CN103078766A - Network flow rate audit method, device and network equipment - Google Patents
Network flow rate audit method, device and network equipment Download PDFInfo
- Publication number
- CN103078766A CN103078766A CN2012105910004A CN201210591000A CN103078766A CN 103078766 A CN103078766 A CN 103078766A CN 2012105910004 A CN2012105910004 A CN 2012105910004A CN 201210591000 A CN201210591000 A CN 201210591000A CN 103078766 A CN103078766 A CN 103078766A
- Authority
- CN
- China
- Prior art keywords
- audit
- period
- network flow
- auditing
- flow information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000012550 audit Methods 0.000 title claims abstract description 159
- 238000000034 method Methods 0.000 title claims abstract description 36
- 238000003860 storage Methods 0.000 claims abstract description 135
- 238000005070 sampling Methods 0.000 description 14
- 238000010586 diagram Methods 0.000 description 11
- 238000012545 processing Methods 0.000 description 11
- 238000004590 computer program Methods 0.000 description 7
- 230000006870 function Effects 0.000 description 7
- 230000008569 process Effects 0.000 description 7
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 1
- 230000003247 decreasing effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 238000011144 upstream manufacturing Methods 0.000 description 1
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a network flow rate audit method, a network flow rate audit device and network equipment. According to the method, in the current preset audit period, according to the size of the pre-determined storage space required for storing the network flow rate information of each audit object, under the condition that the judgment result shows that the obtained vacant storage space is greater than or equal to the sum of the storage spaces required by the network flow rate information of each determined audit object, the network flow rate information generated by each audit object in a last audit period is sequentially counted, and in addition, the network flow rate information obtained after the counting is stored; and the judgment can be carried out according to the condition of the vacant storage space in the storage space before the network flow rate audit, and whether the sufficient storage space exists or not for storing the network flow rate information obtained through the audit can be judged, so the network audit flow rate information loss problem in the prior art can be avoided.
Description
Technical Field
The present invention relates to the field of network communication technologies, and in particular, to a method and an apparatus for auditing network traffic, and a network device.
Background
With the rapid development of networks, the network scale is also larger and larger, and applications and services carried in the networks are also more and more diversified. In the face of a network which is becoming more complex, a maintainer usually wants to know the traffic conditions of the services and the services carried in the network, the traffic conditions of the intranet users and the traffic conditions thereof, and accordingly know the operation conditions of the network to determine whether the network bandwidth is sufficient and whether the allocation of the network bandwidth is reasonable. When network abnormity occurs, enough basis can be provided for positioning and problem solving. As network traffic auditing has become an indispensable function for network devices.
Network traffic auditing can be generally divided into real-time network traffic auditing and historical network traffic auditing. The real-time network flow audit represents the current flow condition of the network, and maintainers can judge the current network operation condition and track and position network faults according to the current flow condition of the network; historical network traffic auditing represents network traffic conditions and network traffic trends in the past, and is generally used for analyzing causes of network failures after the fact. Two kinds of network flow auditing have different application occasions, and have different responsibilities in network operation condition and fault location, which are usually necessary for network equipment.
Historical network traffic auditing is typically performed in the prior art by two methods.
The method comprises the following steps: firstly, setting the length of a sampling period, such as 10 minutes, then sampling the data traffic generated by various audit objects (such as various services, various users, user groups and the like) forwarded by equipment in each period, generating traffic audit records for the dimensions, and storing and writing the traffic audit records into a database. Assuming that historical traffic information of each user in the intranet needs to be audited, information records of periodic sampling are shown in table 1, wherein the information records include uplink traffic and downlink traffic of the users 1 to 3 in two sampling periods respectively.
TABLE 1
| User name | Upstream flow (byte) | Downstream flow (byte) | Time of day |
| User 1 | 100113 | 2340234 | 2012-8-3014:10:00~2012-8-3014:20:00 |
| User 2 | 230543 | 323023 | 2012-8-3014:10:00~2012-8-3014:20:00 |
| User 3 | 3232 | 432045024 | 2012-8-3014:10:00~2012-8-3014:20:00 |
| User 1 | 234242 | 242424254 | 2012-8-3014:20:00~2012-8-3014:30:00 |
| User 2 | 324563 | 423023 | 2012-8-3014:20:00~2012-8-3014:30:00 |
| User 3 | 32322 | 23045024 | 2012-8-3014:20:00~2012-8-3014:30:00 |
In actual implementation, maintenance personnel can add and delete field information to be audited, such as the number of uplink packets and the number of downlink packets, according to actual conditions. According to the obtained audit information, maintenance personnel can know the average flow rate of each user in each period and also can know the accumulated flow condition of each user in a specified time range. However, in this method, because the sampling period is fixed, in general, the number of users in the network and the number of services carried by the network may change with the change of the network, and if the amount of information that needs to be audited and recorded in the same period is too much, which results in exceeding the auditing performance of the device, the loss of network traffic auditing information may occur, and finally, the information provided by the network traffic auditing becomes unreliable, and finally, the network traffic auditing loses practical significance.
