Disclosure of Invention
The application provides a file management method, a device and processing equipment, which aim at rollback operation in file management, can effectively avoid disk fragmentation and disk IO occupation caused by the original file deletion mode based on deleted marks and covered writing operation, can effectively solve the problem of disk performance reduction caused by rollback operation in the original network flow evidence obtaining scene, and has better practicability.
In a first aspect, the present application provides a file management method, including:
detecting whether a target file on a disk meets a file rollback condition;
When the file rollback condition is met, configuring a deleted mark for the target file under the condition that the target file is not deleted, wherein the deleted mark is used for marking that the target file is in a state that the file is deleted;
when triggering to generate a new file with the target file, locating the target file, removing the deleted mark configured by the target file, and performing overlay write operation on the target file.
With reference to the first aspect of the present application, in a first possible implementation manner of the first aspect of the present application, when a file rollback condition is satisfied, the method further includes:
Moving the target file into a deleted file directory, and updating a target index of the target file in an index directory, wherein the index directory comprises indexes of a plurality of files configured with deleted marks;
Positioning the target file, removing the deleted mark configured by the target piece, and performing overlay write operation on the target file, wherein the method comprises the following steps:
And positioning the target flow packet file through the target index recorded in the index directory, removing the target flow packet file from the deleted file directory, removing the deleted mark configured by the target file, removing the target index of the target file in the index directory, and performing overlay write operation on the target file.
With reference to the first possible implementation manner of the first aspect of the present application, in a second possible implementation manner of the first aspect of the present application, file sizes of different files on the disk are configured to be the same fixed file size in advance.
With reference to the second possible implementation manner of the first aspect of the present application, in a third possible implementation manner of the first aspect of the present application, before detecting whether the target file on the disk meets the file rollback condition, the method further includes:
In the initial stage, formatting operation is carried out on the disk, different files are generated according to the fixed file size, the different files are stored in a deleted file catalog, the different files are configured with deleted marks, and corresponding indexes are distributed for the different files in an index catalog for subsequent work;
Different files are stored and new files are generated by adopting a first-in first-out queue mechanism.
With reference to the third possible implementation manner of the first aspect of the present application, in a fourth possible implementation manner of the first aspect of the present application, detecting whether a target file on a disk meets a file rollback condition includes:
Detecting whether any file does not exist in the deleted file directory;
if yes, determining that the target file meets the file rollback condition.
With reference to the first aspect of the present application, in a fifth possible implementation manner of the first aspect of the present application, in a case where the target file is not deleted, configuring the deleted flag for the target file includes:
In the case of an undeleted target file, configuring a deleted flag for the target file, and removing the contribution of the file size of the target file to the used storage space size of the disk in the description information of the used storage space size of the disk.
With reference to the first aspect of the present application, in a sixth possible implementation manner of the first aspect of the present application, the method is specifically applied to a traffic packet file management work in a network traffic evidence obtaining scenario.
In a second aspect, the present application provides a file management apparatus, the apparatus comprising:
the condition detection unit is used for detecting whether the target file on the disk meets the file rollback condition;
A deletion configuration unit configured to configure a deleted flag for the target file in a case where the target file is not deleted when the file rollback condition is satisfied, wherein the deleted flag is used to flag that the target file is in a state where the file has been deleted;
and the writing operation unit is used for positioning the target file, removing the deleted mark configured by the target file and performing overlay writing operation on the target file when triggering to generate a new file by the target file.
With reference to the second aspect of the present application, in a first possible implementation manner of the second aspect of the present application, the deleting configuration unit is further configured to:
Moving the target file into a deleted file directory, and updating a target index of the target file in an index directory, wherein the index directory comprises indexes of a plurality of files configured with deleted marks;
a write operation unit, specifically for:
And positioning the target flow packet file through the target index recorded in the index directory, removing the target flow packet file from the deleted file directory, removing the deleted mark configured by the target file, removing the target index of the target file in the index directory, and performing overlay write operation on the target file.
