Root cause location method, device, equipment, medium and program product

Abstract

The present disclosure provides a root cause location method, which can be applied to the field of financial technology. The method includes: obtaining all topological links with the same ID as the abnormal link, generating multiple one-dimensional links based on all topological links, scoring each one-dimensional link according to preset rules, obtaining the scoring result of each one-dimensional link, and determining the root cause node based on the scoring result of each one-dimensional link. The present disclosure also provides a root cause location device, equipment, storage medium and program product.

Description

Technical Field

[0001] The present disclosure relates to the field of financial technology, and more specifically to a root cause locating method, apparatus, device, medium and program product. Background Art

[0002] With the development of big data technology and cloud computing technology, in order to cope with the huge number of users and transaction traffic, information systems have gradually shifted from traditional monolithic architecture to distributed microservice architecture. While the distributed architecture brings high performance advantages, it also puts higher requirements on the operation and maintenance system.

[0003] In the prior art, full-link monitoring is usually used to monitor the operation and maintenance system. While full-link monitoring records links, indicators, and logs to provide detailed basis for distributed system operation and maintenance, due to the high interdependence of nodes in the distributed system, once an abnormality occurs in a node, it may transmit the abnormality on the call path, causing an abnormality storm. The real cause of the abnormality is submerged in a large area of ​​alarms and cannot be effectively identified and located, resulting in the problem of difficulty in locating the abnormality when it occurs. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a root cause locating method, apparatus, device, medium and program product that can quickly and effectively locate the root cause.

[0005] According to a first aspect of the present disclosure, a root cause location method is provided, comprising:

[0006] Get all topology links with the same ID as the abnormal link;

[0007] Based on all the topological links, generating multiple one-dimensional links;

[0008] Scoring each one-dimensional link according to a preset rule to obtain a scoring result for each one-dimensional link;

[0009] Based on the scoring result of each one-dimensional link, a root cause node is determined.

[0010] In some embodiments of the present disclosure, generating a plurality of one-dimensional links based on all the topological links includes:

[0011] For each topological link, a directed edge is generated with the consumer node as the starting node and the production node as the ending node;

[0012] Traversing all the topological links, and generating a directed acyclic graph based on all directed edges;

[0013] Starting from the root node of the directed acyclic graph, the directed acyclic graph is reduced in dimension to obtain the multiple one-dimensional links.

[0014] In some embodiments of the present disclosure, the one-dimensional link includes a normal node and / or an alarm node, and scoring each one-dimensional link according to a preset rule to obtain a scoring result for each one-dimensional link includes:

[0015] Obtaining the number of alarm nodes in each one-dimensional link;

[0016] When the number of alarm nodes of the one-dimensional link is one, scoring the one-dimensional link according to a first preset rule to obtain a scoring result of the one-dimensional link;

[0017] When there are multiple alarm nodes of a one-dimensional link, the one-dimensional link is scored according to a second preset rule to obtain a scoring result of the one-dimensional link.

[0018] In some embodiments of the present disclosure, the first preset rule:

[0019]

[0020] Wherein, M represents the scoring result, a represents the node sequence number of the alarm node in the one-dimensional link, and b represents the total number of nodes in the one-dimensional link.

[0021] In some embodiments of the present disclosure, the second preset rule:

[0022]

[0023] Among them, M represents the scoring result, c represents the number of the most connected alarm nodes in the one-dimensional link, i is an integer, i represents the i-th alarm node adjacent to the normal node in the one-dimensional link, and di represents the number of normal nodes adjacent to the i-th alarm node.

[0024] In some embodiments of the present disclosure, when all nodes of a one-dimensional link are alarm nodes, the scoring result of the one-dimensional link is increased.

[0025] In some embodiments of the present disclosure, let the number of nodes of a one-dimensional link be r, and when there is a one-dimensional link in which the first p nodes are all normal nodes and the last q nodes are all alarm nodes, increase the score result of the one-dimensional link;

[0026] In the tool, r=p+q.