And secondly, automatically adjusting the sampling period according to the performance of the network equipment on the basis of the first method, wherein the adjustment mode is to compare the processing time with a preset sampling period, if the processing time is longer than the preset sampling period, the sampling period is increased, otherwise, the sampling period is decreased, so that the network equipment can audit with the sampling period corresponding to the actual data flow, and the problem of loss of audit information of the network flow is avoided. However, the method adjusts the duration of the sampling period of the next period according to the processing duration of the previous sampling period, belongs to post adjustment, has a certain hysteresis, and may cause loss of the traffic audit information in some cases.
Therefore, a technical scheme capable of effectively solving the problem of network flow audit information loss is lacked in the prior art.
Disclosure of Invention
In view of this, embodiments of the present invention provide an auditing method and apparatus for network traffic, and a network device, so as to solve the problem in the prior art that auditing information for network traffic is lost during a network auditing process.
The technical scheme of the embodiment of the invention is as follows:
a method for auditing network traffic, comprising: in the current preset auditing period, judging whether the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each auditing object according to the size of the storage space required by the network flow information of each auditing object which is predetermined; under the condition that the obtained free storage space is larger than or equal to the sum of the storage spaces required by the determined network flow information of each audit object, sequentially counting the network flow information generated by each audit object in the last audit period, and storing the network flow information obtained by counting; and under the condition that the obtained free storage space is smaller than the sum of the storage spaces required by the network flow information of each determined auditing object, waiting for a preset waiting period, sequentially counting the network flow information generated by each auditing object in the last auditing period and the waiting period and storing the counted network flow information under the condition that the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each determined auditing object after the preset waiting period is up.
An auditing apparatus for network traffic, comprising: the determining module is used for determining the size of a storage space required for storing the network flow information of each audit object in advance; the judging module is used for judging whether the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each audit object determined by the determining module according to the size of the storage space required by the network flow information of each audit object determined by the determining module in the current preset audit period; the auditing module is used for sequentially counting the network flow information generated by each auditing object in the last auditing period under the condition that the judging module judges that the obtained free storage space is more than or equal to the sum of the determined storage spaces required by the network flow information of each auditing object; waiting for a preset waiting period under the condition that the judgment module judges that the obtained free storage space is smaller than the sum of the storage spaces required by the network flow information of each determined auditing object, and sequentially counting the network flow information generated by each auditing object in the last auditing period under the condition that the preset waiting period is up and the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each determined auditing object; and the storage module is used for storing the network flow information counted by the auditing module.
A network device comprising an auditing apparatus for network traffic as described above.
In the technical scheme of the embodiment of the invention, in the current preset audit period, whether the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each audit object is judged according to the size of the storage space required by the network flow information of each audit object, and under the condition that the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each audit object, the network flow information generated by each audit object in the last audit period is counted in sequence and the network flow information obtained by counting is stored; under the condition that the obtained free storage space is smaller than the sum of the storage spaces required by the network flow information of each determined auditing object, waiting for a preset waiting period, sequentially counting the network flow information generated by each auditing object in the last auditing period and the waiting period under the condition that the preset waiting period is up and the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each determined auditing object, and storing the counted network flow information; before network flow audit, whether enough storage space exists at present to store network flow information obtained by audit can be judged according to the condition of free storage space in the storage space, so that the loss of the network audit flow information in the prior art can be avoided.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
Fig. 1 is a flowchart of a method for auditing network traffic according to an embodiment of the present invention;
fig. 2 is a block diagram of an auditing apparatus for network traffic according to an embodiment of the present invention;
fig. 3 is a block diagram of a preferred configuration of the apparatus shown in fig. 2.