With reference to the first possible implementation manner of the second aspect of the present application, in a second possible implementation manner of the second aspect of the present application, file sizes of different files on the disk are configured to be the same fixed file size in advance.
With reference to the second possible implementation manner of the second aspect of the present application, in a third possible implementation manner of the second aspect of the present application, the apparatus further includes an initial configuration unit, configured to:
In the initial stage, formatting operation is carried out on the disk, different files are generated according to the fixed file size, the different files are stored in a deleted file catalog, the different files are configured with deleted marks, and corresponding indexes are distributed for the different files in an index catalog for subsequent work;
Different files are stored and new files are generated by adopting a first-in first-out queue mechanism.
With reference to the third possible implementation manner of the second aspect of the present application, in a fourth possible implementation manner of the second aspect of the present application, the condition detecting unit is specifically configured to:
Detecting whether any file does not exist in the deleted file directory;
if yes, determining that the target file meets the file rollback condition.
With reference to the second aspect of the present application, in a fifth possible implementation manner of the second aspect of the present application, the deleting configuration unit is specifically configured to:
In the case of an undeleted target file, configuring a deleted flag for the target file, and removing the contribution of the file size of the target file to the used storage space size of the disk in the description information of the used storage space size of the disk.
With reference to the second aspect of the present application, in a sixth possible implementation manner of the second aspect of the present application, the apparatus is specifically applied to a traffic packet file management work in a network traffic evidence obtaining scenario.
In a third aspect, the present application provides a processing device comprising a processor and a memory in which a computer program is stored, the processor executing the method of the first aspect of the present application or any one of the possible implementations of the first aspect of the present application when calling the computer program in the memory.
In a fourth aspect, the present application provides a computer readable storage medium having stored thereon a plurality of instructions adapted to be loaded by a processor to perform the method of the first aspect of the present application or any of the possible implementations of the first aspect of the present application.
From the above, the present application has the following advantages:
For the rollback operation in file management, the method and the device detect whether the target file on the disk meets the file rollback condition, and when the file rollback condition is met, the deleted mark is configured for the target file under the condition that the target file is not deleted, wherein the deleted mark is used for marking that the target file is in a state that the file is deleted, subsequently, when the target file is triggered to generate a new file, the target file is positioned, the deleted mark configured for the target file is removed, and the target file is subjected to the overlay write operation.
Detailed Description
The following description of the embodiments of the present application will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present application, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to fall within the scope of the application.
The terms first, second and the like in the description and in the claims and in the above-described figures, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments described herein may be implemented in other sequences than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or modules is not necessarily limited to those steps or modules that are expressly listed or inherent to such process, method, article, or apparatus. The naming or numbering of the steps in the present application does not mean that the steps in the method flow must be executed according to the time/logic sequence indicated by the naming or numbering, and the execution sequence of the steps in the flow that are named or numbered may be changed according to the technical purpose to be achieved, so long as the same or similar technical effects can be achieved.
The division of the modules in the present application is a logical division, and may be implemented in another manner in practical applications, for example, a plurality of modules may be combined or integrated in another system, or some features may be omitted or not implemented, and further, coupling or direct coupling or communication connection between the modules shown or discussed may be through some interfaces, and indirect coupling or communication connection between the modules may be electrical or other similar manners, which are not limited in the present application. The modules or sub-modules described as separate components may be physically separated or not, or may be distributed in a plurality of circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.
Before describing the file management method provided by the application, the background content related to the application is first described.
The file management method, the file management device and the computer readable storage medium provided by the application can be applied to processing equipment, can effectively avoid the conditions of disk fragmentation and disk IO occupation which are accompanied by the original file deletion mode based on deleted marks and covered writing operation aiming at rollback operation in file management, can effectively solve the problem of disk performance reduction caused by rollback operation in the original network flow evidence obtaining scene, and has better practicability.