[0027] In some embodiments of the present disclosure, determining the root cause node based on the scoring result of each one-dimensional link includes:

[0028] Compare the scoring results of all one-dimensional links;

[0029] Obtaining the time when the target alarm node issues an abnormal alarm, wherein the target alarm node is all the alarm nodes in the one-dimensional link with the highest score result;

[0030] The target alarm node that issues the abnormal alarm the latest is determined as the root cause node.

[0031] In some embodiments of the present disclosure, before acquiring all topological links having the same ID as the abnormal link, the process includes:

[0032] Obtaining alarm information of abnormal alarm and the alarm service tag corresponding to the alarm information;

[0033] Searching for a link topology table storing the alarm service tag;

[0034] The ID of the abnormal link is searched from the link topology table.

[0035] A second aspect of the present disclosure provides a root cause locating device, comprising:

[0036] An acquisition module, used for acquiring all topological links having the same ID as the abnormal link;

[0037] A generating module, used for generating a plurality of one-dimensional links based on all the topological links;

[0038] A scoring module, used to score each one-dimensional link according to a preset rule to obtain a scoring result for each one-dimensional link;

[0039] The determination module is used to determine the root cause node based on the scoring result of each one-dimensional link.

[0040] In one embodiment of the present disclosure, the generating module includes:

[0041] The edge generation submodule is used to generate a directed edge for each topological link, with the consumer node as the starting node and the production node as the end node;

[0042] A graph generation submodule, used for traversing all the topological links and generating a directed acyclic graph based on all directed edges;

[0043] The link generation submodule is used to reduce the dimension of the directed acyclic graph from the root node of the directed acyclic graph to obtain the multiple one-dimensional links.

[0044] In one embodiment of the present disclosure, the one-dimensional link includes normal nodes and / or alarm nodes, and the scoring module includes:

[0045] An acquisition submodule, used for acquiring the number of alarm nodes in each one-dimensional link;

[0046] A first scoring submodule is used for scoring the one-dimensional link according to a first preset rule to obtain a scoring result of the one-dimensional link when the number of alarm nodes of the one-dimensional link is one;

[0047] The second scoring submodule is used to score the one-dimensional link according to a second preset rule when there are multiple alarm nodes in the one-dimensional link to obtain the scoring result of the one-dimensional link.

[0048] In an embodiment of the present disclosure, the first preset rule:

[0049]

[0050] Wherein, M represents the scoring result, a represents the node sequence number of the alarm node in the one-dimensional link, and b represents the total number of nodes in the one-dimensional link.

[0051] In an embodiment of the present disclosure, the second preset rule:

[0052]

[0053] Among them, M represents the scoring result, c represents the number of the most connected alarm nodes in the one-dimensional link, i is an integer, i represents the i-th alarm node adjacent to the normal node in the one-dimensional link, and di represents the number of normal nodes adjacent to the i-th alarm node.

[0054] In one embodiment of the present disclosure, when all nodes of a one-dimensional link are alarm nodes, the score result of the one-dimensional link is increased.

[0055] In one embodiment of the present disclosure, let the number of nodes of a one-dimensional link be r. When the first p nodes in the one-dimensional link are all normal nodes and the last q nodes are all alarm nodes, the scoring result of the one-dimensional link is increased; wherein, r=p+q.

[0056] In one embodiment of the present disclosure, the determining module includes:

[0057] A comparison submodule, used to compare the scoring results of all one-dimensional links;

[0058] An acquisition submodule is used to acquire the time when the target alarm node issues an abnormal alarm, wherein the target alarm node is all the alarm nodes in the one-dimensional link with the highest scoring result;

[0059] The determination submodule is used to determine the target alarm node that issues the abnormal alarm the latest as the root cause node.