Detailed Description
The embodiments of the present invention will be described in conjunction with the accompanying drawings, and it should be understood that the embodiments described herein are only for the purpose of illustrating and explaining the present invention, and are not intended to limit the present invention.
Aiming at the problem that audit information of network flow is lost in the network audit process in the prior art, the embodiment of the invention provides an audit method and device of network flow and network equipment, so as to solve the problem.
Fig. 1 shows an auditing method of network traffic provided by an embodiment of the present invention, including:
the operation of predetermining the size of a storage space required for storing the network traffic information of each audit object specifically includes: acquiring the size information of a storage space required by network flow information which is allocated for each audit object in advance and stores the primary statistics; or, respectively determining the mean value of the sum of the storage space occupied by the network traffic information of each audit object in a plurality of audit periods before the current audit period;
preferably, the free storage space is a free storage space in the cache; the free storage space may also be a storage space in a database, but the data obtained through statistics is directly stored in the database, and since an operation of creating a data index of the written data is usually performed in parallel when the data is written in the database, which affects the efficiency of storage operation, the embodiment of the present invention preferably stores the data in a cache;
the audit object can comprise an audit interface, business and/or a user;
102, when the obtained free storage space (S) is judged to be larger than or equal to the sum (N) of the storage spaces required by the network traffic information of each determined audit object (namely S is larger than or equal to N), sequentially counting the last audit period (T) of each audit objectn－1) Internally generated network flow information (or called audit information) and storing the network flow information obtained by statistics; preferably, the network flow information obtained by statistics is stored in a cache;
103, waiting for a preset waiting period (U) under the condition that the obtained free storage space is smaller than the sum of the storage spaces required by the network traffic information of each determined auditing object (namely S is smaller than N), sequentially counting the network traffic information generated by each auditing object in the last auditing period and the waiting period and storing the counted network traffic information under the condition that the obtained free storage space is larger than or equal to the sum of the storage spaces required by the network traffic information of each determined auditing object (namely S is larger than or equal to N) after the preset waiting period is up, and preferably storing the counted network traffic information into a cache;
specifically, if the free storage space is still smaller than the sum of the storage spaces required by the determined network traffic information of each audit object after waiting for a waiting period to expire, continuing to wait for at least one waiting period until the free storage space is greater than or equal to the sum of the storage spaces required by the determined network traffic information of each audit object.
Specifically, the processing of the network traffic information generated by the auditing object in the last auditing period includes: and according to the starting time of the last statistical operation and the starting time of the current statistical operation, counting the network flow information generated by the auditing object in the last auditing period, or counting the network flow information generated by the auditing object in the last auditing period and the waiting period, namely counting the network flow information generated by the auditing object between the starting time of the last statistical operation and the starting time of the current statistical operation.
The time length of the predetermined audit period and the time length of the predetermined waiting period are determined according to a specific application scene, and in the subsequent method optimization process, the time lengths of the audit period and the waiting period can be adjusted according to specific implementation conditions and effects to obtain ideal time length values of the audit period and the waiting period;
the network traffic information generated by the audit object includes network traffic information of the audit interface, network traffic information of the service, and/or network traffic information of the user, which may include but is not limited to: identification of the audit object, sampling time in each audit period, uplink traffic, downlink traffic, forwarding traffic and/or drop traffic. And when the uplink flow or the downlink flow of each audit object is specifically counted, accumulating the length of the uplink message generated by the audit object in the last audit period or accumulating the length of the generated downlink message. Similarly, the handling of forwarding traffic and dropping traffic is similar.
And after the counted network traffic information is stored in the cache, subtracting the storage space occupied by the stored network traffic information of the auditing object from the number of the idle storage spaces in the cache to obtain the size of the idle storage space of the next auditing period. In the subsequent process, after the network flow information in the cache is imported into the audit report in the database, the storage space in the cache is released.
Through the processing process, before network flow audit, whether enough storage space is available at present to store network flow information obtained by audit can be judged according to the condition of free storage space in the storage space, network flow information generated by an audit object is counted and stored under the condition of having enough storage space, the period of counting operation is dynamically adjusted under the condition of not having enough storage space (namely, a preset waiting period is waited on the basis of the current audit period), and the network flow information generated by the audit object is counted and stored until enough storage space is available, so that the loss of the network audit flow information in the prior art can be avoided.
