custom event, and acquiring event data of the custom event through the preset monitoring process in a target monitoring time period.

In one possible implementation, the monitoring device further includes:

the writing module is used for writing event data of the target tracking event into a preset performance file in the local disk.

In one possible implementation, the monitoring device further includes:

the analysis module is used for carrying out data analysis on the event data of each target tracking event and displaying the analysis result of the event data of each target tracking event in a map form; the analysis result includes the trend of the event data of the corresponding target trace event.

According to a third aspect of embodiments of the present application, there is provided an electronic device comprising a memory, a processor and a computer program stored on the memory, the processor implementing the steps of the method as provided in the first aspect when the program is executed.

According to a fourth aspect of embodiments of the present application, there is provided a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the method as provided by the first aspect.

According to a fifth aspect of embodiments of the present application, there is provided a computer program product comprising computer instructions stored in a computer readable storage medium, which when read from the computer readable storage medium by a processor of a computer device, the computer instructions are executed by the processor causing the computer device to perform the steps of the method as provided by the first aspect.

The beneficial effects that technical scheme that this application embodiment provided brought are:

the embodiment of the application provides the visual target interface for the target object to select the first kernel event needing to be filtered from a plurality of kernel events which can be tracked by the operating system, so that the first kernel event which does not need to be analyzed can be filtered by performing a small amount of screening, and the operation is simple and convenient; in addition, the embodiment of the application also supports the appointed event data for filtering some kernel events, so that the target object can filter the event data of unnecessary trace events according to actual demands, has higher flexibility, can reduce the data volume of the event data to be analyzed, and reduces the difficulty of data analysis.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings that are required to be used in the description of the embodiments of the present application will be briefly described below.

Fig. 1 is a schematic diagram of a system architecture of a data monitoring method for implementing a trace event according to an embodiment of the present application;

fig. 2 is a flow chart of a data monitoring method for tracking events according to an embodiment of the present application;

FIG. 3 is a schematic diagram of a kernel event included in an operating system according to an embodiment of the present application;

FIG. 4 is a schematic diagram of a target interface provided in an embodiment of the present application;

FIG. 5 is a schematic diagram of an ETW event tracking framework provided by an embodiment of the present application;

FIG. 6 is a schematic diagram of a configuration interface provided in an embodiment of the present application;

FIG. 7 is a flow chart of event data for capturing a target tracking event according to an embodiment of the present application;

FIG. 8 is a schematic diagram of a time window sequence provided in an embodiment of the present application;

FIG. 9 is a flowchart of determining a resource allocation unit of an abnormally occupied CPU according to an embodiment of the present application;

fig. 10 is a schematic structural diagram of an event data monitoring device for tracking events according to an embodiment of the present application;

fig. 11 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

Embodiments of the present application are described below with reference to the drawings in the present application. It should be understood that the embodiments described below with reference to the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application, and the technical solutions of the embodiments of the present application are not limited.

As used herein, the singular forms "a", "an", "the" and "the" are intended to include the plural forms as well, unless expressly stated otherwise, as understood by those skilled in the art. It will be further understood that the terms "comprises" and "comprising," when used in this application, specify the presence of stated features, information, data, steps, operations, elements, and/or components, but do not preclude the presence or addition of other features, information, data, steps, operations, elements, components, and/or groups thereof, all of which may be included in the present application. It will be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may be present. Further, "connected" or "coupled" as used herein may include wirelessly connected or wirelessly coupled. The term "and/or" as used herein indicates that at least one of the items defined by the term, e.g., "a and/or B" may be implemented as "a", or as "B", or as "a and B".

For the purpose of making the objects, technical solutions and advantages of the present application more apparent, the embodiments of the present application will be described in further detail below with reference to the accompanying drawings.

Several terms which are referred to in this application are first introduced and explained:

windows event tracking (Event Tracing for Windows, ETW) is a Windows-provided, native event tracking log system, event monitoring (Event Instrumentation) contains two basic entities, the Provider (ETW Provider) and Consumer (ETW Consumer) of an event, and the ETW framework can be considered as an intermediary between the Provider and Consumer. The ETW provider will pre-register with the ETW framework, the provider program will trigger events at some point in time and provide the standardized defined events to the ETW framework. Consumer also needs to register on the ETW framework, and can set event deletion conditions and receive callbacks for processing events at the time of registration.

". etl file": the performance map file generated by Windows Performance Recoder may view event data for kernel events for any resource scheduling entity (e.g., process, thread) during capture.

Windows performance loggers (Windows Performance Recorder, WPR) are Windows-provided event capture tools for capturing event data generated by events tracked by Windows systems. The Windows Performance Analyzer (Windows Performance Analyzer, WPA) is a Windows-provided performance analysis tool for analyzing event data captured by the WPR to achieve performance analysis. The use of WPR in combination with WPA allows the relevant personnel to have a full understanding of the system performance.

However, WPR captures event data that is very cumbersome and cumbersome, contains all trace events for all running processes (or sub-processes, threads) and event data (e.g., data type, data size, and stack data) for all trace events, and long-term performance monitoring can place a significant burden on the disk.

In addition, the event data of some processes has low starting value and high learning cost, increases the difficulty of data analysis, and is difficult to quickly find abnormal data.

The application provides a data monitoring method, a data monitoring device, an electronic device, a computer readable storage medium and a computer program product for tracking events, and aims to solve the technical problems in the prior art.

The technical solutions of the embodiments of the present application and technical effects produced by the technical solutions of the present application are described below by describing several exemplary embodiments. It should be noted that the following embodiments may be referred to, or combined with each other, and the description will not be repeated for the same terms, similar features, similar implementation steps, and the like in different embodiments.

Fig. 1 is a schematic diagram of a system architecture of a method for implementing data monitoring of a trace event according to an embodiment of the present application, and it can be understood that the method for monitoring data of a trace event according to an embodiment of the present application may be applicable to, but not limited to, an application scenario as shown in fig. 1.

As shown in fig. 1, the system architecture diagram may include, but is not limited to, a terminal 110, a server 120, and a network 130, wherein the terminal 110 and the server 120 interact through the network 130.

In one scenario, the terminal 110 presents a target interface comprising at least one selection box and one first input box; each selection box corresponds to a kernel event; the first input box is used for inputting a monitoring time period;

responding to a first selection frame selected from at least one selection frame and a target monitoring time period input by a first input frame, taking a kernel event corresponding to the first selection frame as a first kernel event to be filtered, and sending an acquisition request to a server, wherein the acquisition request comprises the name of the first kernel event and is used for acquiring identification information of a resource scheduling unit to which the first kernel event belongs and an event operation code of the first kernel event.

The server 120 transmits identification information of a resource scheduling unit to which the first kernel event belongs and an event operation code of the first kernel event to the terminal.

The terminal 110 acquires the event data of each tracking event in the target monitoring time period, deletes the event data of the first kernel event from the event data of each tracking event according to the event operation code of the first kernel event, and acquires the event data of the target tracking event; the target tracking event is other events except each first kernel event in various tracking events; event data of each target tracking event obtained in the target monitoring time period is displayed.

The terminal 110 includes, but is not limited to, a smart phone (such as an Android phone, an iOS phone, etc.), a phone simulator, a tablet computer, a notebook computer, a digital broadcast receiver, a MID (mobile internet devices), a PDA (personal digital assistant), an intelligent voice interaction device, an intelligent home appliance, a vehicle-mounted terminal, etc.

The server 120 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server or a server cluster providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (content delivery network), basic cloud computing services such as big data and an artificial intelligence platform.

The network 130 may include, but is not limited to: a wired network, a wireless network, wherein the wired network comprises: local area networks, metropolitan area networks, and wide area networks, the wireless network comprising: bluetooth, wi-Fi, and other networks implementing wireless communications. And in particular, the method can be determined based on actual application scene requirements, and is not limited herein.

An embodiment of the present application provides a method for monitoring data of a trace event, as shown in fig. 2, the method includes:

step S201, a target interface is displayed, wherein the target interface comprises at least one selection frame and a first input frame; each selection box corresponds to a kernel event; the first input box is used for entering a monitoring time period.

The target tool in the applicable terminal of the embodiment of the application is used for realizing the data monitoring method for tracking the event.

The kernel event in the embodiment of the present application refers to a specific event occurring in the system kernel, as shown in fig. 3, which illustrates a schematic diagram of kernel events included in an operating system, for example, a thread switch event, a sampling event, a handle event, a virtual memory event, a file io event, a disk event, and the like. Of course, some kernel events may be divided into finer granularity, for example, handle events include creating handle events and closing handle events, and virtual memory events include allocating memory events and releasing memory events; the file io event comprises a file event creation event, a file event deletion and a file event reading and writing event; disk events include disk read-write events, initialization events, refresh cache events, and the like.

The target tool can display a target interface, wherein the target interface comprises at least one selection box and a first input box, and each selection box corresponds to a kernel event.

The target interface in this embodiment of the present application further includes a first input box, where the first input box is used to record a monitoring time period, where the monitoring time period is also called "dotting information", where the dotting information includes a start time point (or start time) and an end time point (or end time), where the monitoring time period may be a time period customized for a target object, and may be any time period, and of course, the dotting information may also include a preset time point.

In addition, other information may be set in the target interface, for example, marking information (for marking a preset time point), name information (for setting a name for the monitoring time period), and the like, which need to be monitored, which is not limited in the embodiment of the present application.

As shown in fig. 4, which schematically illustrates a target interface provided by an embodiment of the present application, the target interface includes a first region (not shown in fig. 4) and a second region (not shown in fig. 4), wherein,

The first region includes a plurality of selection boxes, each selection box corresponding to a kernel event, where the kernel event includes a Default event, a pre-information PrefInfo event, a CSwitch event, a disk input/output DiskIO event, a disk write DiskIOInit event, a memory page fault memory event, a hardware memory failure memory HardFaults event, a TCP/IP event, a registration Registry event, a deferred procedure call DPC (Deferred Procedure Call) event, an Interrupt event, a system call System Call event, a FileIO event, a virtual memory virtual AllAllalloc event, and a Handle event.

The second area comprises a first input box, a mark control and a name input box, wherein the first input box is used for inputting a monitoring time period; the marking control is used for setting marking information, such as marking a preset time point; the name entry box is used for entering name information of the monitoring time period.

Step S202, responding to a first selection frame selected from at least one selection frame and a target monitoring time period input by a first input frame, and taking a kernel event corresponding to the first selection frame as a first kernel event to be filtered.

The kernel events are events generated by a resource scheduling unit in the kernel, the resource scheduling unit can comprise processes, sub-processes, threads and the like, event data generated by the kernel events are large, and because some kernel events are not commonly used, the configuration of some kernel events is not intuitive, the starting value is low, the capturing and analyzing of the event data of the kernel events are time-consuming, and in order to avoid the above situations, the embodiment of the application supports the filtering of the event data of the captured kernel events.

In the embodiment of the application, the target object (for example, a developer) is supported to select the first kernel event needing to be filtered, and because the number of the target kernel events is generally higher than that of the first kernel events needing to be filtered, in order to reduce the number of checking operations, the first kernel event needing to be filtered can be checked, that is, the first kernel event needing to be filtered and deleted is designated by the target object is realized, and the first kernel event is not written into the disk. The first kernel event may be a unusual kernel event, or may be a kernel event that is filtered by a target object according to an actual scene requirement in some scenes, which is not limited in the embodiment of the present application.

In addition, the target object can also enter a target monitoring time period, so that the first kernel event is filtered in the target monitoring time period. Further, when the analysis map of a certain dimension of the event data is subsequently displayed, the analysis result of the target monitoring period may be mapped into the complete analysis map containing the monitoring period.

Step S203, acquiring event data of each tracking event in a target monitoring time period, wherein the type of the tracking event comprises kernel events, deleting event data of a first kernel event from the event data of each tracking event, and acquiring event data of a target tracking event; the target tracking event is other events except each first kernel event in various tracking events;

Step S204, displaying event data of each target tracking event obtained in the target monitoring period.

The event data in the embodiment of the present application is related data of the trace event in the executed process, where the event data includes a data type, a data content, stack data for generating the event data, a data size, and the like, and may also include other contents, which are not exemplified here.

The terminal of the embodiment of the invention can use an ETW framework, the ETW framework can capture the event data of all tracking events registered in the ETW framework, the types of the tracking events comprise kernel events and custom events, then the types of the event data of the tracking events comprise event data of kernel events and event data of custom events, the kernel events are registered tracking events for the ETW framework, and for the custom tracking events, the custom tracking events need to be registered in the ETW framework, so that the event data of the custom events is captured.

According to the embodiment of the invention, based on the ETW event tracking framework, event data of all tracking events can be obtained, after the first kernel event to be filtered is selected, event data of the first kernel event is filtered from the event data of each tracking event, the event data of the filtered first kernel event is deleted, the event data of the remaining tracking events obtained after the event data of the first kernel event is deleted is used as the event data of each target tracking event, namely, the event data of the target tracking event is the event data of other tracking events except for the event of each first kernel event in all tracking events, and the event data is required to be reserved. And after the event data of the target tracking events are obtained at the target monitoring time, the event data of each target tracking event are displayed.

In an embodiment of the present application, a possible implementation manner is provided, where obtaining event data of a target tracking event further includes:

and writing event data of the target tracking event into a preset performance file in the local disk, wherein the preset performance file is a tracking report etl file (file suffix is. Etl) of the source service system database.

According to the method and the device for processing the event data of the first kernel event, after event data of the first kernel event selected by the target object is filtered, the event data of the remaining tracking events (including the remaining kernel event and the custom event of the target object) after the event data of the first kernel event is deleted are used as the event data of each target tracking event, the event data of the target tracking events are written into the etl file in the local disk, the event data of the first kernel event is not written into the etl file, and therefore the effect of cutting the etl file is achieved, and in the subsequent process, the event data of any target tracking event can be checked from the etl file.

carrying out data analysis on the event data of each target tracking event, and displaying the analysis result of the event data of each target tracking event in a map form; the analysis result includes the trend of the event data of the corresponding target trace event.

The embodiment of the application supports data analysis of the event data of the target tracking event, and the analysis result of the event data of the target tracking event can be displayed in a map form; the analysis results comprise the change trend (rising, falling, peak value and the like) of the event data of the corresponding target tracking event, namely automatic analysis and map analysis are realized, and a developer is helped to locate abnormal data during the running of the program more clearly. Of course, other information may also be included in the analysis result, for example, an event name of each event, event data, and a time of generation of the event data, which is not limited in the embodiment of the present application.

In an embodiment of the present application, a possible implementation manner is provided to delete event data of a first kernel event from event data of each trace event, including:

Commonly declaring a configuration object for each first kernel event, wherein the configuration object comprises identification information of a resource allocation unit to which each first kernel event belongs and an event operation code of each first kernel event;

acquiring event data of each tracking event from a pre-declared tracking event stream; the event data comprises identification information of a resource allocation unit to which the corresponding tracking event belongs and an event operation code of the tracking event;

and for each event data, if the identification information and the event operation code in the event data are determined to be positioned in the configuration object, deleting the event data as the event data of the first kernel event.

The foregoing embodiments have described that the embodiment of the present application uses an ETW event tracking framework, as shown in fig. 5, which schematically illustrates a schematic diagram of the ETW event tracking framework provided by the embodiment of the present application, including a trace event provider etwpprofiler, a trace event stream ETWSession, a configuration object profiler for filtering, and a trace event filter tracereflector.

When filtering the events of the first kernel events, the ETWPprofiler in the ETW event tracking framework declares a configuration object ProfilerConfigure, profilerConfigure for filtering for each first kernel event together, wherein the configuration object ProfilerConfigure, profilerConfigure comprises identification information of a first resource allocation unit to which each first kernel event belongs and an event operation code of each first kernel event, the first kernel event is a kernel event, each resource allocation unit to which each kernel event belongs has corresponding identification information, and when the resource allocation unit is a process, the corresponding identification information can be a process identification pid; similarly, when the resource allocation unit is a thread, the corresponding identification information may be a thread identification. Each core event has a corresponding event operation code (op code), and the first core event can be uniquely determined through the identification information of the resource allocation unit and the event operation code.

The embodiment of the application also states that an ETW trace event stream ETWSession, ETWSession encapsulates calls to ETW Windows API interfaces, such as StartTraceW, controlTraceW, enableTraceEx, etc., and ETWSession obtains kernel data generated by each kernel event by accessing these interfaces, i.e. ETWSession obtains event data of all trace events, including event data of kernel data and event data of custom events.

Windows provides ITracerelogger to record event data of trace events, but ETWSession is only responsible for informing an operating system of trace events needing to be captured, and ITracerelogger records all captured trace events into a local disk, so that the load of the disk is overlarge.

In order to avoid the above situation, in the embodiment of the present application, a TraceRelogger is further declared to filter the real-time trace event stream through profiler configuration and ETWSession, where the TraceRelogger is responsible for filtering event data of a first kernel event in the trace event stream.

The event data of the kernel event in the embodiment of the application comprises the identification information of the resource allocation unit to which the corresponding tracking event belongs and the event operation code of the tracking event, and the event data of the custom event generally does not comprise the identification information of the resource allocation unit and the event operation code of the tracking event. For each event data, if the tracereflector determines that the event data comprises identification information and an event operation code, and the identification information and the event operation code in the event data are located in a configuration object, the event data are deleted as event data of a first kernel event, so that the event data of the first kernel event are filtered. If the event data does not include the identification information and the event operation code, determining that the event data is the event data of the custom event, and directly writing the event data into the etl file.

The embodiment of the application provides a possible implementation manner, and the tracking event further comprises a custom event; custom events are based on registering traces in the following way:

displaying a configuration interface, wherein the configuration interface comprises a second input box;

generating a target program of the custom event in response to entering a start marker, an end marker, an event name and an identification of an event provider of the custom event into the second input box; the target program comprises a program of an event provider, a start mark, an end mark and an event name; the event provider is any one of a driver, a system component, and an application;

the method comprises the steps of obtaining a loading program in an operating system, loading a program of a custom event to a preset monitoring process through the loading program to register and track the custom event, and obtaining the custom event through the preset monitoring process in a target monitoring time period.

In addition to supporting the tracking of kernel events, the ETW event tracking framework of the embodiment of the present invention also supports the custom events of tracking the target objects, where the custom events are events that are not registered for tracking, and therefore, the registration tracking is required, and the target tool of the embodiment of the present invention provides a configuration interface through which the custom events can be registered for tracking, and the event data of the custom events are captured.

As shown in fig. 6, a schematic diagram of a configuration interface provided by an embodiment of the present application is exemplarily shown, where the configuration interface includes a second input box, and the second input box includes an input box corresponding to a start mark of a custom event, an input box corresponding to an end mark, an input box corresponding to an event name, and an input box corresponding to an identifier of an event provider.

For the target object, the target object does not know the resource scheduling unit to which the custom event belongs, but can know the start mark and the end mark of the custom event, wherein the start mark and the end mark of the custom event are also events, and can be custom events, for example, the start mark is an event accessing login preset software, the end mark is an event exiting login, and the target object can set the start mark and the end mark by itself and can set an event name for the custom event.

In addition, the custom event has its own corresponding event Provider, so that the configuration interface also needs to record the identifier of the event Provider, where the event Provider is located at the application layer of the operating system, and may be any one of a driver, a system component (or a plug-in), and an application program, which is not limited in this embodiment of the present application.

The driver is a configuration file written by a hardware manufacturer according to an operating system. The driver is essentially software code, and functions primarily to perform data transfer between the computer system and the hardware device.

A system component refers to a module or component that has a particular function and role in a particular software or system. They are typically the core components of the system, responsible for processing the basic functions and tasks of the system. The system components may be hardware components, such as processors, memory, hard disks, etc., or may be software components, such as operating systems, database management systems, network protocol stacks, etc.

The application program may be any application software or applet in the system, such as QQ and Wechat, but may also be other application programs, which are not limited in this embodiment of the present application.

The background of the target tool in the embodiment of the application generates a target program of the custom event after acquiring the start mark, the end mark, the event name and the identifier of the event provider of the custom event; the object program includes the program of the event provider, a start marker, an end marker, and an event name.

In addition, the target program is loaded, in particular, the loading program in the operating system is obtained, the program of the custom event is loaded to the preset monitoring process through the loading program to register and track the custom event, so as to obtain the custom event through the preset monitoring process in the target monitoring time period,

According to the embodiment of the application, the generator provided by the windows is used for generating the target program of the code custom Event according to the xml in the specified format, the custom provider is loaded into the preset monitoring process Wperf by using the manifest loader wevuil.exe provided by the windows, so that the custom Event can be registered and tracked, namely, an Event Trace can be registered for the custom Event, and when the target program is started (enabled) by the Controller, the tracking Event can be sent to the corresponding ETWSession.

The operating system may assign an identification information to the custom event to distinguish from other times, and the identification information of the custom event may be a globally unique identifier guid. After the registration is successful, the event tracking of the custom event is started through EnableTraceEx2, and the custom event and the kernel event are returned through ITraceRelog and recorded in the etl file.

As shown in fig. 7, an exemplary embodiment of the present application provides an event data flowchart for capturing a target tracking event, and when each tracking event is started, the event data of the tracking kernel event and the event data of the custom event are started, the event data of the first kernel event is filtered to obtain the event data of the target tracking event, and the event data of the target tracking event is written into the etl file, so as to achieve the effect of clipping the etl file.

In this embodiment, a possible implementation manner is provided, where a kernel event corresponding to a first selection box is used as a first kernel event to be filtered, and then the method further includes:

determining each reference resource allocation unit; the reference resource allocation units are other resource allocation units except the resource allocation unit to which the first kernel event belongs in the resource allocation units contained in the operating system;

determining the occupation result of each reference resource allocation unit on a Central Processing Unit (CPU) at each moment of a target monitoring time period;

for any one reference resource allocation unit, if the occupation result of the reference resource allocation unit on the CPU at the continuous preset number of moments is determined to be not in accordance with the preset condition, the reference resource allocation unit is taken as a target resource allocation unit, and the starting moment in the continuous preset number of moments is taken as a target moment;

and displaying alarm information, wherein the alarm information is used for prompting a target resource allocation unit to start to abnormally occupy the CPU at the target moment.

The embodiment of the application can help a developer to more clearly locate abnormal occupation of the cpu during the running of the program, determine each reference resource allocation unit in a plurality of resource allocation units in the operating system, wherein each resource allocation unit has a corresponding tracking event, and the reference resource allocation units are other resource allocation units except for the resource allocation unit to which the first kernel event belongs in each resource allocation unit contained in the operating system.

Metadata (e.g., event data, trace event occupying CPU) provided by the ETW in the embodiment of the present application is sampling point data in units of milliseconds, i.e., a snapshot manner records the trace event currently occupying CPU.

The embodiment of the application provides a possible implementation manner, which is used for determining the occupation result of each reference resource allocation unit on the CPU at each moment of the target monitoring time period, and comprises the following steps:

obtaining a target snapshot at each moment in a target monitoring time period; the target snapshot records each resource allocation unit occupying the CPU at the corresponding moment;

and determining the occupation result of each reference resource allocation unit on the CPU at each moment from the target snapshot at each moment.

According to the method and the device for determining the CPU occupation results, the target snapshot records the resource allocation units occupied by the CPU at the corresponding time, and the occupation results of the reference resource allocation units on the CPU at the time can be determined from the target snapshot at the time. The result of occupancy is occupancy or no occupancy.

For any one reference resource allocation unit, if the occupation result of the reference resource allocation unit on the CPU at the continuous preset number (such as continuous 10 millisecond time) is determined to be not in accordance with the preset condition (such as that n times occupy the CPU at the preset number), the reference resource allocation unit is taken as a target resource allocation unit, and the starting time in the continuous preset number of times is taken as a target time; and prompting alarm information (such as text prompt, voice prompt, image prompt and the like), wherein the alarm information is used for prompting a target resource allocation unit to start to abnormally occupy the CPU at the target moment.

Specifically, in the embodiment of the present application, a possible implementation manner is provided, where determining that an occupation result of a reference resource allocation unit on a CPU at a continuous preset number of moments does not meet a preset condition includes:

setting a plurality of time window sequences in a target monitoring time period, wherein the starting moments of two adjacent time window sequences are separated by a target duration; each time window sequence comprises a continuous preset number of moments;

at the end time of each time window sequence, determining the target weight of each reference resource allocation unit occupying the CPU in the time window sequence, wherein the target weight represents the proportion of the reference resource allocation unit at the first time in a plurality of times contained in the time window sequence; the occupation result of the reference resource allocation unit at the first moment is a preset result; the preset result represents that the reference resource allocation unit occupies the CPU;

for any one reference resource allocation unit, for any one time window sequence, if the target weight of the reference resource allocation unit in the time window sequence is determined to be greater than a preset threshold, determining that the occupation result of the reference resource allocation unit in the time window sequence on the CPU does not meet the preset condition.

In the embodiment of the present application, a plurality of time window sequences are set in a target monitoring time period, where each time window sequence has the same duration and includes the same number of times, each time window sequence includes a continuous preset number of times, for example, 10 continuous milliseconds, and the starting times of two adjacent time window sequences are spaced by a target duration, for example, the target duration is 1, and may also be other data.

As shown in fig. 8, which schematically illustrates a schematic diagram of a time window sequence provided in the embodiment of the present application, the time sequence is represented by the order from left to right, and the relationship between the respective time window sequences is as shown in fig. 8, including a time window sequence 1, a time window sequence 2, and a time window sequence, each time window sequence includes 6ms that are continuous, and a 1ms interval is formed between the start time intervals of two adjacent time window sequences, which means that 1ms intervals are also formed between the end time intervals of two adjacent time window sequences.

For any reference resource allocation unit, judging whether the CPU occupation result of the reference resource allocation unit meets the preset condition or not at every moment, if the CPU occupation result is the CPU occupied by the reference resource allocation unit, determining that the occupation result is the preset result, and if the CPU occupation result is the CPU unoccupied by the reference resource allocation unit, determining that the occupation result is not the preset result.

At the end time of each time window sequence, if the CPU occupation result is a preset result, the number of the preset results in the time window sequence is increased by 1, and if the CPU occupation result is not the preset result, the number of the preset results in the time window sequence is decreased by 1. And at the end time, the target weight of each reference resource allocation unit in the time window sequence is required, wherein the target weight represents the proportion of the occupation result of the reference resource allocation unit in a plurality of times contained in the time window sequence as a preset result, namely the target weight=the number of the preset result/the total number of the times in the time window sequence, and for any one reference resource allocation unit, if the target weight of the reference resource allocation unit in the time window sequence is determined to be greater than a preset threshold value for any one time window sequence, the occupation result of the reference resource allocation unit in the time window sequence on the CPU is determined to be not in accordance with a preset condition, namely the abnormal occupation of the reference resource allocation unit in the time window sequence on the CPU is indicated. If the occupation result of the CPU meets the preset condition, the alarm information is not prompted, and the event data of the reference resource unit is continuously written into the etl file.

The embodiment of the application provides a possible implementation manner, which determines that each reference resource allocation unit occupies a target weight of a CPU in a time window sequence, and includes:

for any one reference resource allocation unit, determining the number of first moments corresponding to the reference resource allocation unit from the preset number of moments contained in the time window sequence; the occupation result of the reference resource allocation unit at the first moment is a preset result;

and determining the ratio between the number of the first moments and the total number of the plurality of moments in the time window sequence, and taking the ratio as the target weight of the reference resource allocation unit at the moments.

Specifically, assuming that the time window includes 10 times, for a certain reference resource allocation unit, the 2 nd, 3 rd, 5 th, 7 th, 8 th and 9 th times are all first times, that is, the occupation result of the reference resource allocation unit on the CPU at the first time is a preset result, and the total of 6 first times, in the time window, the target weight occupied by the reference resource allocation unit on the CPU is 6/10=60%, and assuming that the preset threshold is 50%, since the target weight is greater than the preset threshold, it is explained that the occupation result of the reference resource allocation unit on the CPU in the time window sequence does not meet the preset condition, at this time, the starting time of the time window sequence can be recorded, the starting time is taken as the target time, and alarm information is used for prompting that the target resource allocation unit starts to abnormally occupy the CPU at the target time.