[0060] In one embodiment of the present disclosure, the root cause locating device further includes:

[0061] An information and label acquisition module, used to acquire alarm information of abnormal alarms, and an alarm service label corresponding to the alarm information;

[0062] A first search module, used for searching a link topology table storing the alarm service tag;

[0063] The second search module is used to search the ID of the abnormal link from the link topology table.

[0064] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned root cause location method.

[0065] A fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned root cause locating method.

[0066] A fifth aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned root cause location method when executed by a processor.

[0067] According to an embodiment of the present disclosure, all topological links with the same ID as the abnormal link are obtained, and multiple one-dimensional links are generated based on all the topological links. Each one-dimensional link is scored according to preset rules to obtain a scoring result of each one-dimensional link, and the root cause node is determined based on the scoring result of each one-dimensional link. All topological links with the same ID as the abnormal link are obtained to avoid the accuracy of the root cause location result being dependent on the selection of core feature attributes. By reducing the two-dimensional topological link to one-dimensional link data, the complexity of the root cause location algorithm is reduced and the reliability of the root cause location is improved. The one-dimensional link data is analyzed to avoid the need to collect a large amount of historical data for training and learning, thereby improving the efficiency of root cause location. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0069] Figure 1 The application scenario diagram of the root cause location method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown;

[0070] Figure 2 A flowchart of a root cause location method according to an embodiment of the present disclosure is schematically shown;

[0071] Figure 3The flowchart of operation S220 according to an embodiment of the present disclosure is schematically shown;

[0072] Figure 4 A schematic diagram of a one-dimensional link according to an embodiment of the present disclosure is schematically shown.

[0073] Figure 5 The flowchart of operation S230 according to an embodiment of the present disclosure is schematically shown.

[0074] Figure 6 A structural block diagram of a root cause location device according to an embodiment of the present disclosure is schematically shown; and

[0075] Figure 7 A block diagram of an electronic device suitable for implementing a root cause positioning method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0076] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0077] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0078] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0079] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0080] An embodiment of the present disclosure provides a root cause locating method, comprising: acquiring all topological links having the same ID as an abnormal link, generating multiple one-dimensional links based on all the topological links, scoring each one-dimensional link according to preset rules, obtaining a scoring result for each one-dimensional link, and determining a root cause node based on the scoring result for each one-dimensional link.

[0081] Figure 1 The application scenario diagram of the root cause positioning method according to an embodiment of the present disclosure is schematically shown.

[0082] like Figure 1 As shown, the network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0083] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0084] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0085] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0086] It should be noted that the root cause location method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the root cause location device provided in the embodiment of the present disclosure can generally be set in the server 105. The root cause location method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the ... device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0087] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0088] The following will be based on Figure 1 The scene described by Figure 2 to Figure 6 The root cause location method of the disclosed embodiment is described in detail.

[0089] In a distributed architecture, different functions are usually divided into different services at a smaller granularity. For high availability, multiple instances of the same service are usually deployed, which means that a simple transaction process may be associated with complex call links. These links are intertwined to form a call topology with many nodes and complex relationships, which poses a high challenge to the operation and maintenance of distributed systems.

[0090] In related technologies, a full-link monitoring system is proposed to solve the monitoring problems faced by distributed systems. Full-link monitoring has three core concepts, namely links, indicators, and logs. Among them, indicators are the representation of the system operation status at a certain moment, such as throughput, QPS, etc., logs are records of events that occur in the system, and links record the complete call relationship of a transaction and connect indicators and logs in series.

[0091] While full-link monitoring records links, indicators, and logs to provide detailed basis for distributed system operation and maintenance, it also brings the problem of difficulty in locating anomalies when they occur. The reason is that the nodes in the distributed system are highly interdependent. Once an anomaly occurs in a node, it may be transmitted on the call link, causing an anomaly storm, and the real cause of the anomaly is submerged in a large area of ​​alarms and cannot be effectively identified and located.