After the network flow information of the audit object is counted and stored, the network flow information stored in the cache is exported to generate an audit report, and the audit report is stored in a more stable database system. In particular, according to the audit period (T)n) With a predetermined report generation period (V)n) And storing the network flow information obtained by statistics into the audit report of the report generation period corresponding to the current audit period according to the corresponding relation. Report generation period (V)n) The time length may be determined according to actual needs, for example, 1 hour, 1 day, 1 week, or 1 month, and the time length may also be adjusted according to specific implementation conditions and effects, and an audit report is generated in each report generation period. For example, the audit period is 10 minutes, the report generation period is 1 day (i.e. 1440 minutes), then one report generation period corresponds to 144 audit periods, and each audit object stored in the cache is to be cached each timeWhen the network traffic information is stored in the database, the network traffic information can be stored according to a preset storage period, for example, the network traffic information is stored once in 10 minutes, and then the network traffic information counted in 144 audit periods corresponding to 1 day time is stored in the audit report of the day in the database.
In the process of importing (or writing) network traffic information into an audit report in a database, an index is usually created for data written into the database in order to improve the performance of data query, but if a data index is created while data is written, the performance of the written data is sharply reduced, and particularly when the data volume is large, the performance of the written data is more remarkably reduced; the network traffic information targeted by the embodiment of the invention has higher requirement on writing instantaneity, and if the performance of writing data is obviously reduced, the network traffic information to be written into the database can be lost due to blockage caused by excessive data to be written.
For this problem, in the embodiment of the present invention, after a report generation period is finished, a data index table of network traffic information in an audit report in the report generation period is generated. Therefore, the data index can be prevented from being created while the network flow information is led into the audit report in the database every time, and the performance of saving the audit report can be obviously improved. Specifically, under the condition that the current report generation period is judged to be the beginning of a new period, a data index table is created for the network traffic information in the audit report in the previous report generation period, an audit report of the current report generation period is created in a database, the network traffic information which is counted in the audit period corresponding to the current report generation period and stored in the cache is sequentially imported into the audit report during the current report generation period, and the corresponding storage space in the cache is released.
Furthermore, the embodiment of the present invention further generates a graph of the network traffic information of each audit object in the saved audit report, and independently saves the graph (which may be independently saved in the database or independently saved in the network device performing the audit), so as to directly read and display the graph of the audit object when querying the network traffic information of the audit object, thereby avoiding the problems of increased processing burden on the database and influence on query performance caused by directly querying and reading the network traffic information of the audit object from the database and performing summarization. Preferably, the graph of the network traffic information of the audit object can be generated when the network device is idle.
Based on the same inventive concept, the embodiment of the invention also provides an auditing device of network flow.
Fig. 2 shows a block diagram of an auditing apparatus for network traffic provided by an embodiment of the present invention, where the apparatus includes:
a determining module 20, configured to determine in advance the size of a storage space required for storing the network traffic information of each audit object;
specifically, the determining module 20 obtains the storage space size information required for storing the network traffic information of the primary statistics, which is allocated to each audit object in advance; or, respectively determining the mean value of the sum of the storage space occupied by the network traffic information of each audit object in a plurality of audit periods before the current audit period;
a judging module 21, connected to the determining module 20, configured to judge, in a current predetermined audit period, whether an idle storage space is greater than or equal to a sum of storage spaces required by the network traffic information of each audit object determined by the determining module 20, according to a size of the storage space required by the network traffic information of each audit object determined by the determining module 20;
the auditing module 22 is connected to the judging module 21 and is used for sequentially counting the network traffic information generated by each auditing object in the last auditing period under the condition that the judging module 21 judges that the obtained free storage space is greater than or equal to the sum of the determined storage spaces required by the network traffic information of each auditing object; when the judging module 21 judges that the obtained free storage space is smaller than the sum of the storage spaces required by the determined network traffic information of each audit object, waiting for a preset waiting period, and sequentially counting the network traffic information generated by each audit object in the last audit period under the condition that the preset waiting period is up and the free storage space is larger than or equal to the sum of the storage spaces required by the determined network traffic information of each audit object;
specifically, the auditing module 22 counts the network traffic information generated by the auditing object in the previous auditing period according to the starting time of the previous statistical operation and the starting time of the current statistical operation, or counts the network traffic information generated by the auditing object in the previous auditing period and the waiting period;
and the storage module 23 is connected to the auditing module 22 and is used for storing the network flow information counted by the auditing module 22.
