Fault location method, device and computer readable storage medium

Abstract

The embodiments of the present application provide a fault location method, device and computer-readable storage medium, wherein the method includes: obtaining at least one event, event data corresponding to each of the events and attribute information corresponding to each of the events; constructing a topological map based on the at least one event and the attribute information corresponding to each of the events; obtaining fault data corresponding to a preset fault type from the event data corresponding to each of the events; clustering the at least one event in the topological map based on the fault data and preset clustering conditions to obtain at least one fault event corresponding to the fault data; and locating the fault range corresponding to the fault data in the topological map based on the at least one fault event.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of cloud computing, and relate to but are not limited to a fault location method, device, and computer-readable storage medium. Background Art

[0002] In the data information age, the scale of resources that cloud computing platforms need to present is huge. It is difficult to qualitatively judge the operation problems of various applications and businesses in cloud computing platforms, determine the scope of the problem, and reproduce the business operation problems within a period of time. Therefore, how to provide a method to accurately locate the scope of impact of cloud computing platform failures is an urgent problem to be solved. Summary of the invention

[0003] Based on the problems in the related art, the embodiments of the present application provide a fault location method, device and computer-readable storage medium.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present invention provides a fault location method, including:

[0006] Acquire at least one event, event data corresponding to each of the events, and attribute information corresponding to each of the events;

[0007] Constructing a topological map according to the at least one event and the attribute information corresponding to each of the events;

[0008] Acquire fault data corresponding to a preset fault type from the event data corresponding to each of the events;

[0009] Clustering the at least one event in the topology map according to the fault data and a preset clustering condition to obtain at least one fault event corresponding to the fault data;

[0010] According to the at least one fault event, a fault range corresponding to the fault data is located in the topology map.

[0011] The present application provides a fault location device, including:

[0012] A first acquisition module, used to acquire at least one event, event data corresponding to each of the events, and attribute information corresponding to each of the events;

[0013] A construction module, configured to construct a topology map according to the at least one event and the attribute information corresponding to each of the events;

[0014] A second acquisition module, used to acquire fault data corresponding to a preset fault type from the event data corresponding to each of the events;

[0015] A clustering module, configured to cluster the at least one event in the topology map according to the fault data and a preset clustering condition, to obtain at least one fault event corresponding to the fault data;

[0016] A positioning module is used to locate a fault range corresponding to the fault data in the topology map according to the at least one fault event.

[0017] The present application provides a fault location device, including:

[0018] The memory is used to store executable instructions; the processor is used to implement the above-mentioned fault location method when executing the executable instructions stored in the memory.

[0019] An embodiment of the present application provides a computer-readable storage medium storing executable instructions for causing a processor to execute the executable instructions to implement the above-mentioned fault locating method.

[0020] The fault location method, device and computer-readable storage medium provided in the embodiments of the present application construct a topological map based on at least one acquired event and the attribute information corresponding to each event, cluster the events in the topological map based on the fault data corresponding to the preset fault type and the preset clustering conditions, obtain at least one fault event corresponding to the fault data, and locate the fault range corresponding to the fault data on the topological map based on the at least one fault event. In this way, the embodiments of the present application cluster events through fault data, so that in a large-scale cloud computing platform, fault events can be accurately located and the impact range of the fault can be determined. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of an application scenario of the fault location method provided in an embodiment of the present application;

[0022] Figure 2 It is a flowchart of a fault location method provided in an embodiment of the present application;

[0023] Figure 3A It is a flowchart of a fault location method provided in an embodiment of the present application;

[0024] Figure 3B It is a structural schematic diagram of a tree structure topology diagram provided in an embodiment of the present application;

[0025] Figure 3C It is a schematic diagram of the structure of a tree topology diagram of a communication system provided in an embodiment of the present application;

[0026] Figure 4 It is a flowchart of a fault location method provided in an embodiment of the present application;

[0027] Figure 5 It is a flowchart of a fault location method provided in an embodiment of the present application;

[0028] Figure 6 It is a flowchart of a fault location method provided in an embodiment of the present application;

[0029] Figure 7 It is a flowchart of a fault location method provided in an embodiment of the present application;

[0030] Figure 8 It is a flowchart of a fault location method provided in an embodiment of the present application;

[0031] Fig. 9 It is a flowchart of a fault location method provided in an embodiment of the present application;

[0032] Fig.10 It is a flowchart of a fault location method provided in an embodiment of the present application;

[0033] Fig.11 It is a schematic diagram of the structure of the topological diagram provided in the embodiment of the present application;

[0034] Fig.12 It is a schematic diagram of the structure of the topology subgraph provided in the embodiment of the present application;

[0035] Fig.13 It is a schematic diagram of the structure of the topological graph after clustering provided in an embodiment of the present application;

[0036] Fig.14 It is a structural schematic diagram of the envelope line in the topological diagram after clustering provided by an embodiment of the present application;

[0037] Fig.15 It is a schematic diagram of the structure of the contour envelope in the topological diagram provided in the embodiment of the present application;

[0038] Fig.16 It is a schematic diagram of the structure of the fault location device provided in an embodiment of the present application;

[0039] Fig.17 It is a schematic diagram of the composition structure of the fault location device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0041] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meaning as those commonly understood by those skilled in the art of the technical field of the embodiments of the present application. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0042] Related technologies present the main resources, services and processes in cloud computing in the form of a network diagram. The vertices of the network diagram are different resources, services or processes, and the edges connecting the vertices are resource relationships. The network diagram can present the resource dependency relationships of cloud computing. However, when the scale of resources to be presented is large, due to the excessive number of vertices and edges in the network diagram, it will be difficult to identify and read the fault problems in the cloud computing platform. It will be difficult to qualitatively judge the operation problems of various applications and services in the cloud computing platform, determine the scope of the problem, and reproduce the business operation problems within a period of time.

[0043] Based on the problems in the related art, the embodiment of the present application provides a fault location method, which constructs a topology map according to the acquired at least one event and the attribute information corresponding to each event, clusters the events in the topology map according to the fault data corresponding to the preset fault type and the preset clustering conditions, obtains the fault event corresponding to the fault data, and locates the fault range corresponding to the fault data on the topology map according to the fault event. In this way, the embodiment of the present application clusters events through fault data, so that in a large-scale cloud computing platform, fault events can be accurately located and the impact range of the fault can be determined.

[0044] Figure 1 is a schematic diagram of an application scenario of the fault location method provided in an embodiment of the present application, such as Figure 1 As shown, a fault location system for implementing the fault location method includes a terminal 10, a network 20 and a server 30. At least one event of the cloud computing platform can be displayed on the terminal 10. The server 30 obtains the fault location request sent by the terminal 10 through the network 20. The server 30 constructs a topological map based on the at least one event obtained and the attribute information corresponding to each event. According to the fault data corresponding to the preset fault type and the preset clustering conditions, the events in the topological map are clustered to obtain the fault events corresponding to the fault data. According to the fault event, the fault range corresponding to the fault data is located on the topological map, and the fault range on the topological map is sent to the terminal 10 through the network 20. The user can directly display the received topological map and the fault range on the topological map on the current interface 10-1.

[0045] The fault location method provided by the embodiment of the present application will be described below in conjunction with the exemplary application and implementation of the server provided by the embodiment of the present application. Figure 2 , Figure 2 is a flowchart of a fault location method provided in an embodiment of the present application, which will be combined with Figure 2 The steps shown are explained.

[0046] Step S201: Acquire at least one event, event data corresponding to each of the events, and attribute information corresponding to each of the events.

[0047] In some embodiments, the event may come from an event database of a system that needs to locate a fault. For example, the event may come from an event database of an information technology service management (ITSM) or an event database of a monitoring system.

[0048] In some embodiments, the attribute information corresponding to the event may refer to at least one kind of information such as the event level of the event, the status of the event, the life cycle of the event, the related applications of the event, and the association relationship between events. The attribute information of the event and the event data corresponding to the event are obtained together when the event is acquired and are inherent attributes of the event.

[0049] Step S202: construct a topology map according to the at least one event and the attribute information corresponding to each of the events.

[0050] In some embodiments, the attribute information of the event includes at least the association relationship between the events. In the embodiment of the present application, the constructed topological map can be a topological map that reflects the topological relationship between the original resources of the system. For example, when the main resources, services, and processes in cloud computing are presented in a graph, this graph is the topological map, where the vertices of the topological map are different resources, services, processes, etc., and the edges connecting the vertices are resource relationships, so that a cloud computing resource dependency relationship can be presented.

[0051] In some embodiments, the topology map may further include the at least one event, and the topology map may be constructed by connecting different vertices with events as vertices of the topology map by association relationships between events. Here, the topology map may include all events of the operation and maintenance management system or the monitoring system, or may only include some events related to the fault.

[0052] In some embodiments, when technicians want to understand the dynamic evolution of events in the system, they can obtain the events corresponding to the moment and the correlation between events at different moments to construct topological diagrams at different moments, thereby presenting the evolution of events in the system over time.

[0053] In some embodiments, the topology map can be a network map, that is, each vertex in the topology map is an event, and the association between each two events is represented by the connection between the vertices. The topology map can also be a hexagonal map, that is, each event is a hexagon, and the association between each two events is represented by two adjacent hexagons.

[0054] Step S203: Acquire fault data corresponding to a preset fault type from the event data corresponding to each of the events.

[0055] In some embodiments, the preset fault type is set by the technician and is known data. For example, the preset fault type may be a fault type such as data cannot be stored or data cannot be calculated. The technician sets the fault type as needed and obtains the fault data corresponding to the fault type.

[0056] In the embodiment of the present application, the premise for locating the fault impact range is that the fault type is known, and the fault data corresponding to the fault type in the event data is determined based on the known fault type, and then the fault event that generates the fault data is obtained based on the fault data, and finally the fault range corresponding to the fault data is obtained.

[0057] Step S204: clustering the at least one event in the topology map according to the fault data and a preset clustering condition to obtain at least one fault event corresponding to the fault data.

[0058] In some embodiments, events in the topology map can be clustered based on fault data using density clustering or hierarchical clustering methods. Technicians can set different clustering conditions according to needs to obtain different clustering results, thereby observing the evolution process of fault events.

[0059] Step S205: According to the at least one fault event, locate a fault range corresponding to the fault data in the topology map.

[0060] In an embodiment of the present application, after determining at least one fault event corresponding to the fault data through clustering calculation, an envelope line can be drawn in the topology map based on the clustering result, wherein the envelope line includes at least one fault event, and occasional partial fault events (for example, one or two) may not be included in the drawn envelope line. In other words, the range presented by the envelope line qualitatively presents the impact or diffusion range of the fault. In the topology map, the area of ​​the envelope line is the fault range corresponding to the fault data. The degree of the fault and the scope of influence can be qualitatively judged by the area enclosed by the envelope line in the topology map.

[0061] The embodiment of the present application constructs a topology map based on at least one acquired event and the attribute information corresponding to each event, clusters the events in the topology map based on the fault data corresponding to the preset fault type and the preset clustering conditions, obtains the fault events corresponding to the fault data, and locates the fault range corresponding to the fault data on the topology map based on the fault events. In this way, the embodiment of the present application clusters events based on fault data, so that in a large-scale cloud computing platform, fault events can be accurately located and the impact range of the fault can be determined.

[0062] In some embodiments, the attribute information includes at least the level of each event and the association relationship between every two events. Figure 3A is a flow chart of a fault location method provided in an embodiment of the present application, such as Figure 3A As shown, in some embodiments, step S202 may be implemented by the following steps:

[0063] Step S301: Divide the at least one event into at least one event set with different levels according to the level of each of the events.

[0064] In some embodiments, the attribute information of an event is obtained when the event is acquired, and is an inherent attribute of each event. The attribute information of the event includes at least the level of each event and the association relationship between every two events. According to the level of the event, all events can be divided into event sets with different levels, and the events in each set have the same level.

[0065] Step S302: construct the topology graph with level association according to the level corresponding to each event set and the association relationship between every two events in the same event set.

[0066] In some embodiments, the topology diagram may be a star structure, a ring structure, a bus structure, a distributed structure, a tree structure, a mesh structure, or a honeycomb structure. The embodiment of the present application takes the tree structure as an example to describe in detail the fault location method provided in the embodiment of the present application.

[0067] In the embodiment of the present application, a topological diagram can be drawn through the events in the event set of different levels and the association relationship between every two events, such as Figure 3B As shown, Figure 3B: is a schematic diagram of the structure of the tree structure topology provided in the embodiment of the present application, the level of event A is level 1, the levels of event B and event C are both level 2, the levels of event D to event H are all level 3, event A has an association relationship with event B and event C respectively, event B has an association relationship with event D, event E and event F respectively, event C has an association relationship with event E, event F, event G, and event H respectively, and events A to event H are taken as vertices, and the association relationship between events is represented in the form of connecting lines, so as to construct the following diagram: Figure 3B The topology diagram shown.

[0068] In some embodiments, in a communication system, the level of a communication event may be level 1, the level of a storage event may be level 2, the level of a data change event and a fault alarm event may both be level 3, and there is an association relationship between the communication event and the storage event, and there is an association relationship between the storage event and the data change event and the fault alarm event, respectively. Then, in the tree topology diagram of the communication system, Figure 3C As shown, Figure 3C It is a structural schematic diagram of a tree topology diagram of a communication system provided in an embodiment of the present application.

[0069] The embodiment of the present application draws a topological map of the hierarchical relationship of the original resources through the level of the event, so that the topological map can clearly and concisely depict the topological relationship between various resources of the system. In addition, since the level and association relationship of the event can also be reflected in the topological map, it avoids the problem that the technician needs to find the association relationship between the events when checking the event failure, saving the technician's time.

[0070] In some embodiments, the attribute information may also include the life cycle of each event. Figure 4 is a flow chart of a fault location method provided in an embodiment of the present application, such as Figure 4 As shown, in some embodiments, step S204 can be implemented by the following steps:

[0071] Step S401: Determine at least one first target event that has a mapping relationship with the fault data.

[0072] In some embodiments, the target event refers to a fault event related to fault data. When fault data of a preset fault type is determined, the fault data may be generated by more than one event, and may be a series of events with a related relationship that result in a certain type of fault occurring during operation. Therefore, the fault data has a mapping relationship with this series of events with a related relationship.

[0073] Step S402: according to the level and the life cycle corresponding to each of the first target events, set the clustering condition corresponding to the first target event.

[0074] In some embodiments, the life cycle of an event may refer to the duration of the event when the operation and maintenance management system is running, that is, the duration of the event. The operation and maintenance management system's event runs in order, so the event has a corresponding level according to the running order, so that the formed topology also has a hierarchical relationship, and the operation and maintenance management system's faults can also have levels.

[0075] In some embodiments, the clustering condition may be set according to the duration of the event and the level of the event. For example, the clustering condition may be an event of level 3 or above and the duration of the event exceeds 2 hours.

[0076] In some embodiments, technicians can set different clustering conditions according to different fault types, so that different types of fault impact ranges can be presented in the same topology map, or set different clustering conditions for the same fault type, so that technicians can clearly know the fault impact range under different clustering conditions.

[0077] Step S403: cluster the at least one event in the topology map at least once according to the clustering condition corresponding to each of the first target events to obtain at least one fault event set corresponding to the fault data; wherein each of the fault event sets contains at least one fault event.

[0078] In some embodiments, clustering of events may be density clustering, hierarchical clustering, or other clustering methods that can achieve event clustering by setting clustering conditions.

[0079] In the embodiment of the present application, a preset fault type can be clustered at least once to obtain different fault events corresponding to a preset fault type, form at least one fault event set, and analyze the impact range of the fault by observing the boundary of each clustering on the topological map. It is also possible to cluster each preset fault type at least once to obtain the fault event corresponding to each preset fault type, form at least one fault event set, so as to realize the observation of the fault impact range of each type of fault on a topological map.

[0080] The embodiment of the present application clusters the events on the topology map by setting clustering conditions to obtain fault events corresponding to the fault types, and can quickly determine the fault events corresponding to the fault data in events with complex associations.

[0081] In some embodiments, after obtaining at least one fault event corresponding to the fault data, the fault impact range corresponding to the fault data can be located in the topology map. Figure 5 is a flow chart of a fault location method provided in an embodiment of the present application, such as Figure 5 As shown, in some embodiments, step S205 may be implemented by the following steps:

[0082] Step S501: In the topology map, first characteristic information is added to each fault event in the fault event set.

[0083] In some embodiments, the first characteristic information may be characteristic information such as vertex color or vertex shape representing an event on a topological map. For example, two different levels of clustering conditions are set for fault data of the same preset fault type to obtain two fault event sets. The vertices of the fault events in one of the fault event sets on the topological map may be set to yellow, and the vertices of the fault events in the other fault event set on the topological map may be set to red, so as to add the first characteristic information to the fault events in each fault event set.

[0084] Step S502: Draw a first envelope corresponding to each of the fault event sets according to the first characteristic information.

[0085] In some embodiments, after adding first characteristic information to events in each fault event set, events in the same fault event set have the same characteristics, and a first envelope can be drawn for events with the same characteristics, and each first envelope includes all fault events in each fault event set.

[0086] Here, the envelope colors or lines corresponding to events with different characteristics may be different.

[0087] Step S503: locate the fault range corresponding to the fault data in the topology map according to the first envelope corresponding to each of the fault event sets.

[0088] In some embodiments, the area where the first envelope line in the topology diagram is located is the fault range corresponding to the fault data.

[0089] The embodiment of the present application draws an envelope line for the fault event, so that the fault range corresponding to the fault data can be clearly presented on the topology map.

[0090] In some embodiments, the fault location method provided in the embodiments of the present application can also locate the fault range at each predetermined time. Based on the above embodiments, Figure 6 is a flow chart of a fault location method provided in an embodiment of the present application, such as Figure 6 As shown, in some embodiments, the embodiment of the present application may also have the following steps:

[0091] Step S601: Under at least one preset time, obtain at least one event at each preset time.

[0092] The embodiment of the present application can not only perform multiple clustering on events at a certain time point to obtain fault impact ranges of different levels, but also perform clustering on events at different times to obtain the development and evolution process of events over time.

[0093] In some embodiments, the preset time may be set by the user as required. For example, an event and data corresponding to the event may be obtained once every hour.

[0094] Correspondingly, step S202 can be implemented by the following steps:

[0095] Step S602: at each of the preset moments, construct the topology map according to the at least one event and the attribute information corresponding to each of the events.

[0096] In some embodiments, after obtaining the events at each preset time, a topological map corresponding to each time can be constructed. Here, the method of constructing the topological map is the same as the method in the above embodiment, and will not be repeated here.

[0097] In some embodiments, after obtaining the topology map at each preset time, the fault event at each preset time can be obtained. Based on the above embodiments, Figure 7 is a flow chart of a fault location method provided in an embodiment of the present application, such as Figure 7 As shown, in some embodiments, step S204 can be implemented by the following steps:

[0098] Step S701: Determine at least one second target event that has a mapping relationship with the fault data.

[0099] Here, the second target event refers to the target event corresponding to the fault data at each preset moment.

[0100] Step S702: Set the clustering condition according to the attribute information corresponding to each of the second target events.

[0101] In some embodiments, the attribute information of the event includes at least the level of the event and the existence duration of the event.

[0102] Step S703: cluster at least one event in the topology graph at each preset time according to the clustering condition to obtain at least one fault event of the fault data at the corresponding preset time.

[0103] In the embodiment of the present application, the clustering method may be the same as or different from the above-mentioned embodiment. Here, the same clustering condition may be used for events at different times to observe the fault events corresponding to the same clustering condition at different preset times, so as to obtain the evolution of events corresponding to the same fault type over time during operation.

[0104] Based on the above embodiments, Figure 8 is a flow chart of a fault location method provided in an embodiment of the present application, such as Figure 8 As shown, in some embodiments, step S205 may be implemented by the following steps:

[0105] Step S801: In each of the topological diagrams, second characteristic information is added for at least one fault event corresponding to each of the preset moments.

[0106] Step S802: Draw a second envelope on each of the topological graphs according to the second characteristic information.

[0107] In some embodiments, the second characteristic information may be the same as or different from the first characteristic information, and the color or line of the second envelope on the topological diagram at each preset moment may be the same or different.

[0108] Step S803: According to each of the second envelope lines, at each of the preset moments, locate the fault range corresponding to the fault data in each of the topological graphs.

[0109] In some embodiments, at each preset moment, the area where the second envelope line in the topology diagram is located is the fault range corresponding to the fault data.

[0110] The embodiment of the present application obtains the events at each preset moment to obtain the fault impact range corresponding to the fault data at each preset moment, so that the fault location method provided by the embodiment of the present application can compare the impact range of the fault data at different moments, thereby obtaining the event evolution process corresponding to the fault data.

[0111] In some embodiments, the topology map may be composed entirely of fault events corresponding to the fault data. Based on the above embodiments, Fig. 9 is a flow chart of a fault location method provided in an embodiment of the present application, such as Fig. 9 As shown, in some embodiments, the embodiment of the present application may also have the following steps:

[0112] Step S901: Acquire event data of the at least one event.

[0113] Step S902: Acquire fault data corresponding to the target fault type from the event data.

[0114] Step S903: in the at least one event, obtain a third target event having a mapping relationship with the fault data, a level of each of the third target events, and an association relationship between every two of the third target events.

[0115] Step S904: construct the topology map according to the level of each of the third target events and the association relationship between every two of the third target events.

[0116] In some embodiments, the events in the topology map may also be fault events corresponding to the fault data, rather than all events in the operation and maintenance management system.

[0117] In the embodiment of the present application, among all events in the operation and maintenance management system, a third target event (i.e., a fault event) is determined based on the fault data corresponding to the target fault type, and a topology map is constructed based on the level of the third target event and the association relationship between every two third target events. All events in the topology map are fault events corresponding to the fault data.

[0118] The embodiment of the present application constructs a topological map related to the fault data so that when analyzing the fault impact range, it will not be disturbed by other events unrelated to the fault data, making the result of the fault impact range more accurate.

[0119] The following describes an exemplary application of the embodiments of the present application in a practical application scenario.

[0120] Fig.10 is a flow chart of a fault location method provided in an embodiment of the present application, such as Fig.10 As shown, the fault location method provided in the embodiment of the present application can be implemented by the following steps:

[0121] Step S101: parse the topological relationships of various cloud computing resources from the cloud platform database.

[0122] Step S102: Acquire event data within a period of time.

[0123] In some embodiments, the event data may come from an event database and a monitoring database of an anomaly detection application. The event data may also come from a related management system, such as a change or fault alarm, or the event data may also come from a monitoring data anomaly detection application.

[0124] Step S103: construct a topology map at a specific time or at each time point within a period of time.

[0125] Here, the topology diagram can be Fig.11 As shown, Fig.11 Schematic diagram of the topology diagram provided in the embodiment of the present application. Fig.11As shown, the topology diagram includes: services with different levels (i.e., events) and gateways with different levels, wherein service A corresponds to level 1, A-1, A-2 and A-3 correspond to different level 1 services, service B corresponds to level 2, services C, D and E correspond to level 3, services F and G correspond to level 4, and gateways can be used for communication between every two services. Gateways also have levels, for example, API-1-1 is used to send information to level 1 services, and API-2-1 is used for communication between level 1 services and level 2 services.

[0126] Step S104: Mark the events in the topology map.

[0127] In some embodiments, in each topology map, annotations such as event level, existence duration, related applications, administrators, organizations, target users, and related events may be added to the events.

[0128] Step S105: filter events according to the filtering conditions.

