Root cause location method and device
By training a linear regression model and using regression coefficient screening, the problem of traditional root cause positioning relying on manual comparison is solved, and fast and accurate root cause positioning is achieved, reducing cost and time, and improving the efficiency of troubleshooting.
Patent Information
- Application Number
- CN202111311416.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-11-08
- Publication Date
- 2024-12-31
- Estimated Expiration
- 2041-11-08
AI Technical Summary
Traditional root cause positioning methods rely on manual comparison, which is costly and inefficient, making it difficult to quickly and accurately locate the root cause indicators that cause system abnormalities.
By training a linear regression model, the candidate index is screened out using regression coefficients to quickly and accurately realize root cause positioning, reduce manual intervention, and improve efficiency.
It realizes fast and accurate root cause positioning, reduces labor costs and time, and improves the accuracy and response speed of troubleshooting.
Smart Images
Figure CN114090315B_ABST
Abstract
Description
Technical Field
[0001] One or more embodiments of the present specification relate to the field of artificial intelligence technology, and more particularly, to a method and device for root cause locating. Background Art
[0002] Root Cause Determination (RCA) refers to locating which indicator values caused the anomaly when an anomaly occurred. In the context of huge business and user needs of many systems, fast and accurate root cause location for each service anomaly is an important guarantee for system product quality. Summary of the invention
[0003] In view of this, one or more embodiments of this specification describe a method and apparatus for locating a root cause, so as to quickly and accurately locate the root cause.
[0004] According to a first aspect, a method for root cause location is provided, comprising:
[0005] Acquire a key indicator set and a candidate indicator set of the abnormal system, wherein the key indicator set includes more than one key indicator, and the candidate indicator set includes more than one candidate indicator;
[0006] According to the corresponding relationship between the key indicator and the candidate indicator, each key indicator is respectively executed as the key indicator to be predicted: a time series of the key indicator to be predicted within the abnormal period and one or more corresponding candidate indicator time series are obtained; a linear regression model is trained using the obtained time series, wherein the linear regression model is used to predict the key indicator value at time t using the candidate indicator values at time t-1 and time t-1 and the key indicator value at time t-1, where t is each time within the abnormal period;
[0007] The regression coefficients of each linear regression model obtained through training are screened, and the root cause indicators are determined using the candidate indicators corresponding to the regression coefficients that meet the preset conditions.
[0008] In one embodiment, before the linear regression model is trained using the acquired time series, the method further includes:
[0009] The acquired time series are aggregated and missing values are filled according to the preset time length granularity, so that the acquired time series have equal step lengths.
[0010] In another embodiment, the preset condition includes: the absolute value of the regression coefficient is greater than or equal to a preset threshold.
[0011] In one embodiment, the linear function adopted by the linear regression model applies the least absolute shrinkage and selection operator penalty LASSO penalty to the regression coefficient;
[0012] The preset condition includes that the value of the regression coefficient is non-zero.
[0013] In another embodiment, the key indicator set includes more than one tenant indicator, and the candidate indicator set includes more than one SQL indicator.
[0014] According to a second aspect, a root cause location device is provided, comprising:
[0015] An indicator acquisition unit is configured to acquire a key indicator set and a candidate indicator set of the abnormal system, wherein the key indicator set includes more than one key indicator, and the candidate indicator set includes more than one candidate indicator;
[0016] The model training unit is configured to execute each key indicator as a key indicator to be predicted according to the corresponding relationship between the key indicator and the candidate indicator: obtain a time series of the key indicator to be predicted within the abnormal period and one or more corresponding candidate indicator time series; use the obtained time series to train a linear regression model, wherein the linear regression model is used to use the candidate indicator values at time t and time t-1 and the key indicator value at time t-1 to predict the key indicator value at time t, where t is each time within the abnormal period;
[0017] The coefficient screening unit is configured to screen the regression coefficients of each linear regression model obtained through training, and determine the root cause indicator using the candidate indicators corresponding to the regression coefficients that meet the preset conditions.
[0018] In one embodiment, the apparatus further comprises:
[0019] The sequence optimization unit is configured to aggregate and fill missing values of the time series obtained by the model training unit according to a preset time length granularity, so that the obtained time series has an equal step length for use by the model training unit in training.