The function of the apparatus shown in fig. 2 is similar to that of the method shown in fig. 1 and will not be described again.
Through the device shown in fig. 2, before network traffic auditing is performed, whether enough storage space exists to store network traffic information obtained through auditing currently can be judged according to the condition of free storage space in the storage space, so that loss of network auditing traffic information in the prior art can be avoided.
Preferably, as shown in fig. 3, on the basis of the apparatus shown in fig. 2, the apparatus for auditing network traffic provided in the embodiment of the present invention may further include: an index generation module 24 and a chart generation module 25;
further, the storage module 23 is further configured to store the network traffic information obtained through statistics into the audit report of the report generation period corresponding to the current audit period according to the corresponding relationship between the audit period and the predetermined report generation period
The index generation module 24 is connected to the storage module 23, and is configured to generate a data index table of network traffic information in the audit report in a report generation period after the report generation period is finished;
and the chart generating module 25 is connected to the storage module 23, and is configured to generate a chart of the network traffic information of each audit object in the audit report stored in the storage module 23, and store the chart.
The function of the device shown in fig. 3 is as described above and will not be described in detail here.
Based on the same inventive concept, the embodiment of the present invention further provides a network device, which includes the apparatus shown in fig. 2 or fig. 3, and preferably, the network device may be a router, a switch, or a gateway device.
In summary, in the technical solution of the embodiment of the present invention, in a current predetermined audit period, according to the size of a predetermined storage space required for storing network traffic information of each audit object, it is determined whether an idle storage space is greater than or equal to the sum of the determined storage spaces required for the network traffic information of each audit object, and under the condition that the idle storage space is greater than or equal to the sum of the determined storage spaces required for the network traffic information of each audit object, network traffic information generated by each audit object in the previous audit period is sequentially counted, and the counted network traffic information is stored; under the condition that the obtained free storage space is smaller than the sum of the storage spaces required by the network flow information of each determined auditing object, waiting for a preset waiting period, sequentially counting the network flow information generated by each auditing object in the last auditing period and the waiting period under the condition that the preset waiting period is up and the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each determined auditing object, and storing the counted network flow information; before network flow audit, whether enough storage space exists at present to store network flow information obtained by audit can be judged according to the condition of free storage space in the storage space, so that the loss of the network audit flow information in the prior art can be avoided.
It will be understood by those skilled in the art that all or part of the steps carried by the method for implementing the above embodiments may be implemented by hardware related to instructions of a program, which may be stored in a computer readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.
In addition, each functional unit in the embodiments of the present invention may be integrated into one processing module, or each unit may exist alone physically, or two or more units are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The integrated module, if implemented in the form of a software functional module and sold or used as a stand-alone product, may also be stored in a computer readable storage medium.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present invention without departing from the spirit and scope of the invention. Thus, if such modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.
Claims (13)
1. A method for auditing network traffic, comprising:
in the current preset auditing period, judging whether the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each auditing object according to the size of the storage space required by the network flow information of each auditing object which is predetermined;
under the condition that the obtained free storage space is larger than or equal to the sum of the storage spaces required by the determined network flow information of each audit object, sequentially counting the network flow information generated by each audit object in the last audit period, and storing the network flow information obtained by counting;
and under the condition that the obtained free storage space is smaller than the sum of the storage spaces required by the network flow information of each determined auditing object, waiting for a preset waiting period, sequentially counting the network flow information generated by each auditing object in the last auditing period and the waiting period and storing the counted network flow information under the condition that the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each determined auditing object after the preset waiting period is up.
2. The method according to claim 1, wherein the predetermining a size of a storage space required for storing the network traffic information of each audit object specifically comprises:
acquiring the size information of a storage space required by network flow information which is allocated for each audit object in advance and stores the primary statistics; or,
and respectively determining the mean value of the sum of the storage spaces occupied by the network traffic information of each audit object in a plurality of audit periods before the current audit period.
3. The method of claim 1, wherein counting network traffic information generated by the audit object during a previous audit period specifically comprises: according to the initial time of the last statistical operation and the initial time of the current statistical operation, network flow information generated by an audit object in the last audit period is counted;
the method for counting the network flow information generated by the auditing object in the last auditing period and the waiting period specifically comprises the following steps: and according to the initial time of the last statistical operation and the initial time of the current statistical operation, counting the network flow information generated by the auditing object in the last auditing period and the waiting period.