In the file management method according to the present application, the execution subject may be a file management device, or a server, a physical host, or a User Equipment (UE) that incorporates the file management device. The file management device may be implemented in a hardware or software manner, and the UE may specifically be a terminal device such as a smart phone, a tablet computer, a notebook computer, a desktop computer, or a Personal digital assistant (Personal DIGITAL ASSISTANT, PDA), where the processing device may be set in a device cluster manner.
It should be understood that, the problem of performance degradation of the disk caused by rollback operation in the original network traffic evidence obtaining scenario is mainly solved by the present application, and correspondingly, the processing device executing the present application may be a network traffic evidence obtaining device (or may be referred to as a network traffic backtracking device, a network traffic backtracking evidence obtaining device, or the like) that bears or is responsible for providing network traffic evidence obtaining service (or may be referred to as backtracking or backtracking evidence obtaining device) in the network architecture, or other devices that provide file management service for the network traffic evidence obtaining device in the network architecture.
Under the condition, the scheme of the application can be particularly applied to the traffic packet storage file management work under the network traffic evidence obtaining scene.
Meanwhile, considering that the file rollback operation to be improved specifically in the application is not only suitable for the original network flow evidence obtaining scene, but also can be applied to other application scenes related to the file rollback operation, so that the processing equipment for executing the scheme of the application can also be any equipment in other application scenes, and correspondingly, the scheme of the application can also be specifically applied to any file management work related to the file rollback operation.
For convenience of explanation, in the following description process of the specific scheme, the present application is exemplified by a flow packet file in a conference network flow evidence obtaining scene.
Next, the file management method provided by the present application will be described.
First, referring to fig. 1, fig. 1 shows a flow chart of a file management method according to the present application, and the file management method provided by the present application specifically includes steps S101 to S103 as follows:
step S101, detecting whether a target file on a disk meets a file rollback condition;
It will be appreciated that the present application may initiate a corresponding file rollback operation with granularity of a file, which means that the solution of the present application may substantially involve a plurality of files that may be involved in a file rollback operation in a file management job, where the present application targets a single file (for convenience of explanation, the currently targeted file is denoted as a target file) to determine whether the corresponding file rollback operation needs to be triggered.
Correspondingly, the method and the device require that the file rollback condition is pre-configured so that the device can judge whether the file rollback operation is met, if the file rollback condition is not met, the device can easily understand that the file rollback operation is not required to be initiated on the current target file, otherwise, if the file rollback condition is met, the file rollback operation is required to be initiated on the current target file, and particularly, the subsequent step S102 can be triggered to process.
It is easy to understand that, regarding the file rollback condition, it is flexible to configure specific condition contents related to whether a fixed time point is reached, whether a waiting duration reaches a time interval, whether a file size reaches a threshold, whether a used space of a disk reaches a threshold, etc., and in this embodiment, an emphasis is placed on how to advance a specific file rollback operation subsequently, so a more specific description of the file rollback condition will not be given here.
Step S102, when the file rollback condition is met, configuring a deleted mark for the target file under the condition that the target file is not deleted, wherein the deleted mark is used for marking that the target file is in a state that the file is deleted;
it should be understood that in the original network traffic evidence obtaining scene, when the rollback operation of the traffic packet storage file is triggered, the current targeted traffic packet storage file is deleted, and a new traffic packet storage file is newly built, so that two problems of fragmentation and disk IO occupation are easily caused.
In this regard, the present application contemplates the addition of an overwrite write to "falsely" delete files to avoid both of these issues.
For the former, the application can be realized based on deleted marks, the deleted marks are marked, and the related file management process of the equipment considers that the files configured with the deleted marks are deleted, so that the original file rollback target of the current target file can be realized in the shallow aspect, but the current target file is reserved substantially, and the processing of the step S102 corresponds to that of the current target file;
In the latter case, in the case where the target file which should be deleted but not substantially deleted is retained, the original target file is regarded as a newly created file by the overwrite operation in the case where the file content of the original target file can be discarded, and the new content is written in the original target file, which corresponds to the processing of the subsequent step S103.