[0129] In some embodiments, different filtering conditions (i.e., clustering conditions) can be set for each topology map. For example, the filtering conditions can be events of level 3 or above and events that last more than 2 hours, and the corresponding events are filtered out in the topology map based on the filtered events.

[0130] In some embodiments, a subgraph may be obtained from the topology graph, for example, a topology graph related to three applications {a, b, c}, namely, a subgraph of the topology graph. The subgraph of the topology graph may be obtained as follows: Fig.12 As shown, Fig.12 is a schematic diagram of the structure of a topology subgraph provided in an embodiment of the present application, Fig.12 The topological graph subgraph in comes from Fig.11 The topology diagram in the diagram represents a certain level of service and the gateway corresponding to the service. Here, the topology subgraph can be used to represent a single event, such as storage. Since storage may be used by several databases or applications, such an independent system can be represented by a topology subgraph. Separating this part of the system or subgraph and analyzing it as an independent part may simplify the analysis process. For database engineers, they often do not care about too many details of the lower-level resources. As long as the subgraph is analyzed as a whole, they will be more focused when observing.

[0131] Step S106: Execute density clustering in a single layer or at different levels.

[0132] In some embodiments, hierarchical clustering or density clustering may be performed on the topological graph, or several independent hierarchical clustering or density clustering may be performed on hierarchical attributes such as different levels and durations. Fig.13: is a schematic diagram of the structure of the topology diagram after clustering provided in the embodiment of the present application. The clustering condition can be set as a service (ie, event) with a level of less than level 2. The result after clustering can be as follows: Fig.13 As shown in FIG. 1 , the services (i.e., events) in bold are clustered services, and the service levels after clustering are all lower than level 2.

[0133] Step S107: draw envelopes corresponding to clustering results of different densities.

[0134] In the embodiment of the present application, an envelope can be drawn for the clustering result, and the area corresponding to the envelope is the impact range of the problem, such as Fig.14 As shown, Fig.14 It is a schematic diagram of the structure of the envelope line in the topology diagram after clustering provided by the embodiment of the present application. The envelope line H-1 can correspond to the problem impact range of the service with the clustering condition set as the service (ie event) level below level 2. If there are several hierarchical clusters, then an envelope line with a contour effect is drawn, such as Fig.15 As shown, Fig.15 It is a structural schematic diagram of the contour envelope in the topological diagram provided in the embodiment of the present application.

[0135] Depend on Fig.15 It can be seen that the embodiment of the present application performs clustering twice. The clustering condition set for the first clustering is services with service (i.e., event) levels below level 2, and the problem impact range is the area corresponding to the envelope line H-1. The clustering condition set for the second clustering is services with service (i.e., event) levels below level 1, and the problem impact range is the area corresponding to the envelope line H-2. The envelope lines H-1 and H-2 have contour line effects, and different envelope lines correspond to different problem levels. The envelope line H-1 corresponds to the problem impact range below service level 2, and the envelope line H-2 corresponds to the problem impact range below service level 1.

[0136] Step S108: Color different envelope areas according to data levels.

[0137] In some embodiments, after different envelope areas are colored according to data levels, the following three steps may be performed:

[0138] Step S1081: present a heat map.

[0139] Step S1082: presenting the evolution process of the heat map at different times.

[0140] Step S1083: presenting the comparative effects of heat maps at different event points.

[0141] In some embodiments, the area inside the envelope can be superimposed and colored in a predetermined order according to the level or degree of the problem (i.e., the fault) contained, so as to achieve a heat map effect. According to the above steps, a graph is presented, or the change of the heat map at several moments presents the change process of the problem, or two heat maps at different moments are selected to be parallel or superimposed to present the differences and changes at different moments.

[0142] The embodiment of the present application analyzes the topological diagram of cloud computing resource dependencies at different times, and adds events and event attribute information at different times. Use density-based clustering once, or perform density-based clustering multiple times in combination with hierarchical attribute information, and perform corresponding clustering at each moment. Superimpose and color the clustering results of different levels, draw contour lines, and generate a heat map. You can read a single picture, or you can play the event evolution process of each picture at different times in sequence to compare the system status at different times.

[0143] The embodiment of the present application can draw a topological map for a single moment, or a topological map for a certain moment in history. In addition, clustering can be performed according to different moments in history, rather than clustering existing problems. This makes it easier to see the occurrence or spread of problems, rather than just the extent of existing problems. The clustering effects at different times are synthesized into animations or videos or animated images with time series attributes, which will make it possible to see the evolution of problems more intuitively.

[0144] In presenting the scale of event quantity under multiple dependencies of cloud computing, the embodiment of the present application can quickly browse the impact scope of the presented problem, and can also identify the dynamic process of the development and evolution of events with different attributes in the system; after removing the vertices and edges in the topological graph, the dynamic evolution process of the system problem can be presented.

[0145] Fig.16 is a schematic diagram of the structure of the fault location device provided in the embodiment of the present application, such as Fig.16 As shown, the fault location device 160 includes:

[0146] The first acquisition module 161 is used to acquire at least one event, event data corresponding to each of the events, and attribute information corresponding to each of the events; the construction module 162 is used to construct a topological map based on the at least one event and the attribute information corresponding to each of the events; the second acquisition module 163 is used to acquire fault data corresponding to a preset fault type from the event data corresponding to each of the events; the clustering module 164 is used to cluster the at least one event in the topological map based on the fault data and preset clustering conditions to obtain at least one fault event corresponding to the fault data; the positioning module 165 is used to locate the fault range corresponding to the fault data in the topological map based on the at least one fault event.

[0147] In some embodiments, the attribute information includes at least: the level of each event and the association relationship between every two events; the construction module 162 is also used to divide the at least one event into at least one event set with different levels according to the level of each event; and construct the topological map with level association according to the level corresponding to each event set and the association relationship between every two events in the same event set.

[0148] In some embodiments, the attribute information also includes: the life cycle of each of the events; the clustering module 164 is also used to determine at least one first target event that has a mapping relationship with the fault data; according to the level and the life cycle corresponding to each of the first target events, the clustering condition corresponding to the first target event is set; according to the clustering condition corresponding to each of the first target events, at least one event in the topology map is clustered at least once to obtain at least one fault event set corresponding to the fault data; wherein each of the fault event sets contains at least one fault event.

[0149] In some embodiments, the positioning module 165 is also used to add first characteristic information to each fault event in the fault event set in the topology map; draw a first envelope corresponding to each fault event set based on the first characteristic information; and locate the fault range corresponding to the fault data in the topology map based on the first envelope corresponding to each fault event set.

[0150] In some embodiments, the fault location device 160 also includes: a third acquisition module, used to obtain the at least one event at each preset moment at at least one preset moment; correspondingly, the construction module 162 is also used to construct the topology map at each preset moment according to the at least one event and the attribute information corresponding to each event.

[0151] In some embodiments, the clustering module 164 is also used to determine at least one second target event that has a mapping relationship with the fault data; set the clustering condition according to the attribute information corresponding to each of the second target events; and cluster at least one event in the topological map at each of the preset moments according to the clustering condition to obtain at least one fault event of the fault data at the corresponding preset moment.

[0152] In some embodiments, the positioning module 165 is also used to add second characteristic information for at least one fault event corresponding to each preset moment in each of the topological maps; based on the second characteristic information, draw a second envelope line on each of the topological maps; and based on each of the second envelope lines, locate the fault range corresponding to the fault data in each of the topological maps at each preset moment.

[0153] In some embodiments, the fault location device 160 also includes: a fourth acquisition module, used to acquire event data of the at least one event; a fifth acquisition module, used to acquire fault data corresponding to the target fault type from the event data; a sixth acquisition module, used to acquire, in the at least one event, a third target event having a mapping relationship with the fault data, the level of each of the third target events, and the association relationship between every two of the third target events; and a first construction module, used to construct the topology map according to the level of each of the third target events and the association relationship between every two of the third target events.

[0154] It should be noted that the description of the device of the embodiment of the present application is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment, so it is not repeated. For technical details not disclosed in the embodiment of the device, please refer to the description of the method embodiment of the present application for understanding.

[0155] It should be noted that in the embodiments of the present application, if the above-mentioned fault location method is implemented in the form of a software function module and sold or used as an independent commodity, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application can be essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software commodity, and the computer software commodity is stored in a storage medium, including a number of instructions for a terminal to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM, Read Only Memory), a disk or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0156] Correspondingly, an embodiment of the present application provides a fault location device, Fig.17 is a schematic diagram of the structure of the fault location device provided in the embodiment of the present application, such as Fig.17As shown, the fault location device 170 at least includes: a processor 171 and a computer-readable storage medium 172 configured to store executable instructions, wherein the processor 171 generally controls the overall operation of the fault location device. The computer-readable storage medium 172 is configured to store instructions and applications executable by the processor 171, and can also cache data to be processed or processed by the processor 171 and each module in the fault location device 170, which can be implemented by flash memory (FLASH) or random access memory (RAM).

[0157] The present application embodiment provides a storage medium storing executable instructions, wherein the executable instructions are stored. When the executable instructions are executed by a processor, the processor will execute the method provided by the present application embodiment, for example, Figure 2 The method shown.

[0158] In some embodiments, the storage medium can be a computer-readable storage medium, for example, a ferroelectric random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a magnetic surface memory, an optical disk, or a compact disk read-only memory (CD-ROM), etc.; it can also be various devices including one or any combination of the above memories.

[0159] In some embodiments, executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0160] As an example, executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file storing other programs or data, such as one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions). As an example, executable instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one location, or on multiple computing devices distributed at multiple locations and interconnected by a communication network.

[0161] The above is only an embodiment of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present application are included in the protection scope of the present application.

[0162] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0163] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method or device. In the absence of further restrictions, an element defined by the statement "comprises one..." does not exclude the presence of other identical elements in the process, method, article or device including the element. In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed.

[0164] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A fault location method, characterized in that: include: Acquire at least one event, event data corresponding to each of the events, and attribute information corresponding to each of the events; Constructing a topological map according to the at least one event and the attribute information corresponding to each of the events; Acquire fault data corresponding to a preset fault type from the event data corresponding to each of the events; Clustering the at least one event in the topology map according to the fault data and a preset clustering condition to obtain at least one fault event corresponding to the fault data; According to the at least one fault event, the fault range corresponding to the fault data is located in the topological map; the fault range corresponding to the fault data is located from the topological map according to the first envelope line; the first envelope line is obtained from the first characteristic information; the first characteristic information is the characteristic information of the vertex color or vertex shape representing the event on the topological map.

2. The method according to claim 1, characterized in that The attribute information at least includes: the level of each event and the association relationship between every two events; The constructing a topology map according to the at least one event and the attribute information corresponding to each of the events includes: According to the level of each of the events, dividing the at least one event into at least one event set with different levels; According to the level corresponding to each event set and the association relationship between every two events in the same event set, the topological graph with level association is constructed.

3. The method according to claim 2, characterized in that The attribute information also includes: the life cycle of each of the events; The step of clustering the at least one event in the topology map according to the fault data and a preset clustering condition to obtain at least one fault event corresponding to the fault data includes: Determine at least one first target event having a mapping relationship with the fault data; According to the level and the life cycle corresponding to each of the first target events, setting the clustering condition corresponding to the first target event; According to the clustering condition corresponding to each of the first target events, the at least one event in the topological map is clustered at least once to obtain at least one fault event set corresponding to the fault data; wherein each of the fault event sets contains at least one fault event.

4. The method according to claim 3, characterized in that The locating, in the topology map, a fault range corresponding to the fault data according to the at least one fault event, includes: In the topology map, adding the first characteristic information to each fault event in the fault event set; Drawing the first envelope corresponding to each of the fault event sets according to the first characteristic information; The fault range corresponding to the fault data is located in the topology map according to the first envelope corresponding to each of the fault event sets.

5. The method according to claim 1, characterized in that The method further comprises: At at least one preset moment, obtaining at least one event at each preset moment; Correspondingly, constructing a topology map according to the at least one event and the attribute information corresponding to each of the events includes: At each of the preset moments, the topology map is constructed according to the at least one event and the attribute information corresponding to each of the events.

6. The method according to claim 5, characterized in that The step of clustering the at least one event in the topology map according to the fault data and a preset clustering condition to obtain at least one fault event corresponding to the fault data includes: Determine at least one second target event having a mapping relationship with the fault data; Setting the clustering condition according to the attribute information corresponding to each of the second target events; According to the clustering condition, at least one event in the topological graph at each preset time is clustered to obtain at least one fault event of the fault data at the corresponding preset time.

7. The method according to claim 6, characterized in that The locating, in the topology map, a fault range corresponding to the fault data according to the at least one fault event, includes: In each of the topological graphs, adding second characteristic information for at least one fault event corresponding to each of the preset moments; According to the second characteristic information, drawing a second envelope on each of the topological graphs; According to each of the second envelope lines, at each of the preset moments, the fault range corresponding to the fault data in each of the topological graphs is located.

8. The method according to claim 1, characterized in that The method further comprises: Obtaining event data of the at least one event; Acquire fault data corresponding to a target fault type from the event data; In the at least one event, a third target event having a mapping relationship with the fault data, a level of each of the third target events, and an association relationship between every two of the third target events are acquired; The topology graph is constructed according to the level of each of the third target events and the association relationship between every two of the third target events.

9. A fault location device, characterized in that: include: A first acquisition module, used to acquire at least one event, event data corresponding to each of the events, and attribute information corresponding to each of the events; A construction module, configured to construct a topology map according to the at least one event and the attribute information corresponding to each of the events; A second acquisition module, used to acquire fault data corresponding to a preset fault type from the event data corresponding to each of the events; A clustering module, configured to cluster the at least one event in the topology map according to the fault data and a preset clustering condition, to obtain at least one fault event corresponding to the fault data; A positioning module is used to locate the fault range corresponding to the fault data in the topological map according to the at least one fault event; the fault range corresponding to the fault data is located from the topological map according to a first envelope line; the first envelope line is obtained from first characteristic information; the first characteristic information is characteristic information of the vertex color or vertex shape representing the event on the topological map.

10. A computer-readable storage medium, characterized in that: Executable instructions are stored, which are used to cause a processor to execute the executable instructions to implement the fault location method described in any one of claims 1 to 8.

Images