4. The method according to claim 1, wherein storing the statistically obtained network traffic information specifically comprises:
and storing the network flow information obtained by statistics into the audit report of the report generation period corresponding to the current audit period according to the corresponding relation between the audit period and the preset report generation period.
5. The method of claim 4, further comprising:
and after one report generation period is finished, generating a data index table of the network traffic information in the audit report in the report generation period.
6. The method of claim 4, further comprising:
and generating a chart of the network flow information of each audit object in the audit report, and storing the chart.
7. An auditing apparatus for network traffic, comprising:
the determining module is used for determining the size of a storage space required for storing the network flow information of each audit object in advance;
the judging module is used for judging whether the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each audit object determined by the determining module according to the size of the storage space required by the network flow information of each audit object determined by the determining module in the current preset audit period;
the auditing module is used for sequentially counting the network flow information generated by each auditing object in the last auditing period under the condition that the judging module judges that the obtained free storage space is more than or equal to the sum of the determined storage spaces required by the network flow information of each auditing object; waiting for a preset waiting period under the condition that the judgment module judges that the obtained free storage space is smaller than the sum of the storage spaces required by the network flow information of each determined auditing object, and sequentially counting the network flow information generated by each auditing object in the last auditing period under the condition that the preset waiting period is up and the free storage space is larger than or equal to the sum of the storage spaces required by the network flow information of each determined auditing object;
and the storage module is used for storing the network flow information counted by the auditing module.
8. The apparatus of claim 7, wherein the determining module is specifically configured to:
acquiring the size information of a storage space required by network flow information which is allocated for each audit object in advance and stores the primary statistics; or,
and respectively determining the mean value of the sum of the storage spaces occupied by the network traffic information of each audit object in a plurality of audit periods before the current audit period.
9. The apparatus of claim 7, wherein the audit module is specifically configured to:
and according to the initial time of the last statistical operation and the initial time of the current statistical operation, counting the network flow information generated by the auditing object in the last auditing period, or counting the network flow information generated by the auditing object in the last auditing period and the waiting period.
10. The apparatus of claim 7, wherein the storage module is specifically configured to:
and storing the network flow information obtained by statistics into the audit report of the report generation period corresponding to the current audit period according to the corresponding relation between the audit period and the preset report generation period.
11. The apparatus of claim 10, further comprising:
and the index generation module is used for generating a data index table of the network traffic information in the audit report in the report generation period after one report generation period is finished.
12. The method of claim 10, wherein the apparatus further comprises:
and the chart generating module is used for generating a chart of the network flow information of each audit object in the audit report stored by the storage module and storing the chart.
13. A network device comprising an apparatus as claimed in any one of claims 7 to 12.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210591000.4A CN103078766B (en) | 2012-12-31 | 2012-12-31 | The auditing method of network traffics, device and the network equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210591000.4A CN103078766B (en) | 2012-12-31 | 2012-12-31 | The auditing method of network traffics, device and the network equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103078766A true CN103078766A (en) | 2013-05-01 |
| CN103078766B CN103078766B (en) | 2015-11-25 |
Family
ID=48155176
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210591000.4A Active CN103078766B (en) | 2012-12-31 | 2012-12-31 | The auditing method of network traffics, device and the network equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103078766B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105978706A (en) * | 2016-04-14 | 2016-09-28 | 丽水市睿鼎知识产权咨询有限公司 | Network traffic linkage auditing equipment and method |
| CN110991880A (en) * | 2019-12-03 | 2020-04-10 | 任杉元 | Household power auditing system and method based on big data |