[0020] In another embodiment, the preset condition includes: the absolute value of the regression coefficient is greater than or equal to a preset threshold.
[0021] In one embodiment, the linear function adopted by the linear regression model applies the least absolute shrinkage and selection operator penalty LASSO penalty to the regression coefficient;
[0022] The preset condition includes that the value of the regression coefficient is non-zero.
[0023] In another embodiment, the key indicator set includes more than one tenant indicator, and the candidate indicator set includes more than one SQL indicator.
[0024] According to a third aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect is implemented.
[0025] According to the method and device provided in the embodiments of this specification, the regression coefficient of the linear regression model is trained to reflect the influence of each candidate indicator on the prediction of the key indicator in time series, and the regression coefficient is further screened to quickly and accurately locate the root cause. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0027] Figure 1 A flow chart showing a method for root cause location according to an embodiment is shown;
[0028] Figure 2 A schematic block diagram of a root cause location device according to an embodiment is shown;
[0029] Figure 3 A block diagram of a computing device according to various embodiments is shown. DETAILED DESCRIPTION
[0030] The solution provided in this specification is described below in conjunction with the accompanying drawings.
[0031] Traditional root cause location methods are mostly based on pre-found rules, that is, setting thresholds for important indicators based on experience or experiments for screening. However, this method screens too many indicators and requires manual comparison to determine which indicator is the root cause of the anomaly. This method is obviously heavily dependent on manual labor, which is costly and inefficient.
[0032] The basic concept of the embodiments of this specification is to use the regression coefficient screening of the linear regression model for root cause location.
[0033] The specific implementation of the above concept is described below.
[0034] Figure 1A flow chart of a method for root cause location according to an embodiment is shown. It can be understood that the method can be executed by any device, equipment, platform, or device cluster having computing and processing capabilities.
[0035] like Figure 1 As shown, the method includes:
[0036] Step 101, obtaining a key indicator set and a candidate indicator set of an abnormal system, wherein the key indicator set includes more than one key indicator, and the candidate indicator set includes more than one candidate indicator.
[0037] Step 103, based on the correspondence between the key indicators and the candidate indicators, each key indicator is executed as the key indicator to be predicted: the time series of the key indicator to be predicted within the abnormal period and the corresponding time series of one or more candidate indicators are obtained; a linear regression model is trained using the obtained time series, wherein the linear regression model is used to use the candidate indicator values at time t and time t-1 and the key indicator value at time t-1 to predict the key indicator value at time t, where t is each moment within the abnormal period.
[0038] Step 105 , screening the regression coefficients of each linear regression model obtained through training, and determining the root cause indicator using the candidate indicators corresponding to the regression coefficients that meet the preset conditions.
[0039] exist Figure 1 In the method shown, the regression coefficient of the linear regression model is trained to reflect the influence of each candidate indicator on the prediction of the key indicator in time series, and the regression coefficient is further screened to quickly and accurately locate the root cause. Obviously, compared with the manual comparison method, it is less costly and more efficient.
[0040] Described below Figure 1 The execution method of each step shown is as follows. First, the above step 101, namely "obtaining the key indicator set and candidate indicator set of the abnormal system", is described in detail in conjunction with the embodiment.
[0041] Among them, the abnormal system refers to the system where the abnormality occurs, that is, the system to be analyzed. The key indicator set contains more than one key indicator, and the candidate indicator set contains more than one candidate indicator. Among them, the key indicator refers to the indicator that can directly reflect and measure the system abnormality. These indicators constitute the key indicators and. The candidate indicators refer to the indicators that may cause system abnormalities. These indicators constitute the candidate indicator set.
[0042] Taking SQL software system as an example, with the continuous maturity of virtualization technology, multi-tenant technology has been widely used. Multi-tenant technology simply means that a single instance can serve multiple organizations, so that the same system or program components can be shared in a multi-tenant environment, and the data isolation between tenants can be ensured. In multi-tenant technology, tenants refer to customers who use systems or computing resources. All data that can be identified as a designated user, including account and statistics, various data built by users in the system, and the user's own customized application environment, all belong to the scope of tenants. Usually, tenant indicators can reflect and measure system anomalies, so m tenant indicators can be used to form a key indicator set, where m is a positive integer greater than or equal to 1. The underlying SQL indicators cause SQL software system anomalies, so n SQL indicators can be used to form a candidate indicator set, where n is a positive integer greater than 1.
[0043] Among them, tenant indicators may include such as sql_select_rt (SQL statement running time), cpu_use_util_max (maximum CPU utilization), logical_reads (logical reads), sql_inset_count (number of insert statements executed), etc. SQL indicators may include such as cpu_time (SQL running time on the CPU), exec_pc (number of executions per second), logical_reads (logical reads), exections (total number of executions), etc. The indicators of different systems may be different, so they are not listed here one by one.
[0044] The following is a detailed description of step 103, namely "based on the correspondence between the key indicators and the candidate indicators, executing each key indicator as the key indicator to be predicted: obtaining the time series of the key indicator to be predicted within the abnormal period and the corresponding time series of one or more candidate indicators; and training the linear regression model using the obtained time series" in conjunction with the embodiments.
[0045] In a system, each key indicator corresponds to one or more candidate indicators. For example, each tenant indicator corresponds to one or more SQL indicators, and the corresponding relationship is generated because each tenant indicator is directly calculated or indirectly aggregated from one or more SQL indicators. This corresponding relationship can be obtained in advance before this embodiment.
[0046] For example, the tenant indicator sql_select_rt corresponds to the candidate indicators elapsed_time (response time), execute_time (internal execution time), cpu_time, getplan_time (hard parsing time), queue_time (queue waiting), total_wait_time (internal waiting), netwait_time (network waiting), iowait_time (IO waiting), logical_reads (logical reads), rpc_count (RPC times), and cpu_time*exections (CPU share).
[0047] The tenant indicator cpu_use_util_max corresponds to the candidate indicators cpu_time and total_wait_time (total waiting time).
[0048] The tenant metric logical_reads corresponds to the candidate metric logical_reads.
[0049] The tenant indicator sql_inset_count corresponds to the candidate indicators exections (total number of times) and exec_ps (number of times per second).
[0050] In this step, it is actually necessary to build a linear regression model for each key indicator. Each linear regression model is responsible for predicting a key indicator. Assuming there are m key indicators, then m linear regression models are built.
[0051] The process of establishing a linear regression model for each key indicator is the same. Here, the i-th key indicator is taken as an example and the i-th key indicator is used as the key indicator to be predicted. First, the i-th key indicator time series and the corresponding one or more candidate indicator time series within the abnormal period are obtained.
[0052] The so-called abnormal period refers to the period when the analyzed system has an abnormality, or it can be a period that includes the period when the analyzed system has an abnormality. Assuming that it is known that the system has an abnormality within the past two hours, but the specific abnormal time is unknown, these two hours can be regarded as the abnormal period.
[0053] Get the time series of the i-th key indicator in these two hours, expressed as Y. The time series contains the key indicator values at multiple consecutive time points. Assuming that the candidate indicators corresponding to the i-th key indicator are candidate indicators 1, 2, and 3, then get the time series of candidate indicators 1, 2, and 3 respectively, expressed as X1, X2, and X3. Similarly, X1, X2, and X3 contain candidate indicator values at multiple time points.
[0054] Since the step sizes of the indicator values contained in the above time series Y, X1, X2 and X3 are not the same, for example, some of them are time series formed by collecting the indicator values at the time length granularity of seconds, and some of them are time series formed by collecting the indicator values at the time length granularity of minutes. In order to facilitate the subsequent model training, each time series can be further aggregated and missing values can be filled according to the preset time length granularity, so that the acquired time series have equal step sizes. For example, each time series is aggregated at the time length granularity of minutes, that is, the indicator values collected at the time length granularity of seconds are aggregated according to minutes, so as to obtain a time series with a step size of minutes (that is, time length granularity) to ensure that the step sizes of all time series are equal.
[0055] Some of the possible missing values can be filled by using methods such as adjacent means or interpolation, so that indicator data exists at every time point in the time series.
[0056] If the acquired time series have equal step lengths, there is no need to perform the above-mentioned aggregation process; if there are no missing values in the time series, there is no need to perform the above-mentioned filling process.