Therefore, the deletion work of the file is omitted, the writing of a new file is carried out on the basis of the original file, the problem of fragmentation of a disk is greatly reduced, even the problem of fragmentation of the disk is eliminated, under the network flow evidence obtaining scene, the disk is seriously fragmented after the original flow packet file packet storage system is operated for a long time, so that the packet storage performance is greatly negatively influenced, and after the scheme of the application is adopted, the packet storage performance is still stable after two weeks of operation.
In addition, the influence on the disk IO can be avoided, when the original flow packet file storage system deletes the file in the network flow evidence obtaining scene, the deleting operation needs to occupy a non-negligible disk IO, so that the deleting file can influence the peak writing speed of the packet storage system.
Step S103, when triggering to generate a new file by the target file, locating the target file, removing the deleted mark configured by the target file, and performing overlay write operation on the target file.
It should be understood that, in the embodiment herein, the step S102 and the step S103 are described with respect to the target file, or the description of the solution of the present application is performed with respect to the target file as a perspective.
In a specific operation, it should be noted that, in the case that the step S103 and the step S102 are not directly related or linked, more specifically, in the case that there are multiple files on the disk that may involve a file rollback operation, a rollback operation is triggered on a certain file and a corresponding deleted flag is configured, and an overlay write operation is performed on a certain file, which are two relatively independent links for the disk or for a device where the disk is located, from the time dimension, when processing is performed, the deleted flag may be configured for the first file first, then an overlay write operation is performed on the second file, and after one or multiple overlay write operations on other files, the overlay write operation is performed on the first file.
In this case, when a new overlay write operation needs to be created on the disk, a selection operation involving the file is required, and after a file in which a "false" file deletion operation has been performed and the deleted flag is configured is selected and located, the deleted flag is deleted, and the file name may also be renamed, opened, and then the file pointer is moved to the file start position to perform overlay write on the file.
If the size of the data to be written in later exceeds the size of the file itself, the file can be closed, and the judgment processing of whether the next round of file rollback condition is met or not is triggered to be triggered or directly triggered, or the next new file is triggered to be created to carry out the overlay write operation.
In the process of creating a new file and performing an overlay write operation subsequently, updating information related to the file, the file name mentioned above which is the most basic, and contents in terms of file generation time, file closing time, file size (usually constant and corresponding to the disk physical unit occupied by the file) and actual write size (after the file is used as the newly created file and changed along with the overlay write operation) may also be referred to.
As can be seen from the embodiment shown in fig. 1, for the rollback operation in file management, the present application detects whether the target file on the disk meets the file rollback condition, when the file rollback condition is met, under the condition that the target file is not deleted, the deleted flag is configured for the target file, where the deleted flag is used to flag the state that the target file is deleted, subsequently, when the target file is triggered to generate a new file, the target file is located, the deleted flag configured for the target file is removed, and an overlay write operation is performed on the target file, in this process, on one hand, the present application realizes the original file rollback target of the deleted target file in shallow layer, and subsequently, by executing the overlay write operation on the reserved target file, and realizing the creation target and the update target of the new file in the background, when the rollback operation is performed on the target file, based on the deleted flag and the overlay write operation, no substantial file deletion operation is required, and the situations of fragmentation of the disk and occupation IO accompanying the mode of originally deleting the file can be effectively avoided, and the problem of the rollback performance caused by the original network can be effectively solved, and the practical problem of the rollback performance caused by the rollback operation is better.
The steps of the embodiment shown in fig. 1 and the possible implementation thereof in practical applications will be described in detail.
For the file management processing of the application, in order to further facilitate file management or further improve the file management effect, the application can also introduce a catalog management mechanism.
Specifically, as an exemplary implementation manner, corresponding to step S102 in the foregoing embodiment, when the file rollback condition is satisfied, the method of the present application may further include:
and moving the target file into a deleted file directory, and updating a target index of the target file in an index directory, wherein the index directory comprises indexes of a plurality of files configured with deleted marks.
For example, the present application may configure a deleted directory, which is specially used to store traffic packet files that have been "falsely" deleted and not put into use in actual packet storage, and then may take out a specific traffic packet file from the deleted directory for put into use in actual packet storage, where the relative position of the traffic packet file (not the actual position of the physical unit on the disk, but after all, the actual deletion or movement of the file is not involved) may be updated by the change of the file inode (index) if the movement of the traffic packet file does not actually move on the disk, and the operation overhead of updating the file movement and the index is very low, or even negligible, because the actual position of the file on the disk is not changed.
In this case, corresponding to step S103 in the previous embodiment, locating the target file, removing the deleted flag of the target configuration, and performing the overlay write operation on the target file may specifically include:
And positioning the target flow packet file through the target index recorded in the index directory, removing the target flow packet file from the deleted file directory, removing the deleted mark configured by the target file, removing the target index of the target file in the index directory, and performing overlay write operation on the target file.
Taking the flow packet storage file as an example, it is understood that after the file is removed from the deleted file directory, the file may be stored in a directory where the packet storage system normally performs the packet storage operation, and the directory may be denoted as a destination directory.
In this embodiment, by introducing the two directory mechanisms, a plurality of files (such as flow packet storage files) can be more beneficial to realizing a fine and efficient file management effect.
In addition, it can be understood that, for the scheme of the present application, on one hand, the original application scenario can be directly implanted, so that, for the files originally related to the file rollback operation, after the scheme of the present application is implanted, the corresponding file rollback operation is directly developed for the files without deleting the files, the corresponding file management is developed, the characteristic of silky implanting the original application scenario is achieved, the scheme is convenient to advance or preliminary application attempt (mainly for observation before formally using the scheme) is facilitated, and in this case, the file size of the files is usually meant to be fixed, so that the characteristic exists; on the other hand, when the method and the device are applied, the file sizes of the files related to the file rollback operation can be adjusted in advance, the file sizes of all the files can be the same or different, and can be adjusted according to actual conditions, so that the file sizes can be fixed in advance according to a plan, and better file management effects can be exerted by the scheme of the application more easily.
It may be added that in some cases, a new file related to the file rollback operation may be directly created under the condition that the disk usage space allows, and at this time, the file size of the file may be aligned with the file already existing before or may be adjusted according to the actual situation.
As yet another exemplary embodiment, in the present application, file sizes of different files on a disk may be configured to be the same fixed file size in advance.
For example, the fixed file size mentioned here may be specifically 64GB.
The present application may also involve initializing the disk in the early stage, corresponding to the concept of pre-configuring a fixed file size here.
Specifically, as yet another exemplary embodiment, before the step S101 detects whether the target file on the disk meets the file rollback condition, the method of the present application may further include:
In the initial stage, formatting operation is carried out on the disk, different files are generated according to the fixed file size, the different files are stored in a deleted file catalog, the different files are configured with deleted marks, and corresponding indexes are distributed for the different files in an index catalog for subsequent work;
Different files are stored and new files are generated by adopting a first-in first-out queue mechanism.
It will be appreciated that the formatting operation performed in the disk space where the disk is included in the file management range may ensure that the problem of fragmentation does not occur in the initial stage, in which case a file with a fixed file size is generated and moved to the deleted file directory, or a file with a fixed file size is directly generated in the deleted file directory, the deleted flag is configured, and a corresponding index (which may be updated with subsequent operations) is allocated in the index directory, thereby laying a good foundation for the subsequent actually developed file management operation.
For example, in a specific operation, to further ensure that the disk is free of fragments, the disk may be formatted when the disk is first used or when the disk is just put into a traffic packet, then 64GB of files with a fixed size are sequentially written into the disk until the corresponding disk threshold is reached, all the generated files are stored in the deleted directory and added to the deleted file queue, and a first-in-first-out queue mechanism is adopted in the subsequent working process.
The first-in first-out (First Input First Output, FIFO) queuing mechanism refers to that in the working process, objects to be processed are ordered according to the sequence of entering the queue, when each time processing is performed, objects in the first position (queue head) in the current queue are processed, and new objects are added at the end of the queue.
Taking a flow packet storage file as an example, when a program is started, scanning a disk directory, storing all flow packet storage files into a flow packet storage file FIFO (first in first out) queue according to a file generation sequence, judging whether a file rollback condition is met, if so, removing the earliest stored flow packet storage file from the flow packet storage file FIFO queue, moving the earliest stored flow packet storage file into the deleted directory, updating a deleted file queue, and taking out the deleted file queue consisting of deleted files in the deleted directory by adopting the FIFO queue (as a generated new flow packet storage file).
Therefore, a first-in first-out queue mechanism is introduced in two links of carrying out flow packet storage processing on the generated flow packet storage file and taking out the flow packet storage file (as a generated new flow packet storage file) from the deleted file directory, so that good circulation is formed, and the management work of the flow packet storage file can be completed simply and efficiently by the magnetic disk.
Meanwhile, regarding the file rollback condition in step S101, it may be specifically related to the deleted file directory in the above embodiment, it may be understood that the deleted file directory stores files that are used as new deleted files to be generated (e.g., different files generated according to the fixed file size after the formatting operation in the above embodiment), and theoretically all files are hooked with the used space of the disk, and if the deleted file directory has no deleted file, this means that the used space of the disk has reached the threshold value, the rollback operation needs to be triggered to "rollback" the files that were fetched from the deleted file directory before being put into use to generate new deleted files that can be fetched in the deleted file directory for use in the overlay write operation.
In this regard, as yet another exemplary embodiment, the foregoing step S101 of detecting whether the target file on the disk satisfies the file rollback condition may specifically include:
Detecting whether any file does not exist in the deleted file directory;
if yes, determining that the target file meets the file rollback condition.
Taking a flow packet storage file as an example, when a new flow packet storage file is needed in the service processing process of the flow packet storage, the flow packet storage file comprises:
Judging whether the used space of the disk reaches a threshold value or not, if not, directly storing a packet file from the newly built flow, writing file information into a FIFO (first in first out) queue of the packet file of the flow, and updating the size of the used space of the disk;
If the flux packet storing file exists in the deleted catalogue and the used space of the disk reaches the threshold value, checking whether the flux packet storing file exists in the deleted catalogue, if so, directly taking out the flux packet storing file with the earliest generating time from the deleted catalogue, opening the flux packet storing file after moving the flux packet storing file to the target catalogue, moving a file pointer to the starting position of the file, and performing overlay writing operation from the starting position, when the written data exceeds the size of the file, closing the file and retrying new processing of the new flux packet storing file (the new flux packet storing file can be directly newly built or can come from the deleted catalogue), and simultaneously adding the flux packet storing file FIFO queue into the file removed from the deleted, and treating the flux packet storing file as the completely newly built flux packet storing file.
If no flow packet storage file exists in the deleted directory and the used space of the disk reaches the threshold value, rollback is needed, the earliest stored flow packet storage file is removed from the flow packet storage file FIFO queue, the earliest stored flow packet storage file is moved into the deleted directory, and the deleted file queue is updated.
For the above, a more visual understanding can also be made in connection with a logical schematic of the file management process of the present application shown in fig. 2.
Furthermore, as for the mode of deleting the file in a false way adopted by the application in the file rollback process, the application can also consider the result presentation in the aspect of visualization.
Specifically, as yet another exemplary embodiment, in the process of configuring the deleted flag for the target file in the case that the target file is not deleted in step S102 of the present application, the method may further include:
In the case of an undeleted target file, configuring a deleted flag for the target file, and removing the contribution of the file size of the target file to the used storage space size of the disk in the description information of the used storage space size of the disk.
It will be appreciated that, generally, after deleting the target file, the contribution of the target file is removed from the description information of the used storage space size of the disk, and the application adopts a deletion mode based on the deleted flag, where the target file is not deleted substantially, but is "hidden" and still occupies the storage space of the disk substantially, so, to align the actual file deletion result, the contribution of the file size of the target file to the used storage space size of the disk can be removed from the description information of the used storage space size of the disk, and the amount of the file size of the target file is increased in the usable storage space size of the disk (the used storage space of the disk is not actually changed, but is logically changed).
For the description information of the size of the used storage space of the disk, the description information can be presented in any management interface of the disk, and by taking the user operation related to the PC side as an example, the attribute window of the disk can be opened by a right-click mode of a mouse, the window usually describes the available space and the used space, and the used space can be updated at the moment, so that the file use of the storage space occupied by the target file deleted in a false mode is not affected.
In this regard, a more visual understanding may also be made in connection with a further logical schematic of the file management process of the present application shown in FIG. 3.
The file management method provided by the application is introduced above, and in order to facilitate better implementation of the file management method provided by the application, the application also provides a file management device from the perspective of a functional module.
Referring to fig. 4, fig. 4 is a schematic structural diagram of a file management apparatus according to the present application, in which the file management apparatus 400 may specifically include the following structures:
a condition detection unit 401, configured to detect whether a target file on a disk meets a file rollback condition;
A deletion configuration unit 402 configured to configure a deleted flag for a target file in a case where the target file is not deleted when a file rollback condition is satisfied, wherein the deleted flag is used to flag that the target file is in a state where the file has been deleted;
A writing operation unit 403, configured to locate the target file, remove the deleted flag configured by the target file, and perform an overlay writing operation on the target file when triggering generation of a new file with the target file.
In an exemplary embodiment, the delete configuration unit 402 is further configured to:
Moving the target file into a deleted file directory, and updating a target index of the target file in an index directory, wherein the index directory comprises indexes of a plurality of files configured with deleted marks;
The writing operation unit 403 is specifically configured to:
And positioning the target flow packet file through the target index recorded in the index directory, removing the target flow packet file from the deleted file directory, removing the deleted mark configured by the target file, removing the target index of the target file in the index directory, and performing overlay write operation on the target file.
In yet another exemplary embodiment, the file sizes of different files on the disk are all pre-configured to the same fixed file size.
In yet another exemplary embodiment, the apparatus further comprises an initial configuration unit 404 for:
In the initial stage, formatting operation is carried out on the disk, different files are generated according to the fixed file size, the different files are stored in a deleted file catalog, the different files are configured with deleted marks, and corresponding indexes are distributed for the different files in an index catalog for subsequent work;
Different files are stored and new files are generated by adopting a first-in first-out queue mechanism.
In yet another exemplary embodiment, the condition detection unit 401 is specifically configured to:
Detecting whether any file does not exist in the deleted file directory;
if yes, determining that the target file meets the file rollback condition.
In yet another exemplary embodiment, the deleting configuration unit 402 is specifically configured to:
In the case of an undeleted target file, configuring a deleted flag for the target file, and removing the contribution of the file size of the target file to the used storage space size of the disk in the description information of the used storage space size of the disk.
In yet another exemplary embodiment, the apparatus is specifically applied to traffic packet file management in a network traffic evidence obtaining scenario.
The present application also provides a processing device from the perspective of hardware structure, referring to fig. 5, fig. 5 shows a schematic structural diagram of the processing device of the present application, specifically, the processing device of the present application may include a processor 501, a memory 502, and an input/output device 503, where the processor 501 is configured to implement steps of a file management method in the corresponding embodiment of fig. 1 when executing a computer program stored in the memory 502; or the processor 501 is configured to implement the functions of the units in the corresponding embodiment as shown in fig. 4 when executing the computer program stored in the memory 502, and the memory 502 is configured to store the computer program required for the processor 501 to execute the file management method in the corresponding embodiment as shown in fig. 1.