| CN112671922A (en) * | 2020-12-29 | 2021-04-16 | 北京明朝万达科技股份有限公司 | Industrial internet data processing system and method |
| CN115766582A (en) * | 2022-11-14 | 2023-03-07 | 阿里巴巴（中国）有限公司 | Flow control method, device and system, medium and computer equipment |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020120815A1 (en) * | 2001-02-26 | 2002-08-29 | William Zahavi | Methods and apparatus for accessing trace data |
| US20060217923A1 (en) * | 2005-03-23 | 2006-09-28 | Xiaoxue Ma | Policy-based approach for managing the export of network flow statistical data |
| US7346929B1 (en) * | 1999-07-29 | 2008-03-18 | International Business Machines Corporation | Method and apparatus for auditing network security |
| CN102143071A (en) * | 2011-03-09 | 2011-08-03 | 中兴通讯股份有限公司 | Method and device for determining network flow as well as network equipment |
| CN102752774A (en) * | 2012-07-06 | 2012-10-24 | 大唐移动通信设备有限公司 | Non-real-time service flow monitoring time setting method and system |
-
2012
- 2012-12-31 CN CN201210591000.4A patent/CN103078766B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7346929B1 (en) * | 1999-07-29 | 2008-03-18 | International Business Machines Corporation | Method and apparatus for auditing network security |
| US20020120815A1 (en) * | 2001-02-26 | 2002-08-29 | William Zahavi | Methods and apparatus for accessing trace data |
| US20060217923A1 (en) * | 2005-03-23 | 2006-09-28 | Xiaoxue Ma | Policy-based approach for managing the export of network flow statistical data |
| CN102143071A (en) * | 2011-03-09 | 2011-08-03 | 中兴通讯股份有限公司 | Method and device for determining network flow as well as network equipment |
| CN102752774A (en) * | 2012-07-06 | 2012-10-24 | 大唐移动通信设备有限公司 | Non-real-time service flow monitoring time setting method and system |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105978706A (en) * | 2016-04-14 | 2016-09-28 | 丽水市睿鼎知识产权咨询有限公司 | Network traffic linkage auditing equipment and method |
| CN110991880A (en) * | 2019-12-03 | 2020-04-10 | 任杉元 | Household power auditing system and method based on big data |
| CN110991880B (en) * | 2019-12-03 | 2020-12-01 | 乐清市风杰电子科技有限公司 | Household power audit system and method based on big data |
| CN112381362A (en) * | 2019-12-03 | 2021-02-19 | 任杉元 | Household power auditing method based on big data |
| CN112381362B (en) * | 2019-12-03 | 2024-11-08 | 国网黑龙江省电力有限公司大兴安岭供电公司 | Household electricity audit method based on big data |
| CN112671922A (en) * | 2020-12-29 | 2021-04-16 | 北京明朝万达科技股份有限公司 | Industrial internet data processing system and method |
| CN115766582A (en) * | 2022-11-14 | 2023-03-07 | 阿里巴巴（中国）有限公司 | Flow control method, device and system, medium and computer equipment |
| CN115766582B (en) * | 2022-11-14 | 2025-06-17 | 阿里巴巴（中国）有限公司 | Flow control method, device and system, medium and computer equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103078766B (en) | 2015-11-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108512720B (en) | Website traffic statistical method and device | |
| CN106470163B (en) | Information processing method, device and system | |
| CN103078766A (en) | Network flow rate audit method, device and network equipment | |
| CN106202280B (en) | Information processing method and server | |
| CN110888774B (en) | HBASE-based big data report processing method and device | |
| CN107169700A (en) | A kind of household electrical appliances fault statistics method and device | |
| CN113079062B (en) | Resource adjusting method and device, computer equipment and storage medium | |
| CN104883705B (en) | A kind of the problem of data service is complained localization method and device | |
| CN102404760A (en) | Method and device for measuring system performance in real time | |
| CN108363649A (en) | A kind of method and device of distribution statistical log visit capacity | |
| CN111078651A (en) | Method and device for counting usage amount of object storage | |
| CN112131267B (en) | Count processing method, device, server and count processing system | |
| CN104410962A (en) | A terminal user network traffic monitoring method and device | |
| CN107515807B (en) | Method and device for storing monitoring data | |
| US8442947B2 (en) | Management of performance data | |
| CN102323898A (en) | Cache calling method and system | |
| CN105848127B (en) | A method and device for accurate replenishment | |
| CN112651685B (en) | Automatic bin supplementing method and system for value-added tax electronic invoice | |
| CN101610172A (en) | A kind of mthods, systems and devices of reporting attack logs | |
| CN104052778A (en) | Distributed phone bill statistical method, device thereof and system thereof | |
| CN112751722B (en) | Data transmission quality monitoring method and system | |
| CN110855574B (en) | Statistical method and device for realizing data stream discarding type based on hardware | |
| CN109063081A (en) | A kind of NFS business monitoring method, device, equipment and readable storage medium storing program for executing | |
| CN101674594A (en) | DNS-based mobile data service monitoring system and method | |
| CN114546649A (en) | System and method for processing power data file |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |