WO2023072082A1 - 一种事件监控方法、装置、芯片和计算机存储介质 - Google Patents

一种事件监控方法、装置、芯片和计算机存储介质 Download PDF

Info

Publication number
WO2023072082A1
WO2023072082A1 PCT/CN2022/127406 CN2022127406W WO2023072082A1 WO 2023072082 A1 WO2023072082 A1 WO 2023072082A1 CN 2022127406 W CN2022127406 W CN 2022127406W WO 2023072082 A1 WO2023072082 A1 WO 2023072082A1
Authority
WO
WIPO (PCT)
Prior art keywords
event
value
target
target event
counting
Prior art date
Application number
PCT/CN2022/127406
Other languages
English (en)
French (fr)
Inventor
王全刚
赵茂聪
王力
Original Assignee
苏州盛科通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州盛科通信股份有限公司 filed Critical 苏州盛科通信股份有限公司
Publication of WO2023072082A1 publication Critical patent/WO2023072082A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/08—Allotting numbers to messages; Counting characters, words or messages
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Definitions

  • the present application relates to the technical field of communications, and in particular to an event monitoring method, device, chip and computer storage medium.
  • Microburst refers to the phenomenon that a port receives so much burst data in a short period of time that the instantaneous burst rate reaches dozens or hundreds of times the average rate, or even exceeds the port bandwidth. Microbursts will reduce network service performance, and in severe cases, will cause network packet loss and prolong service completion time.
  • Latency refers to the time required for a packet or packet to be transmitted from one end of a network to the other. During the forwarding process of a user data packet, it may pass through multiple forwarding devices such as switches and routers. Excessive delay will eventually affect the user's network experience.
  • the current network requires chips to be able to provide hardware-level monitoring of micro-bursts and delays.
  • the current solution is to mirror the micro-bursts and delay events on the network port and perform visual analysis on the remote server; however, this solution will As a result, when the traffic is large, it takes up more network bandwidth and increases the pressure on remote services.
  • Embodiments of the present application provide an event monitoring method, device, chip, and computer storage medium, which can realize flexible monitoring of target events and avoid occupying network bandwidth.
  • the embodiment of the present application provides an event monitoring method, the method comprising:
  • the target event signal indicates that the target event is identified, then obtain the counting statistics corresponding to the target event from the Internet Protocol IP data flow information output IPFIX flow table;
  • the counting statistic value corresponding to the target event is less than a preset threshold, the counting statistic value is updated, and the updated counting statistic value is saved in the IPFIX flow table;
  • a reporting event is generated, and the reporting event and the counting statistic value are sent to the central processing unit; wherein the reporting event is set to notify The central processing unit overflows the occurrence count of the target event.
  • the embodiment of the present application provides an event monitoring device, the event monitoring device includes an acquisition unit and an IPFIX engine unit, wherein,
  • the acquiring unit is configured to acquire a target event signal
  • the IPFIX engine unit is configured to, if the target event signal indicates that the target event is identified, then obtain the counting statistics corresponding to the target event from the IP data flow information output IPFIX flow table; and if the target event corresponds to The counting statistic value is less than a preset threshold, then the counting statistic value is updated, and the updated counting statistic value is saved in the IPFIX flow table; and if the counting statistic value corresponding to the target event is greater than or equal to the The preset threshold value, then generate a reporting event, and send the reporting event and the counting statistics to the central processing unit; wherein, the reporting event is set to inform the central processing unit that the counting overflow of the target event occurs .
  • the embodiment of the present application provides a chip, the chip includes a memory and a processor, wherein,
  • the memory configured to store a computer program capable of running on the processor
  • the processor is configured to execute the event monitoring method as described in the first aspect when running the computer program.
  • an embodiment of the present application provides an electronic device, where the electronic device includes the event monitoring apparatus as described in the second aspect or includes the chip as described in the third aspect.
  • an embodiment of the present application provides a computer storage medium, where the computer storage medium stores a computer program, and when the computer program is executed by at least one processor, the event monitoring method as described in the first aspect is implemented.
  • An event monitoring method, device, chip, and computer storage medium provided in the embodiments of the present application obtain the target event signal; if the target event signal indicates that the target event is identified, then obtain the counting statistics corresponding to the target event from the IPFIX flow table value; if the counting statistic value corresponding to the target event is less than the preset threshold, update the counting statistic value, and save the updated counting statistic value to the IPFIX flow table; if the counting statistic value corresponding to the target event is greater than or equal to the preset threshold If the threshold is set, a reporting event is generated, and the reporting event and counting statistics are sent to the central processing unit; wherein, the reporting event is used to inform the central processing unit that the counting overflow of the target event occurs.
  • the target event is counted and counted through the IPFIX flow table.
  • the chip statistics table field is fixed and not easy to expand, the monitoring and statistics of micro-burst events and delay congestion events can be flexibly realized, especially When the traffic is large, it can also realize flexible monitoring of target events and avoid occupying network bandwidth.
  • FIG. 1 is a schematic flow diagram of an event monitoring method provided in an embodiment of the present application
  • FIG. 2 is a schematic flow diagram of another event monitoring method provided in the embodiment of the present application.
  • FIG. 3 is a detailed flow diagram of an event monitoring method provided in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of the composition and structure of an event monitoring device provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of an optional hardware structure of a chip provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of an optional hardware structure of an electronic device provided in an embodiment of the present application.
  • first ⁇ second ⁇ third involved in the embodiment of this application is only to distinguish similar objects, and does not represent a specific ordering of objects. Understandably, “first ⁇ second ⁇ third” Where permitted, the specific order or sequencing may be interchanged such that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein.
  • Microburst It refers to the phenomenon that the port receives so much burst data in a short period of time that the instantaneous burst rate reaches tens or hundreds of times of the average rate, or even exceeds the port bandwidth.
  • Latency refers to the time required for a message or packet to be transmitted from one end of a network to the other.
  • Arithmetic Logic Unit ALU is a combinational logic circuit that can realize multiple sets of arithmetic operations and logic operations.
  • MOB provides a solution for active monitoring and reporting of hardware packet loss specifically for micro-bursts.
  • MOL Monitoring On Latency
  • IP Flow Information Export IP Flow Information Export
  • Cisco NetFlow Version 9 Cisco NetFlow Version 9 (Cisco Data Flow Analysis Toolkit Version 9) data output format, which enables IP traffic information to be transmitted from an exporter (Exporter) to a collector (Collector).
  • IPFIX is a protocol for data flow feature analysis and template-based format output, it has strong scalability and can define different data formats for different needs.
  • IPFIX needs to realize the monitoring of a certain data flow.
  • hash Key hash Key
  • Value the Key
  • Index Index
  • AD Address, behavior
  • Repcord the flow statistics
  • Microburst is a common traffic in the network. On the one hand, it will reduce the performance of network services. In severe cases, it will cause network packet loss and prolong the service completion time. For example, Transmission Control Protocol (Transmission Control Protocol, TCP) may trigger global synchronization, etc., MOB Provides a solution for active monitoring and reporting of hardware packet loss specifically for microbursts.
  • TCP Transmission Control Protocol
  • TCP Transmission Control Protocol
  • MOB Provides a solution for active monitoring and reporting of hardware packet loss specifically for microbursts.
  • the time consumed by the entire transmission process is called network delay until the packet data is sent from the user source host to the destination host or server.
  • network delay the time consumed by the entire transmission process is called network delay until the packet data is sent from the user source host to the destination host or server.
  • they may pass through multiple forwarding devices such as switches and routers.
  • the high delay of any forwarding node will eventually affect the user's network experience. Therefore, it is particularly important to monitor the delay of forwarding devices.
  • MOL provides a solution to actively monitor and report hardware packet loss for latency.
  • the current network requires the chip to provide hardware-level MicroBurst and Latency event monitoring.
  • the current common practice is to mirror the MicroBurst and Latency events on the network port, and the remote server will perform visual analysis, which will occupy the network bandwidth when the traffic is large. At the same time, remote services have been added.
  • the embodiment of the present application provides an event monitoring method, the basic idea of which is: obtain the target event signal; if the target event signal indicates that the target event is identified, then obtain the count statistics corresponding to the target event from the IPFIX flow table value; if the counting statistic value corresponding to the target event is less than the preset threshold, update the counting statistic value, and save the updated counting statistic value to the IPFIX flow table; if the counting statistic value corresponding to the target event is greater than or equal to the preset threshold If the threshold is set, a reporting event is generated, and the reporting event and counting statistics are sent to the central processing unit; wherein, the reporting event is used to inform the central processing unit that the counting overflow of the target event occurs.
  • the target event is counted and counted through the IPFIX flow table.
  • the chip statistics table field is fixed and not easy to expand, the monitoring and statistics of micro-burst events and delay congestion events can be flexibly realized, especially When the traffic is large, it can also realize flexible monitoring of target events and avoid occupying network bandwidth.
  • FIG. 1 shows a schematic flowchart of an event monitoring method provided in an embodiment of the present application.
  • the method may include:
  • the event monitoring method provided in the embodiment of the present application can be applied to an event monitoring device, or an electronic device integrated with the device.
  • the electronic device mainly refers to a forwarding device such as a switch that a data packet passes through during transmission.
  • the event monitoring method provided by the embodiment of the present application can also be implemented based on chips of electronic equipment, such as application specific integrated circuits (Application Specific Integrated Circuit, ASIC) chips, field programmable logic gate arrays (Field Programmable Gate Array, FPGA) chips and a network processor (Networking Processor, NP) chip, etc., which are not limited in this embodiment of the present application.
  • ASIC Application Specific Integrated Circuit
  • FPGA Field Programmable Gate Array
  • NP Network Processor
  • the target event signal may include a microburst event signal (MicroBurst event signal) and/or a delay congestion event signal (LatencyCongestion event signal). That is to say, the target event signal involved in the embodiment of the present application mainly refers to the MicroBurst event signal and/or the LatencyCongestion event signal; correspondingly, the target event involved in the embodiment of the present application mainly refers to the MicroBurst event and/or the LatencyCongestion event.
  • MicroBurst event signal MicroBurst event signal
  • LatencyCongestion event signal delay congestion event signal
  • the MicroBurst event means that the port receives a lot of burst data in a short period of time, so that the instantaneous burst rate reaches dozens of times, hundreds of times the average rate, or even exceeds the port bandwidth;
  • LatencyCongestion event means that the data packet The phenomenon that the delay is too long (for example, the transmission delay exceeds the set threshold value).
  • the delay mainly refers to the delay generated in the forwarding device during the transmission of the data packet. If If the delay is too long, the LatencyCongestion event occurs.
  • the target event signal represents a signal related to the target event. By analyzing and judging the target event signal, it is determined whether the target event signal is valid, so as to determine whether the target event occurs. Details The judging method will be described in detail in the subsequent steps.
  • the target event signal when acquiring the target event signal, if the target event signal is successfully acquired, one of the MicroBurst event signal and the LatencyCongestion event signal may be acquired, or both may be acquired; whether one or both are acquired Both can be obtained, and each target event signal can be processed according to the event monitoring method provided in the embodiment of the present application. That is to say, this embodiment of the present application can implement synchronous monitoring of the MicroBurst event and the LatencyCongestion event.
  • the target event may at least include: a Microburst event, and/or, a LatencyCongestion event; correspondingly, obtaining a target event signal may include:
  • the LatencyCongestion event signal is obtained
  • the Microburst event signal is used to indicate whether the Microburst event occurs
  • the LatencyCongestion event signal is used to indicate whether the LatencyCongestion event occurs.
  • the embodiment of the present application can realize the identification and acquisition of the target event signal through a memory management unit (Memory Management Unit, MMU) unit and an egress process engine (Egress Process Engine, EPE) unit respectively.
  • MMU Memory Management Unit
  • Egress Process Engine Egress Process Engine
  • the Microburst event signal is recognized by the MMU unit, and then the target message is passed to the EPE unit; when the target message passes through the EPE unit, the LatencyCongestion event signal is recognized by the EPE unit; The recognized Microburst event signal and/or LatencyCongestion event signal is the target event signal finally obtained.
  • the Microburst event signal is a signal related to the Microburst event and can be used to indicate whether the Microburst event occurs
  • the LatencyCongestion event signal is a signal related to the LatencyCongestion event and can be used to indicate whether the LatencyCongestion event occurs.
  • the event is usually mirrored to the network port, and then the remote server performs visual analysis. However, this will occupy the network bandwidth and increase the remote End service pressure.
  • the embodiment of the present application can realize the monitoring and counting statistics of the target event based on IPFIX. Therefore, the embodiment of the present application can realize the functions such as the processing of the target event signal and the counting of the target event through the function realization unit IPFIX Engine unit of IPFIX ( IPFIX engine unit, referred to as IPFIX Engine, IPFIX engine) to achieve.
  • IPFIX Engine unit IPFIX
  • IPFIX Engine IPFIX engine
  • the method may also include: enabling the IPFIX function through the access control list ACL, and sending the target event to the IPFIX engine unit;
  • IPFIX engine unit performs a hash search according to the message characteristics of the target message
  • a step of judging whether the counting statistic value corresponding to the target event is less than a preset threshold is performed.
  • the access control list (Access Control Lists, ACL) is an access control technology based on packet filtering, which can filter data packets (such as messages) on the interface according to the set conditions.
  • ACL Access Control Lists
  • the filtering conditions may include only performing subsequent processing on packets transmitted from one or more specific ports, or performing subsequent processing only on packets that are successfully matched after feature matching is performed on the packets.
  • the feature extraction of the target message can be performed through the IPFIX engine unit, and then the hash search can be performed according to the message feature.
  • the hash value can be calculated according to the characteristics of the message, and then the storage space of the IPFIX engine can be read with the hash value as an index. If the record information is found, it is performed to determine whether the count statistics corresponding to the target event are less than the preset threshold Steps; if the record information is not found, first learn the target message, send it to the storage space of the IPFIX engine, and then continue to perform the subsequent steps.
  • the target event signal indicates that the target event is recognized, acquire a counting statistic value corresponding to the target event from the IPFIX flow table.
  • the target event signal after obtaining the target event signal, first judge whether the target event is recognized according to the target event signal, that is, determine whether the target event occurs, and obtain the count statistics corresponding to the target event from the IPFIX flow table when it is determined that the target event occurs value.
  • the counting statistics value is obtained by using a 32-bit ALU field for statistics.
  • IPFIX flow table by using the IPFIX flow table to record the target event, two 32-byte (Bits) ALU statistical fields are used to represent the count statistics corresponding to the Microburst event and the LatencyCongestion event, and other Existing fields (such as FirstTs, LastTs, etc.) share the flow table record information (Record) memory of IPFIX.
  • the count statistic value corresponding to the target event represents the cumulative number of occurrences of the target event, which is stored in the IPFIX flow table.
  • other information and messages related to the target event can also be recorded each time the target event occurs through IPFIX.
  • the target event signal can be analyzed to determine whether the target event occurs. For the judgment of whether the target event occurs, in some embodiments, after acquiring the target event signal, the method may further include:
  • the target event signal indicates that the target event was identified.
  • a first comparator may be used for comparison and determination. setting the target event signal to the first value of the first comparator, and determining the second value of the first comparator to be 0, then comparing the first value with the second value, and if the first value is greater than the second value, Then it is determined that the target event signal indicates that the target event is recognized, that is, the target event corresponding to the target event signal occurs. Otherwise, it is determined that the target event signal indicates that the target event was not identified, ie the target event did not occur.
  • the preset threshold value represents a preset upper limit value of cumulative occurrence times of the target event, which can be set in combination with actual usage scenarios.
  • the method may further include:
  • the counting statistic value is less than a preset threshold.
  • the second comparator may compare the counting statistic value corresponding to the target event with a preset threshold to determine a magnitude relationship between the two.
  • the counting statistical value corresponding to the target event is set as the third value of the second comparator
  • the fourth value of the second comparator is set as the preset threshold
  • the third value is compared with the fourth value, If the third value is smaller than the fourth value, it is determined that the counting statistic value is less than the preset threshold; otherwise, if the third value is greater than or equal to the fourth value, it is determined that the counting statistic value is greater than or equal to the preset threshold.
  • updating the counting statistics may include:
  • the target event signal indicates that the target event is recognized and the count statistic value is less than a preset threshold, an operation of adding one to the count statistic value is performed.
  • updating the counting statistic value corresponding to the target event may be performed by adding one to the counting statistic value when the target event signal indicates that the target event is identified and the counting statistic value corresponding to the target event is less than a preset threshold. Operation means that the number of occurrences of the target event is increased by one.
  • the count statistic value corresponding to the target event is greater than or equal to the preset threshold, it means that the number of occurrences of the target event has reached the preset threshold, that is, the target event count overflows, and a report event will be generated at this time, and the event will be reported And the counting statistics are sent to the central processing unit (Central Processing Unit, CPU). Wherein, the reporting event is used to inform the central processing unit that the count overflow of the target event occurs.
  • CPU Central Processing Unit
  • the embodiment of the present application can also periodically or aperiodically read the count statistics value of the target event from the IPFIX flow table, so as to count the occurrence of the target event when the count statistics value corresponding to the target event is greater than or equal to the preset threshold Overflow is reported.
  • the method may further include:
  • the counting statistic value corresponding to the target event is cleared to recount subsequent target events.
  • the present embodiment provides a kind of event monitoring method, by obtaining target event signal; If the target event signal indicates that the target event is identified, then obtain the count statistics value corresponding to the target event from the IPFIX flow table; if the target event corresponding count statistics value If it is less than the preset threshold, update the counting statistic value, and save the updated counting statistic value in the IPFIX flow table; if the counting statistic value corresponding to the target event is greater than or equal to the preset threshold value, generate a report event, and The reporting event and the counting statistics value are sent to the central processing unit; wherein, the reporting event is used to inform the central processing unit that the counting overflow of the target event occurs.
  • the target event is counted and counted through the IPFIX flow table.
  • the chip statistics table field is fixed and not easy to expand, the monitoring and statistics of micro-burst events and delay congestion events can be flexibly realized, especially When the traffic is large, it can also realize flexible monitoring of target events and avoid occupying network bandwidth.
  • FIG. 2 shows a schematic flowchart of another event monitoring method provided in the embodiment of the present application.
  • the event monitoring method can be executed in the MMU unit, the EPE unit, and the IPFIX Engine respectively; wherein, the MMU unit mainly executes step S201, the EPE unit mainly executes steps S202-S203, and the IPFIX Engine mainly executes steps S204-S206.
  • the method can include:
  • the message may pass through the MMU unit and the EPE unit of the chip in sequence.
  • the MicroBurst event signal is recognized by the MMU unit; then the MMU unit continues to pass the message to the EPE unit of the chip, and when the message passes through the EPE unit of the chip, it is recognized by the EPE unit LatencyCongestion event signal in the packet.
  • the recognition of the MicroBurst event signal is mainly realized by the MMU unit; the recognition of the LatencyCongestion event signal is mainly realized by the EPE unit.
  • the ACL enables IPFIX.
  • the embodiment of this application enables IPFX through ACL, collects the identified MicroBurst event signal and LatencyCongestion event signal, and transmits them to IPFIX Engine.
  • IPFIX is enabled through the ACL, so that the IPFIX Engine only processes target packets that meet certain filter conditions and the MicroBurst event and/or LatencyCongestion event of the target packet.
  • IPFIX Engine is the logical unit that implements IPFIX functions, that is, all IPFIX-related processing logic can be completed within the engine.
  • step S205 is executed; if the search result is a failure, that is If it is not found, it will learn, learn a new flow, and execute the next steps according to the learning result.
  • the ALU updates the counting statistics value.
  • LatencyCongestion event signal or the Microburst event signal transmitted by the EPE is used as the input value of the ALU, and the counting statistics of the two are updated based on the IPFIX flow table.
  • step S207 executes step S207; if the judgment result is no, then end this process.
  • the counting statistic value reaches the preset threshold, the Key and Record information of the flow table can be sent to the CPU through Direct Memory Access (DMA), and the LatencyCongestion event or Microburst event in the chip can be cleared.
  • DMA Direct Memory Access
  • the counting statistics of LatencyCongestion events or Microburst events are updated through the ALU mechanism; then it is judged whether the counting statistics of LatencyCongestion events or Microburst events reach the preset threshold set by the user; if reached, The information such as the Key of the flow table and the counting statistics recorded in the Record memory are sent to the CPU through DMA, and at the same time, the counting statistics of the LatencyCongestion event or Microburst event in the chip are cleared.
  • the preset threshold you can set the preset threshold corresponding to the LatencyCongestion event as the delay threshold, and the preset threshold corresponding to the Microburst event as the microburst threshold.
  • the two values can be the same or different, and can be combined with the actual scene. Sure.
  • the counting statistics of the LatencyCongestion event reaches the corresponding delay threshold, some or all of the Key of the flow table corresponding to the LatencyCongestion event, the LatencyCongestion event information, the counting statistics, and other information recorded in the flow table will be passed through DMA. Send it to the CPU, and at the same time clear the counting statistics of the LatencyCongestion event in the chip, so that when there is a LatencyCongestion event in the subsequent message, it will be counted again.
  • FIG. 3 shows a detailed flowchart of an event monitoring method provided by an embodiment of the present application.
  • the detailed process may include:
  • S301 Receive a LatencyCongestion event signal or a Microburst event signal.
  • comparator CMPO is the first comparator in the foregoing embodiments, its right value is the first value in the foregoing embodiments, and its left value is the second value in the foregoing embodiments.
  • step S305 execute step S305; if the judgment result is no, the process ends.
  • the right value of the comparator CMP0 is greater than the left value, it means that the LatencyCongestion event signal or the Microburst event signal is valid, and the status0 in the ALU is assigned a value of 1, where status0 is the status parameter in the ALU indicating whether the event is valid , whose value is 1 means that the current LatencyCongestion event signal or Microburst event signal is valid, and the event occurs.
  • the ALU field (also referred to as ALU statistical data or ALU statistical information) Record.count represents the number of times LatencyCongestion events or Microburst events are received, that is, the count statistics value.
  • a Record.count is a 32-byte ALU field.
  • the current data stream can include the currently received LatencyCongestion event signal or Microburst event signal, that is, to read the corresponding statistical information Record of MOL or MOB in Record. count. If the LatencyCongestion event signal is received, indicating that MOL is required, read the Record.count corresponding to the LatencyCongestion event; if the Microburst event signal is received, indicating that MOB is required, read the Record.count corresponding to the Microburst event; If both target event signals are received, read the Record.count corresponding to the two target events respectively.
  • comparator CMP1 is the second comparator in the aforementioned embodiments, its left value is the third value in the aforementioned embodiments, and its right value is the fourth value in the aforementioned embodiments.
  • the preset threshold can be configured by the user according to requirements, and the preset threshold can be denoted as Thrd.
  • the preset threshold value is greater than the counting statistical value Record.
  • the state parameter whose value is greater than the left value has a value of 1, indicating that the current ALU field Record.count is less than the preset threshold.
  • step S3012 is executed.
  • an operator may be used to update the counting statistical value Record.count of the target event determined to occur.
  • the ALU statistical information Record.count enters the operator as an input parameter, and performs a self-increment operation in the operator to complete the current counting statistics of the target event. When the target event signal is triggered again, continue to execute this process.
  • step S309 the judgment result is no, then it is determined that the preset threshold is less than or equal to the current Record.count, and the event is notified to the CPU by DMA, that is, the delay congestion count overflow (LatencyCongestion Count Overflow) and /or Microburst Count Overflow (Microburst Count Overflow) is reported, and the current statistical information Record.count is also reported to facilitate user statistical analysis, and then Record.count is cleared to prepare for the next record.
  • DMA delay congestion count overflow
  • Microburst Count Overflow Microburst Count Overflow
  • the embodiment of this application uses two 32-bit ALU statistical data to share the Record memory with other existing FirstTs, LastTs and other fields, combined with the LatencyCongestion event Signals and Microburst event signals flexibly support packet statistics based on delay or micro-mutations, and flexibly realize micro-burst and delay monitoring and statistics on the premise that the chip statistics table fields are fixed and not easy to expand.
  • the microburst and delay events at the hardware level of the switching chip are flexibly realized. statistics and reporting.
  • the scheme for realizing the statistics of LatencyCongestion event and Microburst event in ALU is as above-mentioned steps S301-S3014.
  • This embodiment provides a method for event monitoring.
  • the detailed implementation of the foregoing embodiments is described in detail through the above embodiments. It can be seen from this that the event monitoring method proposed in this embodiment records Microburst events by using the IPFIX flow table.
  • the event monitoring method proposed in this embodiment records Microburst events by using the IPFIX flow table.
  • two 32Bits ALU statistics fields are used to share the Record memory with other existing FirstTs, LastTs and other fields, combined with LatencyCongestion event signals and Microburst event signals to flexibly support packet statistics based on LatencyCongestion events or Microburst events, LatencyCongestion Count Overflow and Microburst Count Overflow will be reported through the ALU mechanism to flexibly realize the monitoring and statistics functions of microburst events and delay congestion events.
  • FIG. 4 shows a schematic diagram of the composition and structure of an event monitoring device 40 provided in the embodiment of the present application.
  • the event monitoring device 40 may include an acquisition unit 401 and an IPFIX engine unit 402, wherein,
  • An acquisition unit 401 configured to acquire a target event signal
  • the IPFIX engine unit 402 is configured to, if the target event signal indicates that the target event is identified, then obtain the counting statistics corresponding to the target event from the IP data flow information output IPFIX flow table; and if the counting corresponding to the target event If the statistical value is less than a preset threshold, then the counting statistical value is updated, and the updated counting statistical value is saved in the IPFIX flow table; and if the counting statistical value corresponding to the target event is greater than or equal to the If the threshold is preset, a reporting event is generated, and the reporting event and the counting statistical value are sent to the central processing unit; wherein the reporting event is used to inform the central processing unit that the counting overflow of the target event occurs.
  • the target event includes at least: a Microburst event, and/or, a LatencyCongestion event;
  • the event monitoring device 40 may further include an MMU unit 403 and an EPE unit 404, wherein,
  • the MMU unit 403 is configured to determine the Microburst event signal when the target message passes through the memory management MMU unit of the chip, and send the target message to the export data processing engine EPE unit;
  • the EPE unit 404 is configured to obtain a LatencyCongestion event signal when the target message passes through the EPE unit of the chip;
  • the acquiring unit 401 is further configured to determine the target event signal according to the Microburst event signal and the LatencyCongestion event signal;
  • the Microburst event signal is used to indicate whether the Microburst event occurs
  • the LatencyCongestion event signal is used to indicate whether the LatencyCongestion event occurs.
  • the EPE unit 404 is also configured to enable the IPFIX function through the access control list ACL, and send the target event signal to the IPFIX engine unit;
  • the IPFIX engine unit 402 is also configured to, in the IPFIX engine unit, perform a hash search according to the message characteristics of the target message; and if the record information is found in the IPFIX engine unit, then perform the judgment described A step of whether the counting statistic value corresponding to the target event is less than a preset threshold.
  • the IPFIX engine unit 402 may be configured to set the first value of the first comparator as the target event signal, set the second value of the first comparator to 0; and set the A first value is compared to the second value; and if the first value is greater than the second value, determining that the target event signal is indicative of a target event being identified.
  • the IPFIX engine unit 402 may also be configured to set the third value of the second comparator as the counting statistical value, and set the fourth value of the second comparator as the preset threshold ; and comparing the third value with the fourth value; and if the third value is smaller than the fourth value, determining that the counting statistic value is smaller than the preset threshold.
  • the counting statistics value is obtained by using a 32-bit ALU field for statistics.
  • the IPFIX engine unit 402 may also be configured to perform an operation of adding one to the count statistic value when the target event signal indicates that the target event is identified and the count statistic value is less than a preset threshold .
  • the IPFIX engine unit 402 is further configured to clear the counting statistical value.
  • a "unit” may be a part of a circuit, a part of a processor, a part of a program or software, etc., of course it may also be a module, or it may be non-modular.
  • each component in this embodiment may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software function modules.
  • the integrated unit is implemented in the form of a software function module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of this embodiment is essentially or It is said that the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product, the computer software product is stored in a storage medium, and includes several instructions to make a computer device (which can It is a personal computer, a server, or a network device, etc.) or a processor (processor) that executes all or part of the steps of the method described in this embodiment.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read only memory (Read Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other various media that can store program codes.
  • this embodiment provides a computer storage medium, the computer storage medium stores a computer program, and when the computer program is executed by at least one processor, the event monitoring method described in any one of the preceding embodiments is implemented.
  • FIG. 5 shows a schematic diagram of an optional hardware structure of a chip 50 provided by an embodiment of the present application.
  • the chip 50 may include a processor 501, and the processor 501 may call and run a computer program from the memory, so as to implement the method described in any one of the foregoing embodiments.
  • the chip 50 may further include a memory 502 .
  • the processor 501 can invoke and run a computer program from the memory 502, so as to realize the event monitoring method described in any one of the foregoing embodiments.
  • the memory 502 may be an independent device independent of the processor 501 , or may be integrated in the processor 501 .
  • the chip 50 may also include an input interface 503 .
  • the processor 501 can control the input interface 503 to communicate with other devices or chips, and optionally, can obtain information or data sent by other devices or chips.
  • the chip 50 may also include an output interface 504 .
  • the processor 501 can control the output interface 504 to communicate with other devices or chips, and optionally, can output information or data to other devices or chips.
  • the chip 50 can be applied to the electronic device described in the foregoing embodiments, and the chip can implement the corresponding processes implemented by the electronic device in the various methods of the embodiments of the present application. For the sake of brevity, details are not repeated here.
  • the chip mentioned in the embodiment of the present application may be a baseband chip, or other system-on-chip, system-on-chip, system-on-chip, or system-on-chip, such as ASIC chips, FPGA chips, and NP chips.
  • FIG. 6 shows a schematic diagram of an optional hardware structure of an electronic device 60 provided by an embodiment of the present application.
  • the electronic device 60 may include a chip 50 configured to execute the event monitoring method described in any one of the foregoing embodiments when running a computer program.
  • the electronic device 60 may also include a transceiver 601, and the chip 50 may control the transceiver 601 to communicate with other devices, and optionally, may send information or data to other devices, or receive other Information or data sent by the device.
  • the chip 50 may control the transceiver 601 to communicate with other devices, and optionally, may send information or data to other devices, or receive other Information or data sent by the device.
  • the transceiver 601 may include a transmitter and a receiver.
  • the transceiver 601 may further include antennas, and the number of antennas may be one or more.
  • the electronic device 60 may be a device integrated with the event monitoring apparatus 40 described in any one of the foregoing embodiments.
  • the electronic device 60 may implement the corresponding processes implemented by the electronic device in the various methods of the embodiments of the present application, and for the sake of brevity, details are not repeated here.
  • This embodiment provides an electronic device that counts and counts target events through an IPFTX flow table in combination with target event signals, and can flexibly realize monitoring and statistics of micro-burst events and delay congestion events, especially when the traffic is relatively high When it is large, it can also avoid occupying network bandwidth.
  • the disclosed devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division.
  • the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms of.
  • the units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units; Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例公开了一种事件监控方法、装置、芯片和计算机存储介质，该方法包括：获取目标事件信号；若目标事件信号指示识别出目标事件，则从IPFIX流表中获取目标事件对应的计数统计值；若目标事件对应的计数统计值小于预设阈值，则对计数统计值进行更新，并将更新后的计数统计值保存到IPFIX流表中；若目标事件对应的计数统计值大于或者等于预设阈值，则生成上报事件，并将上报事件和计数统计值发送给中央处理器；其中，上报事件用于告知中央处理器目标事件出现计数溢出。这样，结合目标事件信号，通过IPFIX流表对目标事件进行计数统计，可以灵活实现微突发事件、时延拥塞事件的监控统计，尤其是在流量较大时，还能够避免占用网络带宽。

Description

一种事件监控方法、装置、芯片和计算机存储介质
本申请要求于2021年10月25日提交中国专利局、申请号为202111238715.7、发明名称“一种事件监控方法、装置、芯片和计算机存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种事件监控方法、装置、芯片和计算机存储介质。
背景技术
微突发(Microburst)是指端口短时间内收到非常多的突发数据，以至于瞬时突发速率达到平均速率的数十倍、数百倍，甚至超过端口带宽的现象。微突发会降低网络业务性能，严重时还会导致网络丢包从而延长业务完成时间。
时延是指一个报文或分组从一个网络的一端传送到另一个端所需要的时间，用户数据报文的转发过程中一路可能会经过多个交换机、路由器等转发设备，任何一个转发节点的时延过高都会最终影响到用户的网络体验。
因此，对微突发事件和时延事件的监控显得尤为重要。当前网络要求芯片能够提供硬件级的微突发和时延的监控，目前的解决方案是把微突发事件和时延事件镜像网络口，由远端服务器做可视化分析；但是这种解决方案会导致在流量较大时，占用较多网络带宽，并且会增大远端服务压力。
发明内容
本申请实施例提供了一种事件监控方法、装置、芯片和计算机存储介质，能够实现对目标事件的灵活监控，避免占用网络带宽。
本申请实施例的技术方案是这样实现的：
第一方面，本申请实施例提供了一种事件监控方法，该方法包括：
获取目标事件信号；
若所述目标事件信号指示识别出目标事件，则从网际互联协议IP数据流信息输出IPFIX流表中获取所述目标事件对应的计数统计值；
若所述目标事件对应的计数统计值小于预设阈值，则对所述计数统计值进行更新，并将更新后的计数统计值保存到所述IPFIX流表中；
若所述目标事件对应的计数统计值大于或者等于预设阈值，则生成上报事件，并将所述上报事件和所述计数统计值发送给中央处理器；其中，所述上报事件被设置为告知所述中央处理器所述目标事件出现计数溢出。
第二方面，本申请实施例提供了一种事件监控装置，该事件监控装置包括获取单元和IPFIX引擎单元，其中，
所述获取单元，配置为获取目标事件信号；
所述IPFIX引擎单元，配置为若所述目标事件信号指示识别出目标事件，则从IP数据流信息输出IPFIX流表中获取所述目标事件对应的计数统计值；以及若所述目标事件对应的计数统计值小于预设阈值，则对所述计数统计值进行更新，并将更新后的计数统计值保存到所述IPFIX流表中；以及若所述目标事件对应的计数统计值大于或者等于所述预设阈值，则生成上报事件，并将所述上报事件和所述计数统计值发送给中央处理器；其中，所述上报事件被设置为告知所述中央处理器所述目标事件出现计数溢出。
第三方面，本申请实施例提供了一种芯片，该芯片包括存储器和处理器，其中，
所述存储器，被设置为存储能够在所述处理器上运行的计算机程序；
所述处理器，被设置为在运行所述计算机程序时，执行如第一方面所述的事件监控方法。
第四方面，本申请实施例提供了一种电子设备，该电子设备包括如第二方面所述的事件监控装置或者包括如第三方面所述的芯片。
第五方面，本申请实施例提供了一种计算机存储介质，该计算机存储介质存储有计算机程序，所述计算机程序被至少一个处理器执行时实现如第一方面所述的事件监控方法。
本申请实施例所提供的一种事件监控方法、装置、芯片和计算机存储介质，通过获取目标事件信号；若目标事件信号指示识别出目标事件，则从IPFIX流表中获取目标事件对应的计数统计值；若目标事件对应的计数统计值小于预设阈值，则对计数统计值进行更新，并将更新后的计数统计值保存到IPFIX流表中；若目标事件对应的计数统计值大于或者等于预设阈值，则生成上报事件，并将上报事件和计数统计值发送给中央处理器；其中，上报事件用于告知中央处理器目标事件出现计数溢出。这样，结合目标事件信号，通过IPFIX流表对目标事件进行计数统计，在芯片统计表项字段固定、不易扩展的前提下，可以灵活实现微突发事件、时延拥塞事件的监控统计，尤其是在流量较大时，也能够实现对目标事件的灵活监控，避免占用网络带宽。
附图说明
图1为本申请实施例提供的一种事件监控方法的流程示意图；
图2为本申请实施例提供的另一种事件监控方法的流程示意图；
图3为本申请实施例提供的一种事件监控方法的详细流程示意图；
图4为本申请实施例提供的一种事件监控装置的组成结构示意图；
图5为本申请实施例提供的一种芯片的可选硬件结构示意图；
图6为本申请实施例提供的一种电子设备的可选硬件结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。可以理解的是，此处所描述的实施例仅用于解释相关申请，而非对该申请的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与有关申请相关的部分。
除非另有定义，本文所使用的所有的技术和科学术语与属于本申请实施例的技术领域的技术人员通常理解的含义相同。本文中所使用的术语只是为了描述本申请实施例的目的，不是旨在限制本申请。
在以下的描述中，涉及到“一些实施例”，其描述了所有可能实施例的子集，但是可以理解，“一些实施例”可以是所有可能实施例的相同子集或不同子集，并且可以在不冲突的情况下相互结合。
需要指出，本申请实施例所涉及的术语“第一\第二\第三”仅仅是区别类似的对象，不代表针对对象的特定排序，可以理解地，“第一\第二\第三”在允许的情况下可以互换特定的顺序或先后次序，以使这里描述的本申请实施例能够以除了在这里图示或描述的以外的顺序实施。
对本申请实施例进行详细说明之前，对本申请实施例中涉及的名词和术语进行说明，本申请实施例中涉及的名词和术语适用于如下的解释：
微突发(Microburst)：指端口短时间内收到非常多的突发数据，以至于瞬时突发速率达到平均速率的数十倍、数百倍，甚至超过端口带宽的 现象。
时延(Latency)：时延是指一个报文或分组从一个网络的一端传送到另一个端所需要的时间。
算数逻辑单元(Arithmetic Logic Unit，ALU)：ALU是能实现多组算术运算和逻辑运算的组合逻辑电路。
主动监控微突发事件并统计上报(Monitor On Buffer，MOB)：MOB专门针对微突发提供硬件丢包主动监控并上报的解决方案。
主动监控时延事件并统计上报(Monitor On Latency，MOL)：MOL对时延提供硬件丢包主动监控并上报的解决方案。
网际互联协议(Internet Protocol，IP)数据流数据输出(IP Flow Information Export，IPFIX)：是由国际互联网工程任务组(The Internet Engineering Task Force，IETF)公布的用于网络中的流信息测量的标准协议。其定义的报文格式以Cisco NetFlow Version9(思科数据流分析工具包第9版)数据输出格式作为基础，可使IP流量信息从一个输出器(Exporter)传送到收集器(Collector)。因为IPFIX是一种针对数据流特征分析、基于模板的格式输出的协议，因此具有很强的可扩展性，对于不同的需求都可以定义不同的数据格式。
IPFIX要实现对某种数据流的监控，通过配置基于该种数据流关心的特征的哈希值(Hash Key)，当报文进入芯片时会查找并匹配Key(值)，从而按照返回的值索引(Key Index)，索引这条流统计(Record)信息的AD(Action，行为)表项，例如报文数量、报文字节数、时间戳等。
Microburst是网络中的一种常见流量，其一方面会降低网络业务性能，严重时刻导致网络丢包从而延长业务完成时间，比如传输控制协议(Transmission Control Protocol，TCP)可能会触发全局同步等，MOB专门针对微突发提供硬件丢包主动监控并上报的解决方案。
对于一个用户分组业务，分组数据从用户源主机发送出来，到达目的主机或者服务器为止，这整个传输过程所消耗的时间称为网络时延。用户数据报文的转发过程中一路可能会经过多个交换机、路由器等转发设备，任何一个转发节点的时延过高都会最终影响到用户的网络体验，因此对转发设备时延的监控就显得尤为重要，MOL对时延提供硬件丢包主动监控并上报的解决方案。
当前网络要求芯片能够提供硬件级的MicroBurst和Latency事件的监控，目前的通用做法是把MicroBurst和Latency事件镜像网络口，由远端服务器做可视化分析，这样导致在流量较大时，占用网络带宽，同时增加了远端服务。
基于此，本申请实施例提供了一种事件监控方法，该方法的基本思想是：获取目标事件信号；若目标事件信号指示识别出目标事件，则从IPFIX流表中获取目标事件对应的计数统计值；若目标事件对应的计数统计值小于预设阈值，则对计数统计值进行更新，并将更新后的计数统计值保存到IPFIX流表中；若目标事件对应的计数统计值大于或者等于预设阈值，则生成上报事件，并将上报事件和计数统计值发送给中央处理器；其中，上报事件用于告知中央处理器目标事件出现计数溢出。这样，结合目标事件信号，通过IPFIX流表对目标事件进行计数统计，在芯片统计表项字段固定、不易扩展的前提下，可以灵活实现微突发事件、时延拥塞事件的监控统计，尤其是在流量较大时，也能够实现对目标事件的灵活监控，避免占用网络带宽。
下面将结合附图对本申请各实施例进行详细说明。
本申请的一实施例中，参见图1，其示出了本申请实施例提供的一种事件监控方法的流程示意图。如图1所示，该方法可以包括：
S101、获取目标事件信号。
需要说明的是，本申请实施例提供的事件监控方法可以应用于事件监 控装置，或者集成有该装置的电子设备。这里，电子设备主要是指在数据包传输过程中所经过的交换机等转发设备。另外，本申请实施例提供的事件监控方法也可以基于电子设备的芯片来实现，例如专用集成电路(Application Specific Integrated Circuit，ASIC)芯片，现场可编程逻辑门阵列(Field Programmable Gate Array，FPGA)芯片以及网络处理器(Networking Processor，NP)芯片等等，本申请实施例对此不作限定。
还需要说明的是，在本申请实施例中，目标事件信号可以包括微突发事件信号(MicroBurst事件信号)和/或时延拥塞事件信号(LatencyCongestion事件信号)。也就是说，本申请实施例所涉及的目标事件信号主要是指MicroBurst事件信号和/或LatencyCongestion事件信号；相应地，本申请实施例所涉及的目标事件主要是指MicroBurst事件和/或LatencyCongestion事件。
其中，MicroBurst事件即端口在短时间内收到非常多的突发数据，以至于瞬时突发速率达到平均速率的数十倍、数百倍，甚至超过端口带宽；LatencyCongestion事件即数据包在传输过程中的时延过长(例如传输时延超过了设定的门限值)的现象，在本申请实施例中，时延主要指数据包传输过程中在转发设备中所产生的时延，如果时延过长，就发生了LatencyCongestion事件。
还需要说明的是，在本申请实施例中，目标事件信号代表与目标事件相关的信号，通过对目标事件信号进行分析判断，确定该目标事件信号是否有效，从而可以确定目标事件是否发生，详细判断方法将在后续步骤进行详细描述。
另外，在获取目标事件信号时，如果成功获取到目标事件信号，有可能是获取到MicroBurst事件信号和LatencyCongestion事件信号中的一者，也可能两者都获取到；不论是获取到一者还是两者都获取到，对于每一个目标事件信号均可以按照本申请实施例所提供的事件监控方法进行处理。也就是说，本申请实施例可以实现对MicroBurst事件和LatencyCongestion 事件的同步监控。
可选地，在一些实施例中，目标事件至少可以包括：Microburst事件，和/或，LatencyCongestion事件；相应地，获取目标事件信号，可以包括：
当目标报文经过芯片的内存管理MMU单元时，确定Microburst事件信号，并将目标报文发送给出口数据处理引擎EPE单元；
当目标报文经过芯片的EPE单元时，获取LatencyCongestion事件信号；
根据Microburst事件信号和LatencyCongestion事件信号，确定目标事件信号；
其中，Microburst事件信号用于指示Microburst事件是否发生，LatencyCongestion事件信号用于指示LatencyCongestion事件是否发生。
需要说明的是，对于目标事件信号的获取，本申请实施例可以分别通过内存管理(Memory Management Unit，MMU)单元和出口数据处理引擎(Egress Process Engine，EPE)单元实现目标事件信号的识别获取。
详细来说，当目标报文经过芯片的MMU单元时，通过MMU单元识别Microburst事件信号，然后将目标报文传递至EPE单元；在目标报文经过EPE单元时，通过EPE单元识别LatencyCongestion事件信号；识别到的Microburst事件信号和/或LatencyCongestion事件信号即为最终获取的目标事件信号。
其中，Microburst事件信号是与Microburst事件相关的信号，可以用于指示Microburst事件是否发生，LatencyCongestion事件信号是与LatencyCongestion事件相关的信号，可以用于LatencyCongestion事件是否发生。
还需要说明的是，目前，在对事件进行监控时，通常是将事件镜像网络口，再由远端服务器做可视化分析，然而这样会在网络流量较大时，占 用网络带宽，并增大远端服务压力。
本申请实施例可以基于IPFIX实现对目标事件的监控和计数统计，因此，本申请实施例针对目标事件信号的处理以及针对目标事件的计数等功能实现均可以通过IPFIX的功能实现单元IPFIX Engine单元(IPFIX引擎单元，简称IPFIX Engine，IPFIX引擎)来实现。
可选地，由于在实际网络通信过程中，会存在大量处于传输过程中的报文等，如果对每一个报文都基于IPFIX进行监控处理，则会占据较多的硬件资源，如果数据量过大，会导致硬件压力大，有必要对需要基于IPFIX进行监控处理的报文进行初步筛选。
因此，在一些实施例中，该方法还可以包括：通过访问控制列表ACL使能IPFIX功能，将目标事件发送给IPFIX引擎单元；
在IPFIX引擎单元中，根据目标报文的报文特征进行哈希查找；
若在IPFIX引擎单元中查找到记录信息，则执行判断目标事件对应的计数统计值是否小于预设阈值的步骤。
需要说明的是，访问控制列表(Access Control Lists，ACL)是一种基于包过滤的访问控制技术，它可以根据设定的条件对接口上的数据包(如报文)进行过滤。这样，通过ACL使能IPFIX功能，可以只对满足一定筛选条件的目标报文的目标事件信号进行后续处理，而对于不满足筛选条件的报文，即使能够从中识别到目标事件信号，也会将其过滤掉，不会进行后续的处理。
还需要说明的是，对于筛选条件，可以包括仅对从特定的一个或者多个端口传输的报文进行后续处理，或者对报文进行特征匹配后，仅对匹配成功的报文进行后续处理。
还需要说明的是，通过ACL使能IPFIX功能，并将目标事件信号发送给IPFIX引擎单元后，可以通过IPFIX引擎单元对目标报文进行特征提 取，然后根据报文特征进行哈希查找。详细来说，可以根据报文特征进行哈希值计算，然后以哈希值为索引读取IPFIX引擎存储空间，如果查找到记录信息，则执行判断目标事件对应的计数统计值是否小于预设阈值的步骤；如果没有查找到记录信息，则先针对该目标报文进行学习，将其下发至IPFIX引擎存储空间，再继续执行后续步骤。
S102、若目标事件信号指示识别出目标事件，则从IPFIX流表中获取目标事件对应的计数统计值。
需要说明的是，在获取目标事件信号之后，首先根据目标事件信号判断是否识别出目标事件，即确定目标事件是否发生，在确定目标事件发生时，从IPFIX流表中获取目标事件对应的计数统计值。
在一些实施例中，计数统计值用32位的ALU字段进行统计得到的。
需要说明的是，在本申请实施例中，通过使用IPFIX流表来记录目标事件，分别利用两个32字节(Bits)的ALU统计字段表示Microburst事件和LatencyCongestion事件对应的计数统计值，与其他现有字段(如FirstTs、LastTs等)共享IPFIX的流表记录信息(Record)内存。
其中，目标事件对应的计数统计值表示目标事件的累积发生次数，其在IPFIX流表中进行保存。另外，还可以通过IPFIX将每次发生目标事件时，与目标事件有关的其它信息以及报文等信息进行记录。
还需要说明的是，在获取目标事件信号之后，对目标事件信号进行分析，可以确定目标事件是否发生。对于目标事件是否发生的判断，在一些实施例中，在获取目标事件信号之后，该方法还可以包括：
将第一比较器的第一值设置为目标事件信号，将第一比较器的第二值设置为0；
将第一值和第二值进行比较；
若第一值大于第二值，则确定目标事件信号指示识别出目标事件。
需要说明的是，在确定目标事件信号是否发生时，本申请实施例可以通过第一比较器进行比较确定。将目标事件信号设置为第一比较器的第一值，并将第一比较器的第二值确定为0，然后将第一值和第二值进行比较，如果第一值大于第二值，则确定目标事件信号指示识别出目标事件，即目标事件信号对应的目标事件发生。否则，确定目标事件信号指示未识别出目标事件，即未发生目标事件。
S103、若目标事件对应的计数统计值小于预设阈值，则对计数统计值进行更新，并将更新后的计数统计值保存到IPFIX流表中。
需要说明的是，如果目标事件信号指示识别出目标事件，而且还同时满足目标事件对应的计数统计值小于预设阈值，则对目标事件对应的计数统计值进行更新，并将更新后的计数统计值保存在IPFIX流表中。其中，预设阈值表示预设的目标事件累积发生次数的上限值，可以结合实际使用场景进行设置。
可选的，对于计数统计值和预设阈值的大小关系，在一些实施例中，在从IPFIX流表中获取目标事件对应的计数统计值之后，该方法还可以包括：
将第二比较器的第三值设置为计数统计值，将第二比较器的第四值设置为预设阈值；
将第三值和第四值进行比较；
若第三值小于第四值，则确定计数统计值小于预设阈值。
需要说明的是，本申请实施例可以通过第二比较器将目标事件对应的计数统计值和预设阈值进行比较，以确定两者的大小关系。详细来说，将目标事件对应的计数统计值设置为第二比较器的第三值，并将第二比较器的第四值设置为预设阈值，将第三值和第四值进行比较，如果第三值小于第四值，则确定计数统计值小于预设阈值；否则，如果第三值大于或者等于第四值，则确定计数统计值大于或者等于预设阈值。
可选地，在一些实施例中，对计数统计值进行更新，可以包括：
在目标事件信号指示识别出目标事件且计数统计值小于预设阈值的情况下，对计数统计值执行加一操作。
需要说明的是，对目标事件对应的计数统计值进行更新可以是在目标事件信号指示识别出目标事件，且目标事件对应的计数统计值小于预设阈值的情况下，对计数统计值执行加一操作，即表示该目标事件的发生次数加一。
S104、若目标事件对应的计数统计值大于或者等于预设阈值，则生成上报事件，并将上报事件和计数统计值发送给中央处理器。
需要说明的是，如果目标事件对应的计数统计值大于或者等于预设阈值，则说明目标事件的发生次数达到预设阈值，即目标事件出现计数溢出，此时就生成上报事件，并将上报事件和计数统计值发生给中央处理器(Central Processing Unit，CPU)。其中，上报事件用于告知中央处理器目标事件出现计数溢出。
还需要说明的是，在将上报事件和计数统计值发生给CPU时，还可以将目标事件的相关信息以及Record内存中所记录的信息都上报CPU，以便进行统计分析。
另外，本申请实施例还可以周期或者非周期性的从IPFIX流表中读取目标事件的计数统计值，以在目标事件对应的计数统计值大于或者等于预设阈值时，将目标事件发生计数溢出进行上报。
在一些实施例中，在将上报事件和计数统计值发送给中央处理器之后，该方法还可以包括：
对计数统计值进行清零处理。
需要说明的是，在进行事件上报之后，就将目标事件对应的计数统计值清零，以对后续发生的目标事件重新进行计数。
本实施例提供了一种事件监控方法，通过获取目标事件信号；若目标事件信号指示识别出目标事件，则从IPFIX流表中获取目标事件对应的计数统计值；若目标事件对应的计数统计值小于预设阈值，则对计数统计值进行更新，并将更新后的计数统计值保存到IPFIX流表中；若目标事件对应的计数统计值大于或者等于预设阈值，则生成上报事件，并将上报事件和计数统计值发送给中央处理器；其中，上报事件用于告知中央处理器目标事件出现计数溢出。这样，结合目标事件信号，通过IPFIX流表对目标事件进行计数统计，在芯片统计表项字段固定、不易扩展的前提下，可以灵活实现微突发事件、时延拥塞事件的监控统计，尤其是在流量较大时，也能够实现对目标事件的灵活监控，避免占用网络带宽。
本申请的另一实施例中，参见图2，其示出了本申请实施例提供的另一种事件监控方法的流程示意图。如图2所示，该事件监控方法可以分别在MMU单元、EPE单元以及IPFIX Engine执行；其中，MMU单元主要执行步骤S201，EPE单元主要执行步骤S202～S203，IPFIX Engine主要执行步骤S204～S206。该方法可以包括：
S201、报文经过芯片的MMU单元时，识别MicroBurst事件信号，并传递到EPE单元。
S202、报文经过芯片的EPE单元时，识别LatencyCongestion事件信号。
需要说明的是，在报文的传递过程中，报文可以依次经过芯片的MMU单元和EPE单元。详细来说，在报文经过芯片的MMU单元时，通过MMU单元识别MicroBurst事件信号；然后MMU单元继续将报文传递至芯片的EPE单元，在报文经过芯片的EPE单元时，通过EPE单元识别报文中的LatencyCongestion事件信号。
也就是说，在本申请实施例中，MicroBurst事件信号的识别主要通过 MMU单元实现；LatencyCongestion事件信号的识别主要通过EPE单元实现。
S203、ACL使能IPFIX。
需要说明的是，本申请实施例通过ACL使能IPFX，并将识别到的MicroBurst事件信号以及LatencyCongestion事件信号收集起来，传递到IPFIX Engine。这样，通过ACL使能IPFIX，使得IPFIX Engine仅处理满足一定筛选条件的目标报文和目标报文的MicroBurst事件和/或LatencyCongestion事件。
S204、进行哈希查找。
需要说明的是，IPFIX Engine是实现IPFIX功能的逻辑单元，即IPFIX相关处理逻辑均可以在该引擎内完成。
MicroBurst事件信号和LatencyCongestion事件信号被传递到IPFIX Engine后，在IPFIX Engine中，通过报文特征进行哈希查找，确定查找结果，如果查找结果为成功，就执行步骤S205；如果查找结果为失败，即没有查找到，则进行学习，学习一条新的流，并根据学习结果执行后续步骤。
S205、ALU更新计数统计值。
需要说明的是，将EPE传递过来的LatencyCongestion事件信号或Microburst事件信号作为ALU的输入值，基于IPFIX流表更新二者的计数统计值。
S206、判断计数统计值是否达到预设阈值。
需要说明的是，对流表Record内存中的LatencyCongestion事件或Microburst事件的计数统计值进行判断，确定其是否达到用户设定的预设阈值。
还需要说明的是，如果判断结果为是，那么执行步骤S207；如果判 断结果为否，那么结束本流程。
S207、将Record信息通过DMA上报CPU。
需要说明的是，如果计数统计值达到预设阈值，那么可以将流表的Key和Record信息，通过直接存储器访问(Direct Memory Access，DMA)发送给CPU，并清空芯片中LatencyCongestion事件或Microburst事件的计数统计值。
还需要说明的是，在IPFIX Engine中，通过ALU机制对LatencyCongestion事件或Microburst事件的计数统计进行更新；然后判断LatencyCongestion事件或Microburst事件的计数统计是否达到用户所设定的预设阈值；如果达到，就将流表的Key和Record内存中所记录的计数统计值等信息，通过DMA发送给CPU，同时清空芯片中LatencyCongestion事件或Microburst事件的计数统计值。
另外，对于预设阈值，可以分别设置LatencyCongestion事件对应的预设阈值为时延阈值，Microburst事件对应的预设阈值为微突变阈值，两者的值可以相同也可以不同，可以结合实际应该场景进行确定。
例如，LatencyCongestion事件的计数统计达到了对应的时延阈值，则将LatencyCongestion事件对应的流表的Key、LatencyCongestion事件信息、计数统计值以及流表中所记录的其它信息等中的部分或全部通过DMA发送给CPU，同时将芯片中关于LatencyCongestion事件的计数统计清空，以在后续报文中存在LatencyCongestion事件时，对其重新进行计数统计。同时，Microburst事件的计数统计并未达到对应的微突变阈值，则无需进行上报，继续对Microburst事件进行累积统计，直到计数统计达到微突变阈值，则进行上报并清空Microburst事件的计数统计，并在后续报文中存在Microburst事件时，重新进行计数统计。
可选地，对于步骤S205～S207来说，其实现过程可以参见图3，其示出了本申请实施例提供的一种事件监控方法的详细流程示意图。如图3所 示，该详细流程可以包括：
S301、接收LatencyCongestion事件信号或Microburst事件信号。
S302、将LatencyCongestion事件信号或Microburst事件信号作为比较器CMP0的右值。
S303、将比较器CMP0的左值赋值为0。
需要说明的是，比较器CMP0即前述实施例中的第一比较器，其右值即前述实施例中的第一值，左值即前述实施例中的第二值。
S304、判断比较器CMP0的右值是否大于左值。
如果判断结果为是，则执行步骤S305；如果判断结果为否，则结束流程。
S305、将ALU中的status0赋值为1。
需要说明的是，如果比较器CMP0的右值大于左值，说明该LatencyCongestion事件信号或Microburst事件信号有效，则对ALU中的status0赋值为1，其中，status0为ALU中表示事件是否有效的状态参数，其值为1表示当前LatencyCongestion事件信号或Microburst事件信号有效，事件发生。
S306、读取当前数据流对应的ALU字段Record.count。
需要说明的是，本申请实施例利用ALU字段(也称作ALU统计数据或ALU统计信息)Record.count代表接收到LatencyCongestion事件或Microburst事件的次数，即计数统计值。一个Record.count为一个32个字节的ALU字段。
还需要说明的是，对于LatencyCongestion事件和Microburst事件分别对应有一个Record.count，用于分别实现对LatencyCongestion事件和Microburst事件的计数统计。
这里，读取的是与当前数据流对应的ALU字段Record.count，当前数据流可以包括当前接收到的LatencyCongestion事件信号或Microburst事件信号，即读取MOL或MOB在Record中对应的统计信息Record.count。如果接收到的是LatencyCongestion事件信号，说明需要进行MOL，就读取LatencyCongestion事件对应的Record.count；如果接收到的是Microburst事件信号，说明需要进行MOB，就读取Microburst事件对应的Record.count；如果两个目标事件信号都接收到了，则分别读取两个目标事件各自对应的Record.count。
S307、将比较器CMP1的左值赋值为Record.count。
S308、将比较器CMP1的右值赋值为预设阈值。
需要说明的是，比较器CMP1即前述实施者中的第二比较器，其左值即前述实施例中的第三值，右值即前述实施例中的第四值。
预设阈值可以由用户根据需求进行配置，预设阈值可以记作Thrd。
S309、判断比较器CMP1的右值是否大于左值。
若判断结果为是，在执行步骤S110；若判断结果为否，则执行步骤S113。
S3010、将ALU中的status1赋值为1。
需要说明的是，如果比较器CMP1的右值大于左值，即预设阈值大于计数统计值Record.count，则将ALU中的status1赋值为1，其中，status1为ALU中表示比较器CMP1的右值大于左值的状态参数，其值为1，表示当前ALU字段Record.count小于预设阈值。
当S305和S3010同时成立，即当ALU中的status0值为1且ALU中的status1值也为1时，执行步骤S3012。
S3011、将当前Record.count作为运算器的输入值。
S3012、在运算器中做自加1操作。
需要说明的是，本申请实施例可以通过运算器(Operator)对确定发生的目标事件的计数统计值Record.count进行更新。详细来说，ALU统计信息Record.count作为输入参数进入运算器，并在运算器Operator中做自加1操作，完成对目标事件的本次计数统计，在再次触发目标事件信号时，继续执行本流程。
S3013、通过DMA上报Record信息。
S3014、芯片将Record.count清零，准备下一次记录。
需要说明的是，如果在步骤S309中，判断结果为否，则确定预设阈值小于或者等于当前的Record.count，通过DMA将该事件通知CPU，即将时延拥塞计数溢出(LatencyCongestion Count Overflow)和/或微突发计数溢出(Microburst Count Overflow)进行上报，同时还上报当前的统计信息Record.count，便于用户统计分析，然后将Record.count清零，准备下一次记录。
综上所述，本申请实施例为了实现硬件级的微突发与时延的统计，通过利用2个32比特的ALU统计数据，与其他现有FirstTs、LastTs等字段共享Record内存，结合LatencyCongestion事件信号、Microburst事件信号，灵活支持基于时延或者微突变的报文统计信息，在芯片统计表项字段固定、不易扩展的前提下，灵活实现微突发和时延监控及统计。
该方法的详细实现过程前述步骤S201～S207。
本申请实施例在IPFIX引擎中，结合芯片传递的LatencyCongestion事件信号、Microburst事件信号，并利用ALU，以及与Record中其他字段内存共享的方法，灵活实现交换芯片硬件级的微突发和时延事件的统计和上报。
其中，ALU中实现LatencyCongestion事件和Microburst事件统计的 方案如前述步骤S301～S3014。
本实施例提供了一种事件监控方法，通过上述实施例对前述实施例的详细实现进行了详细阐述，从中可以看出，本实施例提出的事件监控方法，通过使用IPFIX流表来记录Microburst事件和LatencyCongestion的事件，利用2个32Bits的ALU统计字段，与其他现有FirstTs、LastTs等字段共享Record内存，结合LatencyCongestion事件信号、Microburst事件信号灵活支持基于LatencyCongestion事件或者Microburst事件的报文统计信息，LatencyCongestion Count Overflow和Microburst Count Overflow将通过ALU机制进行上报，灵活实现微突发事件和时延拥塞事件的监控和统计的功能。
本申请的再一实施例中，参见图4，其示出了本申请实施例提供的一种事件监控装置40的组成结构示意图。如图4所示，该事件监控装置40可以包括获取单元401和IPFIX引擎单元402，其中，
获取单元401，配置为获取目标事件信号；
IPFIX引擎单元402，配置为若所述目标事件信号指示识别出目标事件，则从IP数据流信息输出IPFIX流表中获取所述目标事件对应的计数统计值；以及若所述目标事件对应的计数统计值小于预设阈值，则对所述计数统计值进行更新，并将更新后的计数统计值保存到所述IPFIX流表中；以及若所述目标事件对应的计数统计值大于或者等于所述预设阈值，则生成上报事件，并将所述上报事件和所述计数统计值发送给中央处理器；其中，所述上报事件用于告知所述中央处理器所述目标事件出现计数溢出。
在一些实施例中，所述目标事件至少包括：微突发Microburst事件，和/或，时延拥塞LatencyCongestion事件；
相应地，参见图4，该事件监控装置40还可以包括MMU单元403和EPE单元404，其中，
MMU单元403，配置为当目标报文经过芯片的内存管理MMU单元 时，确定Microburst事件信号，并将所述目标报文发送给出口数据处理引擎EPE单元；
EPE单元404，配置为当所述目标报文经过芯片的EPE单元时，获取LatencyCongestion事件信号；
获取单元401，还配置为根据所述Microburst事件信号和所述LatencyCongestion事件信号，确定所述目标事件信号；
其中，所述Microburst事件信号用于指示所述Microburst事件是否发生，所述LatencyCongestion事件信号用于指示所述LatencyCongestion事件是否发生。
在一些实施例中，EPE单元404，还配置为通过访问控制列表ACL使能IPFIX功能，将所述目标事件信号发送给IPFIX引擎单元；
IPFIX引擎单元402，还配置为在所述IPFIX引擎单元中，根据所述目标报文的报文特征进行哈希查找；以及若在所述IPFIX引擎单元中查找到记录信息，则执行判断所述目标事件对应的计数统计值是否小于预设阈值的步骤。
在一些实施例中，IPFIX引擎单元402，可以配置为将第一比较器的第一值设置为所述目标事件信号，将所述第一比较器的第二值设置为0；以及将所述第一值和所述第二值进行比较；以及若所述第一值大于所述第二值，则确定所述目标事件信号指示识别出目标事件。
在一些实施例中，IPFIX引擎单元402，还可以配置为将第二比较器的第三值设置为所述计数统计值，将所述第二比较器的第四值设置为所述预设阈值；以及将所述第三值和所述第四值进行比较；以及若所述第三值小于所述第四值，则确定所述计数统计值小于所述预设阈值。
在一些实施例中，所述计数统计值用32位的ALU字段进行统计得到的。
在一些实施例中，IPFIX引擎单元402，还可以配置为在所述目标事件信号指示识别出目标事件且所述计数统计值小于预设阈值的情况下，对所述计数统计值执行加一操作。
在一些实施例中，IPFIX引擎单元402，还配置为对所述计数统计值进行清零处理。
可以理解地，在本实施例中，“单元”可以是部分电路、部分处理器、部分程序或软件等等，当然也可以是模块，还可以是非模块化的。而且在本实施例中的各组成部分可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
所述集成的单元如果以软件功能模块的形式实现并非作为独立的产品进行销售或使用时，可以存储在一个计算机可读取存储介质中，基于这样的理解，本实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或processor(处理器)执行本实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
因此，本实施例提供了一种计算机存储介质，该计算机存储介质存储有计算机程序，所述计算机程序被至少一个处理器执行时实现前述实施例中任一项所述事件监控方法。
基于上述的一种事件监控装置40的组成以及计算机存储介质，参见图5，其示出了本申请实施例提供的一种芯片50的可选硬件结构示意图。如图5所示，芯片50可以包括处理器501，处理器501可以从存储器中调 用并运行计算机程序，以实现前述实施例中任一项所述的方法。
可选地，如图5所示，芯片50还可以包括存储器502。其中，处理器501可以从存储器502中调用并运行计算机程序，以实现前述实施例中任一项所述的事件监控方法。
其中，存储器502可以是独立于处理器501的一个单独的器件，也可以集成在处理器501中。
可选地，该芯片50还可以包括输入接口503。其中，处理器501可以控制该输入接口503与其他设备或芯片进行通信，可选地，可以获取其他设备或芯片发送的信息或数据。
可选地，该芯片50还可以包括输出接口504。其中，处理器501可以控制该输出接口504与其他设备或芯片进行通信，可选地，可以向其他设备或芯片输出信息或数据。
可选地，该芯片50可应用于前述实施例所述的电子设备，并且该芯片可以实现本申请实施例的各个方法中由电子设备实现的相应流程，为了简洁，在此不再赘述。
示例性的，本申请实施例提到的芯片可以是基带芯片，也可以是其它系统级芯片、系统芯片、芯片系统或片上系统芯片等，例如ASIC芯片、FPGA芯片以及NP芯片等等。
基于上述芯片50的组成以及计算机存储介质，参见图6，其示出了本申请实施例提供的一种电子设备60的可选硬件结构示意图。如图6所示，该电子设备60可以包括芯片50，被设置为在运行计算机程序时，执行前述实施例中任一项所述的事件监控方法。
可选地，如图6所示，电子设备60还可以包括收发器601，芯片50可以控制该收发器601与其他设备进行通信，可选地，可以向其他设备发送信息或数据，或接收其他设备发送的信息或数据。
其中，收发器601可以包括发射机和接收机。收发器601还可以包括天线，天线的数量可以为一个或多个。
可选地，电子设备60可以为集成有前述实施例中任一项所述的事件监控装置40的设备。这里，并且电子设备60可以实现本申请实施例的各个方法中由电子设备实现的相应流程，为了简洁，在此不再赘述。
本实施例提供了一种电子设备，该电子设备结合目标事件信号，通过IPFTX流表对目标事件进行计数统计，可以灵活实现微突发事件、时延拥塞事件的监控统计，尤其是在流量较大时，还能够避免占用网络带宽。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元，即可以位于一个地方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
还需要说明的是，在本申请中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个......”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
本申请所提供的几个方法实施例中所揭露的方法，在不冲突的情况下可以任意组合，得到新的方法实施例。
本申请所提供的几个产品实施例中所揭露的特征，在不冲突的情况下可以任意组合，得到新的产品实施例。
本申请所提供的几个方法或设备实施例中所揭露的特征，在不冲突的情况下可以任意组合，得到新的方法实施例或设备实施例。
以上所述，仅为本申请的可选实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (11)

  1. 一种事件监控方法，所述方法包括：
    获取目标事件信号；
    若所述目标事件信号指示识别出目标事件，则从IP数据流信息输出IPFIX流表中获取所述目标事件对应的计数统计值；
    若所述目标事件对应的计数统计值小于预设阈值，则对所述计数统计值进行更新，并将更新后的计数统计值保存到所述IPFIX流表中；
    若所述目标事件对应的计数统计值大于或者等于所述预设阈值，则生成上报事件，并将所述上报事件和所述计数统计值发送给中央处理器；其中，所述上报事件用于告知所述中央处理器所述目标事件出现计数溢出。
  2. 根据权利要求1所述的方法，其中，所述目标事件至少包括：微突发Microburst事件，和/或，时延拥塞LatencyCongestion事件；相应地，
    所述获取目标事件信号，包括：
    当目标报文经过芯片的内存管理MMU单元时，确定Microburst事件信号，并将所述目标报文发送给出口数据处理引擎EPE单元；
    当所述目标报文经过芯片的EPE单元时，获取LatencyCongestion事件信号；
    根据所述Microburst事件信号和所述LatencyCongestion事件信号，确定所述目标事件信号；
    其中，所述Microburst事件信号用于指示所述Microburst事件是否发生，所述LatencyCongestion事件信号用于指示所述LatencyCongestion事件是否发生。
  3. 根据权利要求2所述的方法，其中，所述方法还包括：
    通过访问控制列表ACL使能IPFIX功能，将所述目标事件信号发送给IPFIX引擎单元；
    在所述IPFIX引擎单元中，根据所述目标报文的报文特征进行哈希查找；
    若在所述IPFIX引擎单元中查找到记录信息，则执行判断所述目标事件对应的计数统计值是否小于预设阈值的步骤。
  4. 根据权利要求1所述的方法，其中，在所述获取目标事件信号之后，所述方法还包括：
    将第一比较器的第一值设置为所述目标事件信号，将所述第一比较器的第二值设置为0；
    将所述第一值和所述第二值进行比较；
    若所述第一值大于所述第二值，则确定所述目标事件信号指示识别出目标事件。
  5. 根据权利要求1所述的方法，其中，在所述从IPFIX流表中获取所述目标事件对应的计数统计值之后，所述方法还包括：
    将第二比较器的第三值设置为所述计数统计值，将所述第二比较器的第四值设置为所述预设阈值；
    将所述第三值和所述第四值进行比较；
    若所述第三值小于所述第四值，则确定所述计数统计值小于所述预设阈值。
  6. 根据权利要求1所述的方法，其中，所述计数统计值用32位的算数逻辑单元ALU字段进行统计得到的。
  7. 根据权利要求1至6任一项所述的方法，其中，所述对所述计数统计值进行更新，包括：
    在所述目标事件信号指示识别出目标事件且所述计数统计值小于预设阈值的情况下，对所述计数统计值执行加一操作。
  8. 根据权利要求1至6任一项所述的方法，其中，在所述将所述上报事件和所述计数统计值发送给中央处理器之后，所述方法还包括：
    对所述计数统计值进行清零处理。
  9. 一种事件监控装置，所述事件监控装置包括获取单元和IPFIX引擎单元，其中，
    所述获取单元，配置为获取目标事件信号；
    所述IPFIX引擎单元，配置为若所述目标事件信号指示识别出目标事件，则从IP数据流信息输出IPFIX流表中获取所述目标事件对应的计数统计值；以及若所述目标事件对应的计数统计值小于预设阈值，则对所述计数统计值进行更新，并将更新后的计数统计值保存到所述IPFIX流表中；以及若所述目标事件对应的计数统计值大于或者等于所述预设阈值，则生成上报事件，并将所述上报事件和所述计数统计值发送给中央处理器；其中，所述上报事件被设置为告知所述中央处理器所述目标事件出现计数溢出。
  10. 一种芯片，所述芯片包括存储器和处理器，其中，
    所述存储器，被设置为存储能够在所述处理器上运行的计算机程序；
    所述处理器，被设置为在运行所述计算机程序时，执行如权利要求1至8任一项所述的事件监控方法。
  11. 一种计算机存储介质，所述计算机存储介质存储有计算机程序，所述计算机程序被至少一个处理器执行时实现如权利要求1至8任一项所述的事件监控方法。
PCT/CN2022/127406 2021-10-25 2022-10-25 一种事件监控方法、装置、芯片和计算机存储介质 WO2023072082A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111238715.7A CN116032721A (zh) 2021-10-25 2021-10-25 一种事件监控方法、装置、芯片和计算机存储介质
CN202111238715.7 2021-10-25