[0057] The process of training a linear regression model is actually the process of fitting the regression coefficient. Taking the i-th key indicator as an example, the linear regression model is trained using the time series Y, X1, X2 and X3. The linear regression model is used to use the candidate indicator values at time t and time t-1 and the key indicator value at time t-1 to predict the key indicator value at time t, where t is each moment in the abnormal period. If the time series is aggregated as described above, t is each moment after aggregation. It can be expressed as:
[0058]
[0059] in, is the predicted value of the key indicator at the tth moment, y t-1 is the key indicator value at the t-1th moment, X t-1 is a tensor composed of the candidate index values at the t-1th time (including the index values at the t-1th time in X1, X2, and X3), X t is a tensor consisting of the candidate index values at the tth moment. β0, β1 and β2 are regression coefficients, and ε is the error value.
[0060] In addition to the conventional linear regression model described above, a preferred implementation is provided herein, that is, applying LASSO penalty in the linear regression model, that is, adopting the LASSO linear regression model.
[0061] LASSO stands for Least absolute shrinkage and selection operator. It is a compression estimation method that constructs a norm as a penalty constraint to obtain a more refined linear regression model.
[0062] The corresponding model can be expressed as:
[0063]
[0064] Among them, λ(||β0||1+||β1||1+||β2||1) is the LASSO penalty term, and || ||1 represents the 1-norm, which is the sum of the absolute values of the vector elements.
[0065] The above linear regression model is trained moment by moment, and the training goal is to minimize the predicted value With the actual value y t The loss function can be designed according to the training objective, and the regression coefficients in the model are updated inversely according to the value of the loss function in each iteration until the preset iteration stop condition is met, such as the value of the loss function is less than or equal to the preset threshold, the number of iterations reaches the preset threshold, and so on.
[0066] By adopting the above method, a linear regression model can be constructed for each key indicator. The linear regression model corresponding to each key indicator reflects the influence of the candidate indicator corresponding to the key indicator on the key indicator during the abnormal period. The influence is reflected by the absolute value of the regression coefficient corresponding to the candidate indicator in the linear regression model. The larger the absolute value of the regression coefficient, the greater the influence of the corresponding candidate indicator, and the smaller the absolute value of the regression coefficient, the smaller the influence of the corresponding candidate indicator.
[0067] The above step 105, namely "screening the regression coefficients of each linear regression model obtained through training, and determining the root cause indicator using the candidate indicators corresponding to the regression coefficients that meet the preset conditions" is described in detail below in conjunction with the embodiments.
[0068] After the linear regression model training is completed, in theory, the root cause indicator has a much greater impact on the key indicator at time t than other candidate indicators, which is reflected in the absolute value of its corresponding regression coefficient being larger than the value of other candidate indicators. Based on this theory, the root cause indicator can be determined by screening based on the regression coefficient in this step (i.e., screening based on the above β1 and β2).
[0069] If a linear regression model is trained using the above formula (1), candidate indicators corresponding to regression coefficients whose absolute values are greater than or equal to a preset threshold can be selected during screening. The preset threshold can be a test value or an empirical value.
[0070] If the LASSO linear regression model is trained using the method such as the above formula (2), since the linear regression model adds the LASSO penalty in the function, its unique algorithm itself has a coefficient screening mechanism, which makes the regression coefficient of the candidate indicators with a certain influence non-zero. Therefore, when screening, the candidate indicators corresponding to the non-zero regression coefficients can be screened.
[0071] After the candidate indicators are screened, these candidate indicators can be directly used as root cause indicators, or other methods can be combined to further identify the root cause indicators from the screened candidate indicators. For example, the root cause indicators can be further identified from the screened candidate indicators manually. Since the number of screened candidate indicators is very limited, the labor cost is low.
[0072] After conducting experiments on abnormal SQL software systems, the LASSO linear regression model was able to effectively hit at least 11 of the 14 root cause indicators, with a high accuracy rate. In actual tests, due to the limited correspondence between key indicators and candidate indicators, only a limited number of model training sets were used to complete root cause location. The average training time for the model was 20 seconds, and the longest time was no more than one minute, which enabled rapid root cause location.
[0073] In addition, the method of regression coefficient screening is highly interpretable, and each regression coefficient can well reflect the impact of the root cause indicator on the abnormal system.
[0074] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0075] According to an embodiment of another aspect, a root cause locating device is provided. Figure 2 FIG. 1 is a schematic block diagram of a root cause location device according to an embodiment. It is understood that the device can be implemented by any device, equipment, platform, or device cluster with computing and processing capabilities. Figure 2As shown, the device 200 includes: an indicator acquisition unit 201, a model training unit 202 and a coefficient screening unit 203, and may further include a sequence optimization unit 204. The main functions of each component unit are as follows:
[0076] The indicator acquisition unit 201 is configured to acquire a key indicator set and a candidate indicator set of the abnormal system, wherein the key indicator set includes more than one key indicator, and the candidate indicator set includes more than one candidate indicator.
[0077] Among them, key indicators refer to indicators that can directly reflect and measure system abnormalities, and these indicators constitute key indicators and. Candidate indicators refer to indicators that may cause system abnormalities, and these indicators constitute the candidate indicator set.
[0078] The model training unit 202 is configured to execute each key indicator as a key indicator to be predicted based on the corresponding relationship between the key indicator and the candidate indicator: obtain the time series of the key indicator to be predicted within the abnormal period and the corresponding time series of one or more candidate indicators; use the obtained time series to train a linear regression model, wherein the linear regression model is used to use the candidate indicator values at time t and time t-1 and the key indicator value at time t-1 to predict the key indicator value at time t, where t is each moment within the abnormal period.
[0079] The so-called abnormal period refers to the period during which the analyzed system has an abnormality, and may also be a period that includes the period during which the analyzed system has an abnormality.
[0080] The model training unit 202 actually needs to construct a linear regression model for each key indicator, and each linear regression model is responsible for predicting a key indicator. Assuming there are m key indicators, then m linear regression models are constructed.
[0081] After constructing a linear regression model for each key indicator, the linear regression model corresponding to each key indicator reflects the degree of influence of the candidate indicator corresponding to the key indicator on the key indicator during the abnormal period. The degree of influence is reflected by the absolute value of the regression coefficient corresponding to the candidate indicator in the linear regression model. The larger the absolute value of the regression coefficient, the greater the influence of the corresponding candidate indicator, and the smaller the absolute value of the regression coefficient, the smaller the influence of the corresponding candidate indicator.
[0082] The coefficient screening unit 203 is configured to screen the regression coefficients of each linear regression model obtained through training, and determine the root cause indicator using the candidate indicators corresponding to the regression coefficients that meet the preset conditions.
[0083] As a preferred embodiment, the sequence optimization unit 204 is configured to aggregate and fill missing values of the time series obtained by the model training unit 202 according to a preset time length granularity, so that the obtained time series has equal step lengths for use by the model training unit 202 for training.
[0084] For example, each time series is aggregated with a duration granularity of minutes, that is, each indicator value collected with a duration granularity of seconds is aggregated according to minutes, so as to obtain a time series with a step length of minutes (that is, the duration granularity) to ensure that the step lengths of all time series are equal.
[0085] Some of the possible missing values can be filled by using methods such as adjacent means or interpolation, so that indicator data exists at every time point in the time series.
[0086] As one possible implementation method, if a common linear regression model is used, the above-mentioned preset condition may include: the absolute value of the regression coefficient is greater than or equal to a preset threshold.
[0087] As another preferred implementation, the linear function adopted by the linear regression model may apply LASSO penalty to the regression coefficient, that is, the LASSO linear regression model is trained, and the above-mentioned preset condition may include that the value of the regression coefficient is non-zero.
[0088] As a typical application scenario, the above embodiment can be used for root cause location of a SQL software system. The key indicator set in this scenario may include more than one tenant indicator, and the candidate indicator set may include more than one SQL indicator.
[0089] However, it should be noted that the above embodiments of this specification are not limited to this application scenario, and can be applied to root cause location of any other system.
[0090] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
[0091] It can be seen from the contents recorded in the above embodiments that the technical solution provided in this specification can have the following advantages:
[0092] 1) The regression coefficient of the linear regression model is trained to reflect the impact of each candidate indicator on the prediction of the key indicator in time series, and the regression coefficient is further screened to quickly and accurately locate the root cause.
[0093] 2) There is no need to manually compare a large number of indicators, which greatly reduces labor costs and improves the efficiency of root cause location.
[0094] 3) By screening the regression coefficients, the number of root cause indicators can be narrowed to a certain range, which provides a guarantee for the accuracy and response time of troubleshooting.
[0095] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 1 The method described.
[0096] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 1 The method described.
[0097] Figure 3 A schematic block diagram of a computing device 300 according to various embodiments is exemplarily shown. The device 300 may include one or more processors 302, a system control logic 301 coupled to at least one processor 302, a non-volatile memory (NMV) / storage 304 coupled to the system control logic 301, and a network interface 306 coupled to the system control logic 301.
[0098] The processor 302 may include one or more single-core processors or multi-core processors. The processor 302 may include any combination of general-purpose processors or special-purpose processors (such as image processors, application processors, baseband processors, etc.).
[0099] System control logic 301 in one embodiment may include any suitable interface controller to provide any suitable interface to at least one of processors 302 and / or to provide any suitable interface to any suitable device or component in communication with system control logic 301 .
[0100] In one embodiment, the system control logic 301 may include one or more memory controllers to provide an interface to the system memory 303. The system memory 303 is used to load and store data and / or instructions. For example, corresponding to the device 300, in one embodiment, the system memory 303 may include any suitable volatile memory.
[0101] NVM / memory 304 may include one or more tangible, non-transitory computer-readable media for storing data and / or executable code. For example, NVM / memory 304 may include any suitable non-volatile storage device, such as a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
[0102] NVM / storage 304 may include storage resources that are physically part of a device installed or accessible by the system, but not necessarily part of the device. For example, NVM / storage 304 may be network accessible via network interface 306 .
[0103] System memory 303 and NVM / storage 304 may each include executable code. The executable code may include instructions that, when executed by at least one of processors 302, cause device 300 to implement Figure 1 In various embodiments, executable code or hardware, firmware, and / or software components may additionally / alternatively be placed in the system control logic 301 , the network interface 306 , and / or the processor 302 .
[0104] The network interface 306 may include a receiver to provide a wireless interface for the device 300 to communicate with one or more networks and / or any suitable device. The network interface 306 may include any suitable hardware and / or firmware. The network interface 306 may include multiple antennas to provide a multiple-input multiple-output wireless interface. In one embodiment, the network interface 306 may include a network adapter, a wireless network adapter, a telephone modem, and / or a wireless modem.
[0105] In one embodiment, at least one of the processors 302 may be packaged with logic for one or more controllers for system control logic. In one embodiment, at least one of the processors may be packaged with logic for one or more controllers for system control logic to form a system-in-package. In one embodiment, at least one of the processors may be integrated on the same die with logic for one or more controllers for system control logic. In one embodiment, at least one of the processors may be integrated on the same die with logic for one or more controllers for system control logic to form a system-on-chip.
[0106] The device 300 may further include an input / output device 305. The input / output device 305 may include a user interface designed to allow a user to interact with the device 300, may include a peripheral component interface designed to enable peripheral components to interact with the system, and / or may include a sensor designed to determine environmental conditions and / or location information about the device 300.
[0107] Those skilled in the art should be aware that in one or more of the above examples, the functions described in this specification can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.
[0108] It should also be noted that the terms used in the embodiments of this specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms of "a", "said" and "the" used in the embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings.
[0109] The word "if" as used herein may be interpreted as "when" or "when" or "in response to" depending on the context.
[0110] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.
Claims
1. Root cause location methods include: Obtaining a key indicator set and a candidate indicator set of an abnormal system, wherein the key indicator set includes more than one key indicator, and the candidate indicator set includes more than one candidate indicator; wherein the key indicator is an indicator that directly reflects and measures the system abnormality, and the candidate indicator is an indicator that may cause the system abnormality; each key indicator corresponds to a candidate indicator; and a candidate indicator is not one of the key indicators; For each key indicator, based on the corresponding relationship between the key indicator and the candidate indicator, the key indicator is executed as the key indicator to be predicted: the time series of the current key indicator to be predicted within the abnormal period and the time series of more than one candidate indicator corresponding to the current key indicator to be predicted are obtained; a linear regression model is trained using the obtained key indicator time series and candidate indicator time series, wherein the linear regression model is used to predict the key indicator value at time t using the candidate indicator values at time t, time t-1 and the key indicator value at time t-1, wherein t is each time within the abnormal period, so that a linear regression model is obtained for each key indicator; the calculation formula of the linear regression model of each key indicator is: in, is the predicted value of the key indicator at the tth moment, y t-1 is the key indicator value at the t-1th moment, X t-1 is a tensor consisting of one or more candidate indicator values corresponding to the key indicator at the t-1th moment, X t is a tensor consisting of one or more candidate indicator values corresponding to the key indicator at the tth moment; β0, β1 and β2 are regression coefficients, and ε is the error value; The regression coefficients of the linear regression models obtained through training are screened, and the root cause indicators are determined by using the candidate indicators corresponding to the regression coefficients that meet the preset conditions among the candidate indicators.
2. The method according to claim 1, wherein: Before the method of using the acquired key indicator time series and candidate indicator time series to train the linear regression model, it also includes: The obtained key indicator time series and candidate indicator time series are respectively aggregated and filled with missing values according to the preset time length granularity, so that the obtained key indicator time series and candidate indicator time series have equal step lengths.
3. The method according to claim 1, wherein: The preset condition includes: the absolute value of the regression coefficient is greater than or equal to a preset threshold.
4. The method according to claim 1, wherein: The linear function adopted by the linear regression model imposes the least absolute shrinkage and selection operator penalty LASSO penalty on the regression coefficient; The preset condition includes that the value of the regression coefficient is non-zero.
5. The method according to any one of claims 1 to 4, wherein: The key indicator set includes more than one tenant indicator, and the candidate indicator set includes more than one SQL indicator.
6. Devices for root cause location, including: The indicator acquisition unit is configured to acquire a key indicator set and a candidate indicator set of the abnormal system, wherein the key indicator set includes more than one key indicator, and the candidate indicator set includes more than one candidate indicator; wherein the key indicator is an indicator that directly reflects and measures the system abnormality, and the candidate indicator is an indicator that may cause the system abnormality; each key indicator corresponds to a candidate indicator; and a candidate indicator is not one of the key indicators; The model training unit is configured to execute, for each key indicator, the key indicator as the key indicator to be predicted according to the corresponding relationship between the key indicator and the candidate indicator: obtain the time series of the current key indicator to be predicted within the abnormal period and the time series of more than one candidate indicator corresponding to the current key indicator to be predicted; train a linear regression model using the obtained key indicator time series and the candidate indicator time series, wherein the linear regression model is used to predict the key indicator value at time t using the candidate indicator values at time t and time t-1 and the key indicator value at time t-1, wherein t is each time within the abnormal period, so that a linear regression model is obtained for each key indicator; the calculation formula of the linear regression model of each key indicator is: in, is the predicted value of the key indicator at the tth moment, y t-1 is the key indicator value at the t-1th moment, X t-1 is a tensor consisting of one or more candidate indicator values corresponding to the key indicator at the t-1th moment, X t is a tensor consisting of one or more candidate indicator values corresponding to the key indicator at the tth moment; β0, β1 and β2 are regression coefficients, and ε is the error value; The coefficient screening unit is configured to screen the regression coefficients of each linear regression model obtained through training, and determine the root cause indicator using the candidate indicator corresponding to the regression coefficient that meets the preset conditions among the candidate indicators.
7. The apparatus according to claim 6, further comprising: The sequence optimization unit is configured to aggregate and fill missing values of the key indicator time series and candidate indicator time series obtained by the model training unit according to a preset time granularity, so that the obtained key indicator time series and candidate indicator time series have equal step lengths for use in training by the model training unit.
8. The device according to claim 6, wherein: The preset conditions include: the absolute value of the regression coefficient is greater than or equal to a preset threshold; and / or, The linear function adopted by the linear regression model applies the least absolute shrinkage and selection operator penalty LASSO penalty to the regression coefficient, and the preset condition includes that the value of the regression coefficient is non-zero.
9. The device according to any one of claims 6 to 8, wherein: The key indicator set includes more than one tenant indicator, and the candidate indicator set includes more than one SQL indicator.
10. A computing device comprising a memory and a processor, characterized in that: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 5 is implemented.