As shown in fig. 9, which is an exemplary flowchart for determining a resource allocation unit of an abnormally occupied CPU according to an embodiment of the present application, the method includes the following steps:

step S901, determining each reference resource allocation unit from each resource allocation unit included in the operating system;

step S902, determining the occupation result of each reference resource allocation unit to the CPU at each moment in the target monitoring time period;

step S903, a plurality of time window sequences are set in a target monitoring time period, and the starting moments of two adjacent time window sequences are separated by a target duration; each time window sequence comprises a continuous preset number of moments;

step S904, at the end time of each time window sequence, determining the target weight of each reference resource allocation unit occupying the CPU in the time window sequence, wherein the target weight represents the proportion of the reference resource allocation unit at the first time in a plurality of times contained in the time window sequence; the occupation result of the reference resource allocation unit at the first moment is a preset result; the preset result represents that the reference resource allocation unit occupies the CPU;

step S905, for any one reference resource allocation unit, for any one time window sequence, if it is determined that the target weight of the reference resource allocation unit in the time window sequence is greater than the preset threshold, it is determined that the occupation result of the reference resource allocation unit in the time window sequence on the CPU does not meet the preset condition;

Step S906, taking the reference resource allocation unit as a target resource allocation unit, and taking the starting time in continuous preset number of times as a target time;

step S907, warning information is prompted, wherein the warning information is used for prompting the target resource allocation unit to start abnormally occupying the CPU at the target moment.

The detailed implementation process of the steps S901-S907 is described in the foregoing embodiments, and the embodiments of the present application will not be repeated here.

An embodiment of the present application provides a data monitoring device 1000 for tracking events, as shown in fig. 10, the monitoring device 1000 may include:

a first display module 1010 for displaying a target interface, the target interface including at least one selection box and a first input box; each selection box corresponds to a kernel event; the first input box is used for inputting a monitoring time period;

the first response module 1020 is configured to respond to a first selected box in the at least one selected box and a target monitoring period of time in which the first input box is input, and take a kernel event corresponding to the first selected box as a first kernel event to be filtered;

the deleting module 1030 is configured to acquire event data of each trace event in the target monitoring period, where the type of trace event includes a kernel event, delete event data of a first kernel event from the event data of each trace event, and obtain event data of a target trace event; the target tracking event is other events except each first kernel event in various tracking events;

And a second display module 1040, configured to display event data of each target tracking event obtained during the target monitoring period.

The embodiment of the application provides the visual target interface for the target object to select the first kernel event needing to be filtered from a plurality of kernel events which can be tracked by the operating system, so that the first kernel event which does not need to be analyzed can be eliminated by performing a small amount of checkup, and the operation is simple and convenient; in addition, the embodiment of the application also supports the appointed event data for filtering some kernel events, so that the target object can filter the event data of unnecessary trace events according to actual demands, has higher flexibility, can reduce the data volume of the event data to be analyzed, and reduces the difficulty of data analysis.

The embodiment of the application provides a possible implementation manner, and the monitoring device further comprises:

the second determining submodule is used for determining the occupation result of each reference resource allocation unit on the CPU at each moment of the target monitoring time period;

The target determining sub-module is used for regarding any one reference resource allocation unit, if the occupation result of the reference resource allocation unit on the CPU does not meet the preset condition at the time of the continuous preset number, taking the reference resource allocation unit as a target resource allocation unit, and taking the starting time in the time of the continuous preset number as a target time;

The embodiment of the application provides a possible implementation manner, and the target determining submodule comprises:

the weight determining unit is used for determining the target weight of each reference resource allocation unit occupying the CPU in the time window sequence at the end time of each time window sequence, and the target weight represents the proportion of the reference resource allocation unit at the first time in a plurality of times contained in the time window sequence; the occupation result of the reference resource allocation unit at the first moment is a preset result; the preset result represents that the reference resource allocation unit occupies the CPU;

The embodiment of the application provides a possible implementation manner, and the weight determining unit is specifically configured to determine, for any one reference resource allocation unit, the number of first moments corresponding to the reference resource allocation unit from the preset number of moments included in the time window sequence; and determining the ratio between the number of the first moments and the total number of the plurality of moments in the time window sequence, and taking the ratio as the target weight of the reference resource allocation unit at the moments.

The embodiment of the application provides a possible implementation manner, and the second determining submodule is specifically used for obtaining target snapshots of all moments in a target monitoring time period; the target snapshot records each resource allocation unit occupying the CPU at the corresponding moment; and determining the occupation result of each reference resource allocation unit on the CPU at each moment from the target snapshot at each moment.

The embodiment of the application provides a possible implementation manner, and the deletion module is specifically configured to jointly declare a configuration object for each first kernel event, where the configuration object includes identification information of a resource allocation unit to which each first kernel event belongs and an event operation code of each first kernel event; acquiring event data of each tracking event from a pre-declared tracking event stream; the event data comprises identification information of a resource allocation unit to which the corresponding tracking event belongs and an event operation code of the tracking event; and for each event data, if the identification information and the event operation code in the event data are determined to be positioned in the configuration object, deleting the event data as the event data of the first kernel event.

The embodiment of the application provides a possible implementation manner, and the tracking event further comprises a custom event; the device also comprises a registration module, wherein the registration module is used for registering and tracking the custom event through the following submodules:

and the writing module is used for writing the event data of the target tracking event into the etl file in the local disk.

The embodiment of the application provides a possible implementation manner, and the device further comprises:

The apparatus of the embodiments of the present application may perform the method provided by the embodiments of the present application, and implementation principles of the method are similar, and actions performed by each module in the apparatus of each embodiment of the present application correspond to steps in the method of each embodiment of the present application, and detailed functional descriptions of each module of the apparatus may be referred to in the corresponding method shown in the foregoing, which is not repeated herein.

In the present embodiment, the term "module" or "unit" refers to a computer program or a part of a computer program having a predetermined function, and works together with other relevant parts to achieve a predetermined object, and may be implemented in whole or in part by using software, hardware (such as a processing circuit or a memory), or a combination thereof. Also, a processor (or multiple processors or memories) may be used to implement one or more modules or units. Furthermore, each module or unit may be part of an overall module or unit that incorporates the functionality of the module or unit.

The embodiment of the application provides an electronic device, which comprises a memory, a processor and a computer program stored on the memory, wherein the processor executes the computer program to realize the steps of a data monitoring method for tracking events, and compared with the related art, the steps can be realized: the embodiment of the application provides the visual target interface for the target object to select the first kernel event needing to be filtered from a plurality of kernel events which can be tracked by the operating system, so that the first kernel event which does not need to be analyzed can be eliminated by performing a small amount of checkup, and the operation is simple and convenient; in addition, the embodiment of the application also supports the appointed event data for filtering some kernel events, so that the target object can filter the event data of unnecessary trace events according to actual demands, has higher flexibility, can reduce the data volume of the event data to be analyzed, and reduces the difficulty of data analysis.

In an alternative embodiment, there is provided an electronic device, as shown in fig. 11, the electronic device 4000 shown in fig. 11 includes: a processor 4001 and a memory 4003. Wherein the processor 4001 is coupled to the memory 4003, such as via a bus 4002. Optionally, the electronic device 4000 may further comprise a transceiver 4004, the transceiver 4004 may be used for data interaction between the electronic device and other electronic devices, such as transmission of data and/or reception of data, etc. It should be noted that, in practical applications, the transceiver 4004 is not limited to one, and the structure of the electronic device 4000 is not limited to the embodiment of the present application.

The processor 4001 may be a CPU (Central Processing Unit ), general purpose processor, DSP (Digital Signal Processor, data signal processor), ASIC (Application Specific Integrated Circuit ), FPGA (Field Programmable Gate Array, field programmable gate array) or other programmable logic device, transistor logic device, hardware components, or any combination thereof. Which may implement or perform the various exemplary logic blocks, modules, and circuits described in connection with this disclosure. The processor 4001 may also be a combination that implements computing functionality, e.g., comprising one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

Bus 4002 may include a path to transfer information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect, peripheral component interconnect standard) bus or an EISA (Extended Industry Standard Architecture ) bus, or the like. The bus 4002 can be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, only one thick line is shown in FIG. 11, but not only one bus or one type of bus.

Memory 4003 may be, but is not limited to, ROM (Read Only Memory) or other type of static storage device that can store static information and instructions, RAM (Random Access Memory ) or other type of dynamic storage device that can store information and instructions, EEPROM (Electrically Erasable Programmable Read Only Memory ), CD-ROM (Compact Disc Read Only Memory, compact disc Read Only Memory) or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium that can be used to carry or store a computer program and that can be Read by a computer.

The memory 4003 is used for storing a computer program that executes an embodiment of the present application, and is controlled to be executed by the processor 4001. The processor 4001 is configured to execute a computer program stored in the memory 4003 to realize the steps shown in the foregoing method embodiment.

Among them, the electronic device package may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and the like, and stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 11 is merely an example, and should not impose any limitations on the functionality and scope of use of embodiments of the present disclosure.

Embodiments of the present application provide a computer readable storage medium having a computer program stored thereon, where the computer program, when executed by a processor, may implement the steps and corresponding content of the foregoing method embodiments. Compared with the prior art, can realize: the embodiment of the application provides the visual target interface for the target object to select the first kernel event needing to be filtered from a plurality of kernel events which can be tracked by the operating system, so that the first kernel event which does not need to be analyzed can be eliminated by performing a small amount of checkup, and the operation is simple and convenient; in addition, the embodiment of the application also supports the appointed event data for filtering some kernel events, so that the target object can filter the event data of unnecessary trace events according to actual demands, has higher flexibility, can reduce the data volume of the event data to be analyzed, and reduces the difficulty of data analysis.

It should be noted that the computer readable medium described in the present disclosure may be a computer readable signal medium or a computer readable medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

The embodiments of the present application also provide a computer program product, which includes a computer program, where the computer program can implement the steps of the foregoing method embodiments and corresponding content when executed by a processor. Compared with the prior art, can realize: the embodiment of the application provides the visual target interface for the target object to select the first kernel event needing to be filtered from a plurality of kernel events which can be tracked by the operating system, so that the first kernel event which does not need to be analyzed can be eliminated by performing a small amount of checkup, and the operation is simple and convenient; in addition, the embodiment of the application also supports the appointed event data for filtering some kernel events, so that the target object can filter the event data of unnecessary trace events according to actual demands, has higher flexibility, can reduce the data volume of the event data to be analyzed, and reduces the difficulty of data analysis.

The terms "first," "second," "third," "fourth," "1," "2," and the like in the description and in the claims of this application and in the above-described figures, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the present application described herein may be implemented in other sequences than those illustrated or otherwise described.

It should be understood that, although the flowcharts of the embodiments of the present application indicate the respective operation steps by arrows, the order of implementation of these steps is not limited to the order indicated by the arrows. In some implementations of embodiments of the present application, the implementation steps in the flowcharts may be performed in other orders as desired, unless explicitly stated herein. Furthermore, some or all of the steps in the flowcharts may include multiple sub-steps or multiple stages based on the actual implementation scenario. Some or all of these sub-steps or phases may be performed at the same time, or each of these sub-steps or phases may be performed at different times, respectively. In the case of different execution time, the execution sequence of the sub-steps or stages may be flexibly configured according to the requirement, which is not limited in the embodiment of the present application.