Publications (1)

Publication Number Publication Date
WO2023072082A1 true WO2023072082A1 (zh) 2023-05-04

Family

ID=86089830

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/127406 WO2023072082A1 (zh) 2021-10-25 2022-10-25 一种事件监控方法、装置、芯片和计算机存储介质

Country Status (2)

Country Link
CN (1) CN116032721A (zh)
WO (1) WO2023072082A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100031273A1 (en) * 2006-10-26 2010-02-04 France Telecom method of supervising a plurality of units in a communications network
US20140215077A1 (en) * 2013-01-26 2014-07-31 Lyatiss, Inc. Methods and systems for detecting, locating and remediating a congested resource or flow in a virtual infrastructure
US20190387426A1 (en) * 2016-11-29 2019-12-19 Sk Telecom Co., Ltd. Method for providing streaming service and apparatus therefor
CN111435921A (zh) * 2019-01-15 2020-07-21 华为技术有限公司 配置监控事件的方法、通信装置和通信系统
CN112543149A (zh) * 2020-11-23 2021-03-23 盛科网络（苏州）有限公司 防止ipfix消息丢失的方法及其应用、asic芯片

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104521197B (zh) * 2013-06-28 2017-10-17 华为技术有限公司 拥塞信息反馈方法及装置、网关
CN104378263A (zh) * 2014-11-27 2015-02-25 盛科网络（苏州）有限公司 基于tcp会话的网络流量监测方法、装置及报文处理芯片
CN107566220B (zh) * 2017-10-17 2021-04-16 盛科网络（苏州）有限公司 一种基于流量实现ipfix探测的方法及装置
CN111970211A (zh) * 2020-08-13 2020-11-20 苏州盛科科技有限公司 一种基于ipfix的大象流处理方法及装置
CN112260899B (zh) * 2020-10-20 2022-08-26 苏州盛科通信股份有限公司 基于mmu的网络监测方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100031273A1 (en) * 2006-10-26 2010-02-04 France Telecom method of supervising a plurality of units in a communications network
US20140215077A1 (en) * 2013-01-26 2014-07-31 Lyatiss, Inc. Methods and systems for detecting, locating and remediating a congested resource or flow in a virtual infrastructure
US20190387426A1 (en) * 2016-11-29 2019-12-19 Sk Telecom Co., Ltd. Method for providing streaming service and apparatus therefor
CN111435921A (zh) * 2019-01-15 2020-07-21 华为技术有限公司 配置监控事件的方法、通信装置和通信系统
CN112543149A (zh) * 2020-11-23 2021-03-23 盛科网络（苏州）有限公司 防止ipfix消息丢失的方法及其应用、asic芯片

Also Published As

Publication number Publication date
CN116032721A (zh) 2023-04-28

Similar Documents

Publication Publication Date Title
US11032205B2 (en) Flow control method and switching device
US9577906B2 (en) Scalable performance monitoring using dynamic flow sampling
US20190013954A1 (en) Elastic timestamping
US10757033B2 (en) Traffic control method, traffic control apparatus and server
US8184553B2 (en) Method and apparatus for measuring packet transmission quality
CN110971445B (zh) 一种网络的oam方法及装置
US10924374B2 (en) Telemetry event aggregation
US10785164B2 (en) Preventing duplication of packets in a network
EP3082293B1 (en) Switching device and packet loss method therefor
EP3979577B1 (en) Queue congestion control method, device and storage medium
CN106921665B (zh) 一种报文处理方法及网络设备
JP2023514790A (ja) ネットワーク性能検出方法及び機器、並びにネットワーク装置
WO2022105691A1 (zh) 防止ipfix消息丢失的方法及其应用、asic芯片
EP3491784B1 (en) Estimation of losses in a video stream
CN111756641A (zh) 一种发送设备的调整方法和通信装置
WO2023072082A1 (zh) 一种事件监控方法、装置、芯片和计算机存储介质
WO2017091313A1 (en) Setting a lifetime limit of a data packet to minimize congestion and contention
US20070253446A1 (en) Method of reducing buffer usage by detecting missing fragments and idle links for multilink protocols and devices incorporating same
CN112565821B (zh) 数据处理方法、装置、安全网关及存储设备
CN113453024B (zh) 监控业务的方法、装置和系统
US9203718B2 (en) Frame loss measurement device, communication device, communication system and performance measurement method
JP2015170878A (ja) ネットワーク内の複数データ通信装置を管理する運用管理装置
CN114006872B (zh) 数据包的传输方法、装置、电子设备及可读存储介质
WO2024027577A1 (zh) 数据特征分析方法、装置及网络设备
JP2006033713A (ja) 通信装置及び通信帯域制御方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22885959

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22885959

Country of ref document: EP

Kind code of ref document: A1