[0092] In related technologies, two main approaches are used to locate the root cause, one is machine learning for root cause analysis, and the other is decision tree-based root cause location. Using machine learning for root cause analysis specifically refers to extracting abnormal sequence data as positive and negative samples, performing supervised classification, and identifying the root cause after obtaining the classification model. The advantage of this method is that it has solid theoretical support, but the disadvantage is that the positioning accuracy is greatly affected by the sample capacity, and the generalization of the model is weak. Different businesses need to train different models. Root cause location based on decision trees specifically refers to selecting a certain indicator as the core feature and calculating information entropy as the basis for classification, while combining pruning algorithms for rapid root cause location. The advantage is that it is highly interpretable, but the disadvantage is that the positioning accuracy is heavily dependent on the selection of core features.

[0093] Figure 2 The flowchart of the root cause location method according to the embodiment of the present disclosure is schematically shown.

[0094] like Figure 2As shown, the root cause positioning method of this embodiment includes operations S210 to S230, and the root cause positioning method can be executed by a terminal or a server.

[0095] In operation S210, all topology links having the same ID as the abnormal link are acquired.

[0096] In operation S220, a plurality of one-dimensional links are generated based on all the topological links.

[0097] In operation S230, each one-dimensional link is scored according to a preset rule to obtain a scoring result of each one-dimensional link.

[0098] In operation S240, a root cause node is determined based on the scoring result of each one-dimensional link.

[0099] In the disclosed embodiment, an abnormal link refers to a link where an abnormal alarm occurs. Before operation S210, the alarm information of the abnormal alarm and the alarm service tag corresponding to the alarm information are obtained, the link topology table storing the alarm service tag is searched, and the ID of the abnormal link is searched from the link topology table.

[0100] In some embodiments of the present disclosure, alarm information and alarm service tags are stored in an alarm table, that is, alarm information of abnormal alarms can be searched in the alarm table. The search method can be to scan the alarm table in a time window of a certain time length to search for alarm information of abnormal alarms. The structure of the alarm table is shown in Table 1 below.

[0101] Table 1

[0102] Field Name Remark EVENT_DATE Alarm date EVENT_TIME Alarm time EVENT_TYPE Alarm Type EVENT_CODE Alarm code EVENT_INFO Alarm information SERVICE Alarm service EVENT_BIZTAG Alarm service label

[0103] In some disclosed embodiments, alarm information can also be obtained from an alarm table storing the alarm type according to the alarm type that the analyst is interested in. Furthermore, in addition to the alarm type, the analyst may also be interested in the alarm date, alarm time, etc., which is not limited in the present disclosure.

[0104] In some embodiments of the present disclosure, the link topology table is shown in Table 2, which includes information such as storage service providers, service consumers, service tags, link IDs, call results, link recording time, and the cluster where the link is located.

[0105] Table 2

[0106]

[0107]

[0108] In one embodiment of the present disclosure, operation S240 includes comparing the scoring results of all one-dimensional links, obtaining the time when the target alarm node issues an abnormal alarm, the target alarm node is all the alarm nodes in the one-dimensional link with the highest scoring result, and the target alarm node with the latest time of issuing the abnormal alarm is determined as the root cause node.

[0109] According to an embodiment of the present disclosure, all topological links with the same ID as the abnormal link are obtained, and multiple one-dimensional links are generated based on all the topological links. Each one-dimensional link is scored according to preset rules to obtain a scoring result of each one-dimensional link, and the root cause node is determined based on the scoring result of each one-dimensional link. All topological links with the same ID as the abnormal link are obtained to avoid the accuracy of the root cause location result being dependent on the selection of core feature attributes. By reducing the two-dimensional topological link to one-dimensional link data, the complexity of the root cause location algorithm is reduced and the reliability of the root cause location is improved. The one-dimensional link data is analyzed to avoid the need to collect a large amount of historical data for training and learning, thereby improving the efficiency of root cause location.

[0110] Figure 3 The flowchart of operation S220 according to an embodiment of the present disclosure is schematically shown.

[0111] like Figure 3 As shown, Figure 3 Schematically shows Figure 2 The flowchart of generating multiple one-dimensional links based on all the topological links is shown in FIG. Figure 3 As shown, in this embodiment, generating multiple one-dimensional links based on all the topological links may include operations S310 to S330.

[0112] In operation S310, for each topological link, a directed edge is generated with the consumer node as the starting node and the producer node as the ending node.

[0113] In operation S320, all the topological links are traversed, and a directed acyclic graph is generated based on all directed edges.

[0114] In operation S330, starting from the root node of the directed acyclic graph, the directed acyclic graph is reduced in dimension to obtain the multiple one-dimensional links.

[0115] For example, the generated one-dimensional link is as follows Figure 4 Each one-dimensional link includes normal nodes and / or alarm nodes. Figure 4 In the figure, normal nodes are represented by dark colors, and alarm nodes are represented by light colors. For example, in the one-dimensional link I, the nodes with sequence numbers 1, 3, and 4 are normal nodes, and the node with sequence number 2 is an alarm node.

[0116] In the present disclosure, a directed acyclic graph refers to a directed graph without loops, and generally its dimension is greater than 1. By reducing the dimension of the directed acyclic graph to obtain the multiple one-dimensional links, the complexity of the root cause location algorithm is reduced and the reliability of the root cause location is improved. Figure 5 The flowchart of operation S303 according to an embodiment of the present disclosure is schematically shown.

[0117] Figure 5 The flowchart of operation S230 according to an embodiment of the present disclosure is schematically shown.

[0118] like Figure 5 As shown, Figure 5 Schematically shows Figure 2 The schematic diagram of the process of scoring each one-dimensional link according to the preset rules to obtain the scoring result of each one-dimensional link is shown in FIG. Figure 5 As shown, in this embodiment, scoring each one-dimensional link according to a preset rule, and obtaining the scoring result of each one-dimensional link may include operations S510 to S530.

[0119] In operation S510, the number of alarm nodes in each one-dimensional link is obtained.

[0120] In operation S520, when the number of alarm nodes of the one-dimensional link is one, the one-dimensional link is scored according to a first preset rule to obtain a scoring result of the one-dimensional link.

[0121] In operation S530, when there are multiple alarm nodes in the one-dimensional link, the one-dimensional link is scored according to a second preset rule to obtain a scoring result of the one-dimensional link.

[0122] In one embodiment of the present disclosure, the first preset rule:

[0123]

[0124] Wherein, M represents the scoring result, a represents the node sequence number of the alarm node in the one-dimensional link, and b represents the total number of nodes in the one-dimensional link.

[0125] In one embodiment of the present disclosure, the second preset rule:

[0126]

[0127] Among them, M represents the scoring result, c represents the number of the most connected alarm nodes in the one-dimensional link, i is an integer, i represents the i-th alarm node adjacent to the normal node in the one-dimensional link, and di represents the number of normal nodes adjacent to the i-th alarm node.

[0128] For example, Figure 4 For example, the number of alarm nodes in the one-dimensional link I is single, and the one-dimensional link I is scored according to the first preset rule. The scoring result is And Figure 4 Taking the one-dimensional link II as an example, the number of alarm nodes in the one-dimensional link II is also single, then the one-dimensional link II is scored according to the first preset rule, and the scoring result is And Figure 4 Take the one-dimensional link III as an example. The number of alarm nodes in the one-dimensional link III is multiple. Then the one-dimensional link III is scored according to the second preset rule. The scoring result is And Figure 4 Take the one-dimensional link IV as an example. The number of alarm nodes in the one-dimensional link IV is multiple. Then the one-dimensional link IV is scored according to the second preset rule. The scoring result is

[0129] In one embodiment of the present disclosure, when all nodes of a one-dimensional link are alarm nodes, the scoring result of the one-dimensional link is increased. The way to increase the scoring result may be to add a certain score value or to multiply the scoring result by a certain multiple, which is not limited by the present disclosure.

[0130] In one embodiment of the present disclosure, let the number of nodes of a one-dimensional link be r. When the first p nodes of a one-dimensional link are all normal nodes and the last q nodes are all alarm nodes, the score result of the one-dimensional link is increased, where r=p+q. For example, if the number of nodes of a one-dimensional link is 10, the first 3 nodes of the one-dimensional link are normal nodes and the last 7 nodes are alarm nodes, then the one-dimensional link belongs to the above situation. Figure 4 The one-dimensional link II in also conforms to the above situation.

[0131] Based on the above root cause location method, the present disclosure also provides a root cause location device. Figure 6 The device is described in detail.

[0132] Figure 6 The structure block diagram of the root cause location device according to an embodiment of the present disclosure is schematically shown.

[0133] like Figure 6 As shown, the root cause location device 600 of this embodiment includes an acquisition module 610 , a generation module 620 , a scoring module 630 and a determination module 640 .

[0134] The acquisition module 610 is used to acquire all topological links having the same ID as the abnormal link. In one embodiment, the acquisition module 610 can be used to perform the operation S210 described above, which will not be described in detail here.

[0135] The generating module 620 is used to generate a plurality of one-dimensional links based on all the topological links. In one embodiment, the generating module 620 can be used to perform the operation S220 described above, which will not be described in detail here.

[0136] The scoring module 630 is used to score each one-dimensional link according to a preset rule to obtain a scoring result of each one-dimensional link. In one embodiment, the scoring module 630 can be used to perform the operation S230 described above, which will not be described in detail here.

[0137] The determination module 640 is used to determine the root cause node based on the scoring result of each one-dimensional link. In one embodiment, the determination module 640 can be used to perform the operation S240 described above, which will not be described in detail here.

[0138] According to the embodiments of the present disclosure, an acquisition module is used to acquire all topological links with the same ID as the abnormal link, a generation module is used to generate multiple one-dimensional links based on all the topological links, a scoring module is used to score each one-dimensional link according to preset rules to obtain the scoring result of each one-dimensional link, and a determination module is used to determine the root cause node based on the scoring result of each one-dimensional link. All topological links with the same ID as the abnormal link are acquired to avoid the accuracy of the root cause location result being dependent on the selection of core feature attributes. By reducing the two-dimensional topological link to one-dimensional link data, the complexity of the root cause location algorithm is reduced and the reliability of the root cause location is improved. The one-dimensional link data is analyzed to avoid the need to collect a large amount of historical data for training and learning, thereby improving the efficiency of root cause location.

[0139] In one embodiment of the present disclosure, the generating module 620 includes:

[0140] The edge generation submodule is used to generate a directed edge for each topological link, with the consumer node as the starting node and the production node as the end node;

[0141] A graph generation submodule, used for traversing all the topological links and generating a directed acyclic graph based on all directed edges;

[0142] The link generation submodule is used to reduce the dimension of the directed acyclic graph from the root node of the directed acyclic graph to obtain the multiple one-dimensional links.

[0143] In one embodiment of the present disclosure, the one-dimensional link includes normal nodes and / or alarm nodes, and the scoring module 630 includes:

[0144] An acquisition submodule, used for acquiring the number of alarm nodes in each one-dimensional link;

[0145] A first scoring submodule is used for scoring the one-dimensional link according to a first preset rule to obtain a scoring result of the one-dimensional link when the number of alarm nodes of the one-dimensional link is one;

[0146] The second scoring submodule is used to score the one-dimensional link according to a second preset rule when there are multiple alarm nodes in the one-dimensional link to obtain the scoring result of the one-dimensional link.

[0147] In an embodiment of the present disclosure, the first preset rule:

[0148]

[0149] Wherein, M represents the scoring result, a represents the node sequence number of the alarm node in the one-dimensional link, and b represents the total number of nodes in the one-dimensional link.

[0150] In an embodiment of the present disclosure, the second preset rule:

[0151]

[0152] Among them, M represents the scoring result, c represents the number of the most connected alarm nodes in the one-dimensional link, i is an integer, i represents the i-th alarm node adjacent to the normal node in the one-dimensional link, and di represents the number of normal nodes adjacent to the i-th alarm node.

[0153] In one embodiment of the present disclosure, when all nodes of a one-dimensional link are alarm nodes, the score result of the one-dimensional link is increased.

[0154] In one embodiment of the present disclosure, let the number of nodes of a one-dimensional link be r. When the first p nodes in the one-dimensional link are all normal nodes and the last q nodes are all alarm nodes, the scoring result of the one-dimensional link is increased; wherein, r=p+q.

[0155] In one embodiment of the present disclosure, the determination module 640 includes:

[0156] A comparison submodule, used to compare the scoring results of all one-dimensional links;

[0157] An acquisition submodule is used to acquire the time when the target alarm node issues an abnormal alarm, wherein the target alarm node is all the alarm nodes in the one-dimensional link with the highest scoring result;

[0158] The determination submodule is used to determine the target alarm node that issues the abnormal alarm the latest as the root cause node.

[0159] In one embodiment of the present disclosure, the root cause locating device 600 further includes:

[0160] An information and label acquisition module, used to acquire alarm information of abnormal alarms, and an alarm service label corresponding to the alarm information;

[0161] A first search module, used for searching a link topology table storing the alarm service tag;

[0162] The second search module is used to search the ID of the abnormal link from the link topology table.

[0163] According to an embodiment of the present disclosure, any multiple modules of the acquisition module 610, the generation module 620, the scoring module 630 and the determination module 640 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 610, the generation module 620, the scoring module 630 and the determination module 640 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the acquisition module 610 , the generation module 620 , the scoring module 630 , and the determination module 640 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0164] Figure 7 A block diagram of an electronic device suitable for implementing a root cause positioning method according to an embodiment of the present disclosure is schematically shown.

[0165] like Figure 7As shown, the electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include an onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0166] In RAM 703, various programs and data required for the operation of electronic device 700 are stored. Processor 701, ROM 702 and RAM 703 are connected to each other via bus 704. Processor 701 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 702 and / or RAM 703. It should be noted that the program can also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0167] According to an embodiment of the present disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to the bus 704. The electronic device 700 may further include one or more of the following components connected to the I / O interface 705: an input portion 706 including a keyboard, a mouse, etc.; an output portion 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 708 including a hard disk, etc.; and a communication portion 709 including a network interface card such as a LAN card, a modem, etc. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage portion 708 as needed.

[0168] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0169] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 702 and / or RAM 703 described above and / or one or more memories other than ROM 702 and RAM 703.

[0170] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the item recommendation method provided by the embodiment of the present disclosure.

[0171] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 701. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0172] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 709, and / or installed from the removable medium 711. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0173] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0174] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0175] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0176] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0177] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A root cause location method, comprising: Get all topology links with the same ID as the abnormal link; Based on all the topological links, generating multiple one-dimensional links; Scoring each one-dimensional link according to a preset rule to obtain a scoring result for each one-dimensional link; Determine the root cause node based on the scoring result of each one-dimensional link; The one-dimensional link includes a normal node and / or an alarm node, and each one-dimensional link is scored according to a preset rule, and the scoring result of each one-dimensional link includes: Obtaining the number of alarm nodes in each one-dimensional link; When the number of alarm nodes of the one-dimensional link is one, scoring the one-dimensional link according to a first preset rule to obtain a scoring result of the one-dimensional link; When there are multiple alarm nodes of the one-dimensional link, the one-dimensional link is scored according to a second preset rule to obtain a scoring result of the one-dimensional link; The first preset rule: Wherein, M represents the scoring result, a represents the node sequence number of the alarm node in the one-dimensional link, and b represents the total number of nodes in the one-dimensional link; The second preset rule: Wherein, M represents the scoring result, c represents the number of the most connected alarm nodes in the one-dimensional link, i is an integer, i represents the i-th alarm node adjacent to the normal node in the one-dimensional link, d i Represents the number of normal nodes adjacent to the i-th alarm node.

2. The root cause location method according to claim 1, wherein generating a plurality of one-dimensional links based on all the topological links comprises: For each topological link, a directed edge is generated with the consumer node as the starting node and the production node as the ending node; Traversing all the topological links, and generating a directed acyclic graph based on all directed edges; Starting from the root node of the directed acyclic graph, the directed acyclic graph is reduced in dimension to obtain the multiple one-dimensional links.

3. The root cause location method according to claim 1, wherein: When all nodes of a one-dimensional link are alarm nodes, the score result of the one-dimensional link is increased.

4. The root cause location method according to claim 1, wherein: Let the number of nodes of the one-dimensional link be r. When the first p nodes in the one-dimensional link are all normal nodes and the last q nodes are all alarm nodes, increase the score result of the one-dimensional link. Among them, r=p+q.

5. The root cause location method according to claim 1, wherein determining the root cause node based on the scoring result of each one-dimensional link comprises: Compare the scoring results of all one-dimensional links; Obtaining the time when the target alarm node issues an abnormal alarm, wherein the target alarm node is all the alarm nodes in the one-dimensional link with the highest score result; The target alarm node that issues the abnormal alarm the latest is determined as the root cause node.

6. The root cause location method according to claim 1, before acquiring all topological links having the same ID as the abnormal link, comprising: Obtaining alarm information of abnormal alarm and the alarm service tag corresponding to the alarm information; Searching for a link topology table storing the alarm service tag; The ID of the abnormal link is searched from the link topology table.

7. A root cause locating device, comprising: An acquisition module, used for acquiring all topological links having the same ID as the abnormal link; A generating module, used for generating a plurality of one-dimensional links based on all the topological links; A scoring module, used to score each one-dimensional link according to a preset rule to obtain a scoring result for each one-dimensional link; A determination module, configured to determine a root cause node based on the scoring result of each one-dimensional link; The one-dimensional link includes normal nodes and / or alarm nodes, and the scoring module includes: An acquisition submodule, used for acquiring the number of alarm nodes in each one-dimensional link; A first scoring submodule is used for scoring the one-dimensional link according to a first preset rule to obtain a scoring result of the one-dimensional link when the number of alarm nodes of the one-dimensional link is one; A second scoring submodule is used for scoring the one-dimensional link according to a second preset rule to obtain a scoring result of the one-dimensional link when there are multiple alarm nodes of the one-dimensional link; The first preset rule: Wherein, M represents the scoring result, a represents the node sequence number of the alarm node in the one-dimensional link, and b represents the total number of nodes in the one-dimensional link; The second preset rule: Wherein, M represents the scoring result, c represents the number of the most connected alarm nodes in the one-dimensional link, i is an integer, i represents the i-th alarm node adjacent to the normal node in the one-dimensional link, d i Represents the number of normal nodes adjacent to the i-th alarm node.

8. The root cause locating device according to claim 7, wherein the generating module comprises: The edge generation submodule is used to generate a directed edge for each topological link, with the consumer node as the starting node and the production node as the end node; A graph generation submodule, used for traversing all the topological links and generating a directed acyclic graph based on all directed edges; The link generation submodule is used to reduce the dimension of the directed acyclic graph from the root node of the directed acyclic graph to obtain the multiple one-dimensional links.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 6.

11. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images