The foregoing is merely an optional implementation manner of some implementation scenarios of the present application, and it should be noted that, for those skilled in the art, other similar implementation manners based on the technical ideas of the present application are adopted without departing from the technical ideas of the solution of the present application, which also belongs to the protection scope of the embodiments of the present application.

Claims

1. A method of monitoring data for tracking events, comprising:

responding to a first selection frame selected from at least one selection frame and a target monitoring time period input by the first input frame, and taking a kernel event corresponding to the first selection frame as a first kernel event to be filtered;

acquiring event data of each tracking event in the target monitoring time period, wherein the type of the tracking event comprises a kernel event, deleting the event data of a first kernel event from the event data of each tracking event, and acquiring the event data of the target tracking event; the target tracking event is other events except each first kernel event in various tracking events;

event data of each target tracking event obtained in the target monitoring time period is displayed.

2. The method of claim 1, wherein the regarding the kernel event corresponding to the first selection box as the first kernel event to be filtered further comprises:

Determining each reference resource allocation unit; the reference resource allocation units are other resource allocation units except the resource allocation unit to which the first kernel event belongs in each resource allocation unit contained in the operating system;

determining the occupation result of each reference resource allocation unit on a Central Processing Unit (CPU) at each moment of the target monitoring time period;

for any one reference resource allocation unit, if the occupation result of the reference resource allocation unit on the CPU at the time of the continuous preset number is determined to be not in accordance with the preset condition, taking the reference resource allocation unit as a target resource allocation unit, and taking the starting time in the time of the continuous preset number as a target time;

and prompting alarm information, wherein the alarm information is used for prompting the target resource allocation unit to start to abnormally occupy the CPU at the target moment.

3. The method according to claim 2, wherein the determining that the occupation result of the reference resource allocation unit on the CPU at the consecutive preset number of time instants does not meet the preset condition includes:

setting a plurality of time window sequences in the target monitoring time period, wherein the starting moments of two adjacent time window sequences are separated by target duration; each time window sequence comprises a continuous preset number of moments;

At the end time of each time window sequence, determining the target weight of each reference resource allocation unit occupying the CPU in the time window sequence, wherein the target weight represents the proportion of the reference resource allocation unit at the first moment in a plurality of moments contained in the time window sequence; the occupation result of the reference resource allocation unit at the first moment is a preset result; the preset result represents that the reference resource allocation unit occupies a CPU;

for any reference resource allocation unit, for any time window sequence, if the target weight of the reference resource allocation unit in the time window sequence is determined to be greater than a preset threshold, determining that the occupation result of the reference resource allocation unit in the time window sequence on the CPU does not meet a preset condition.

4. The method of claim 3, wherein determining that each reference resource allocation unit occupies a target weight of the CPU in the time window sequence comprises:

for any one reference resource allocation unit, determining the number of first moments corresponding to the reference resource allocation unit from the preset number of moments contained in the time window sequence;

And determining a ratio between the number of the first moments and the total number of the plurality of moments in the time window sequence, and taking the ratio as a target weight of the reference resource allocation unit at the moments.

5. The method according to claim 2, wherein determining the occupation result of each reference resource allocation unit to the central processing unit CPU at each time of the target monitoring period comprises:

obtaining a target snapshot at each moment in a target monitoring time period; the target snapshot records each resource allocation unit occupying the CPU at corresponding time;

6. The method of claim 1, wherein deleting the event data of the first kernel event from the event data of each trace event comprises:

acquiring event data of each tracking event from a pre-declared tracking event stream; the event data comprises identification information of a resource allocation unit to which a corresponding tracking event belongs and an event operation code of the tracking event;

7. The method of claim 1, wherein the tracking event further comprises a custom event; the custom event registers for tracking by:

generating a target program of the custom event in response to entering a start marker, an end marker, an event name and an identification of an event provider of the custom event into the second input box; the target program includes a program of the event provider, the start marker, the end marker, and the event name; the event provider is any one of a driver, a system component and an application program;

and acquiring a loading program in an operating system, loading the program of the custom event to a preset monitoring process through the loading program so as to register and track the custom event, and acquiring event data of the custom event through the preset monitoring process in the target monitoring time period.

8. The method of claim 1, wherein obtaining event data for a target trace event, further comprising thereafter:

and writing the event data of the target tracking event into a preset performance file in the local disk.

9. The method of claim 1, wherein obtaining event data for a target trace event, further comprising thereafter:

carrying out data analysis on the event data of each target tracking event, and displaying the analysis result of the event data of each target tracking event in a map form; the analysis result comprises the change trend of event data of the corresponding target tracking event.

10. A data monitoring device for tracking events, comprising:

the first response module is used for responding to a first selected frame in at least one selected frame and a target monitoring time period input by the first input frame, and taking a kernel event corresponding to the first selected frame as a first kernel event to be filtered;

The deleting module is used for acquiring event data of each tracking event in the target monitoring time period, wherein the type of the tracking event comprises a kernel event, and deleting the event data of a first kernel event from the event data of each tracking event to acquire the event data of the target tracking event; the target tracking event is other events except each first kernel event in various tracking events;

and the second display module is used for displaying event data of each target tracking event obtained in the target monitoring time period.

11. An electronic device comprising a memory, a processor and a computer program stored on the memory, characterized in that the processor executes the computer program to carry out the steps of the method according to any one of claims 1-9.

12. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method according to any one of claims 1-9.

13. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the steps of the method according to any one of claims 1-9.