By way of example, a computer program may be partitioned into one or more modules/units that are stored in memory 502 and executed by processor 501 to perform the present application. One or more of the modules/units may be a series of computer program instruction segments capable of performing particular functions to describe the execution of the computer program in a computer device.
The processing devices may include, but are not limited to, a processor 501, memory 502, and input-output devices 503. It will be appreciated by those skilled in the art that the illustrations are merely examples of processing devices, and are not limiting of processing devices, and may include more or fewer components than shown, or may combine some components, or different components, e.g., processing devices may also include network access devices, buses, etc., through which processor 501, memory 502, input output device 503, etc., are connected.
The Processor 501 may be a central processing unit (Central Processing Unit, CPU), but may also be other general purpose processors, digital signal processors (DIGITAL SIGNAL Processor, DSP), application SPECIFIC INTEGRATED Circuit (ASIC), field-Programmable gate array (Field-Programmable GATE ARRAY, FPGA) or other Programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like, which is a control center for a processing device, with various interfaces and lines connecting the various parts of the overall device.
The memory 502 may be used to store computer programs and/or modules, and the processor 501 may implement various functions of the computer device by executing or executing the computer programs and/or modules stored in the memory 502, and invoking data stored in the memory 502. The memory 502 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, application programs required for at least one function, and the like; the storage data area may store data created according to the use of the processing device, or the like. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as a hard disk, memory, plug-in hard disk, smart memory card (SMART MEDIA CARD, SMC), secure Digital (SD) card, flash memory card (FLASH CARD), at least one disk storage device, flash memory device, or other volatile solid-state storage device.
The processor 501, when configured to execute a computer program stored in the memory 502, may specifically implement the following functions:
detecting whether a target file on a disk meets a file rollback condition;
When the file rollback condition is met, configuring a deleted mark for the target file under the condition that the target file is not deleted, wherein the deleted mark is used for marking that the target file is in a state that the file is deleted;
when triggering to generate a new file with the target file, locating the target file, removing the deleted mark configured by the target file, and performing overlay write operation on the target file.
It will be clear to those skilled in the art that, for convenience and brevity of description, the specific working process of the file management apparatus, the processing device and the corresponding units thereof described above may refer to the description of the file management method in the corresponding embodiment as shown in fig. 1, and the detailed description thereof will not be repeated here.
Those of ordinary skill in the art will appreciate that all or a portion of the steps of the various methods of the above embodiments may be performed by instructions, or by instructions controlling associated hardware, which may be stored in a computer-readable storage medium and loaded and executed by a processor.
For this reason, the present application provides a computer readable storage medium, in which a plurality of instructions capable of being loaded by a processor to execute steps of a file management method according to the corresponding embodiment of fig. 1 are stored, and specific operations of the file management method according to the corresponding embodiment of fig. 1 will be referred to as descriptions of the file management method according to the corresponding embodiment of fig. 1, and will not be repeated herein.
Wherein the computer-readable storage medium may comprise: read Only Memory (ROM), random access Memory (Random Access Memory, RAM), magnetic or optical disk, and the like.
Since the instructions stored in the computer readable storage medium can execute the steps of the file management method according to the corresponding embodiment of fig. 1, the beneficial effects of the file management method according to the corresponding embodiment of fig. 1 can be achieved, and detailed descriptions are omitted herein.
The foregoing has outlined the detailed description of the file management method, apparatus, processing device and computer readable storage medium of the present application, and the detailed description of the principles and embodiments of the present application herein has been provided by way of example only to facilitate the understanding of the method and core idea of the present application; meanwhile, as those skilled in the art will have variations in the specific embodiments and application scope in light of the ideas of the present application, the present description should not be construed as limiting the present application.