A root cause analysis method and device

Abstract

The present invention provides a root cause analysis method and device. When a single-node root cause algorithm mode is enabled, the correlation probability between other data indicators of an abnormal server node and abnormal data indicators within the alarm time period is calculated and displayed. When a multi-indicator root cause algorithm mode is enabled, a random walk is performed on the call relationship graph corresponding to the abnormal server node using multiple first data indicators of the abnormal server node within the alarm time period and multiple second data indicators of other server nodes within the alarm time period, and the arrival frequency of each other server node is obtained and displayed. Multiple modes are provided for root cause analysis, and multi-data indicator tracing is supported to improve the accuracy of fault determination and meet multiple business scenarios.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and in particular to a root cause analysis method and device. Background Art

[0002] Currently, more and more companies are transforming their applications into microservices, breaking down a single application into several microservices. To ensure the normal operation of the business, when an abnormality occurs in the business, it is necessary to identify the fault in a timely manner.

[0003] Currently, we mainly rely on public cloud anomaly root cause analysis algorithms to determine faults. However, public cloud anomaly root cause analysis algorithms only support single-indicator tracing, such as using only memory usage or CPU usage to roughly determine anomalies. When servers are called, they usually use different microservices, and different microservices require different indicators to measure anomalies. Therefore, the accuracy of public cloud anomaly root cause analysis algorithms in determining faults is low. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a root cause analysis method and device to solve the problem that the public cloud abnormal root cause analysis algorithm has a low accuracy rate in determining faults.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] A first aspect of an embodiment of the present invention discloses a root cause analysis method, the method comprising:

[0007] Obtain at least the abnormal data indicators and alarm time period corresponding to the abnormal server node from the alarm platform;

[0008] When the single-node root cause algorithm mode is enabled, calculating the correlation probability between other data indicators of the abnormal server node within the alarm time period and the abnormal data indicator;

[0009] Sending the calculated correlation probability to the alarm platform for display;

[0010] In the case where the multi-indicator root cause algorithm mode is enabled, determining a call relationship graph corresponding to the abnormal server node, wherein the call relationship graph is composed of the abnormal server node and other server nodes;

[0011] Acquire a plurality of first data indicators of the abnormal server node within the alarm time period, and acquire a plurality of second data indicators of the other server nodes within the alarm time period;

[0012] Determining a data correlation coefficient between the abnormal server node and the other server nodes according to the first data indicator and the second data indicator;

[0013] According to the data association coefficient, starting from the abnormal server node, a random walk is performed on the relationship call graph to obtain the arrival frequency of each of the other server nodes;

[0014] The arrival frequency of each of the other server nodes is sent to the alarm platform for display.

[0015] Preferably, when the multi-indicator root cause algorithm mode is enabled, determining the call relationship graph corresponding to the abnormal server node includes:

[0016] When the multi-indicator root cause algorithm mode is enabled, the call request data corresponding to the abnormal server node is obtained from the database, and the port information of the abnormal server node is scanned, where the port information indicates the connection relationship between the abnormal server node and other server nodes;

[0017] A call relationship graph corresponding to the abnormal server node is constructed according to the call request data and / or the port information.

[0018] Preferably, according to the data association coefficient, starting from the abnormal server node, a random walk is performed on the relationship call graph to obtain the arrival frequency of each of the other server nodes, including:

[0019] For any pair of adjacent server nodes in the relationship call graph, calculating the transition probability between the any pair of adjacent server nodes according to the data association coefficient;

[0020] Constructing a transition probability matrix using all the calculated transition probabilities;

[0021] According to the transition probability matrix, a random walk is performed on the relationship call graph starting from the abnormal server node to obtain the arrival frequency of each of the other server nodes.

[0022] Preferably, after obtaining a plurality of first data indicators of the abnormal server node within the alarm time period, and obtaining a plurality of second data indicators of the other server nodes within the alarm time period, the method further includes:

[0023] The plurality of first data indicators and the plurality of second data indicators are interpolated and filtered.

[0024] Preferably, sending the arrival frequency of each of the other server nodes to the alarm platform for display includes:

[0025] The arrival frequency of each of the other server nodes is sorted, and the sorting result is sent to the alarm platform for display.

[0026] A second aspect of an embodiment of the present invention discloses a root cause analysis device, the device comprising:

[0027] A first acquisition unit is used to obtain at least an abnormal data indicator and an alarm time period corresponding to an abnormal server node from an alarm platform;

[0028] A first processing unit, configured to calculate, when a single-node root cause algorithm mode is enabled, a correlation probability between other data indicators of the abnormal server node within the alarm time period and the abnormal data indicator;

[0029] A first display unit, used for sending the calculated correlation probability to the alarm platform for display;

[0030] A second processing unit is used to determine a call relationship graph corresponding to the abnormal server node when a multi-indicator root cause algorithm mode is enabled, wherein the call relationship graph is composed of the abnormal server node and other server nodes;

[0031] A second acquisition unit, configured to acquire a plurality of first data indicators of the abnormal server node within the alarm time period, and to acquire a plurality of second data indicators of the other server nodes within the alarm time period;

[0032] a determining unit, configured to determine a data correlation coefficient between the abnormal server node and the other server nodes according to the first data indicator and the second data indicator;

[0033] A random walk unit, configured to perform a random walk on the relationship call graph starting from the abnormal server node according to the data association coefficient, to obtain an arrival frequency of each of the other server nodes;

[0034] The second display unit is used to send the arrival frequency of each of the other server nodes to the alarm platform for display.

[0035] Preferably, the second processing unit is specifically used to: when the multi-indicator root cause algorithm mode is enabled, obtain the call request data corresponding to the abnormal server node from the database, and scan the port information of the abnormal server node, the port information indicating the connection relationship between the abnormal server node and other server nodes; and construct a call relationship graph corresponding to the abnormal server node based on the call request data and / or the port information.

[0036] Preferably, the random walk unit is specifically used to: for any pair of adjacent server nodes in the relationship call graph, calculate the transfer probability between the any pair of adjacent server nodes according to the data association coefficient; construct a transfer probability matrix using all the calculated transfer probabilities; and based on the transfer probability matrix, perform a random walk on the relationship call graph starting from the abnormal server node to obtain the arrival frequency of each of the other server nodes.

[0037] A third aspect of an embodiment of the present invention discloses an electronic device, comprising: a processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; and the memory is used to store a program, wherein the program is used to implement the root cause analysis method disclosed in the first aspect of the embodiment of the present invention.

[0038] A fourth aspect of an embodiment of the present invention discloses a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute the root cause analysis method disclosed in the first aspect of the embodiment of the present invention.

[0039] Based on the above-mentioned embodiment of the present invention, a root cause analysis method and device are provided. The method is as follows: at least the abnormal data index and alarm time period corresponding to the abnormal server node are obtained from the alarm platform; when the single-node root cause algorithm mode is enabled, the correlation probability between other data indicators of the abnormal server node and the abnormal data index within the alarm time period is calculated; the calculated correlation probability is sent to the alarm platform for display; when the multi-indicator root cause algorithm mode is enabled, the call relationship graph corresponding to the abnormal server node is determined; multiple first data indicators of the abnormal server node within the alarm time period are obtained, and multiple second data indicators of other server nodes within the alarm time period are obtained; according to the first data indicator and the second data indicator, the data correlation coefficient between the abnormal server node and other server nodes is determined; according to the data correlation coefficient, a random walk is performed on the relationship call graph starting from the abnormal server node to obtain the arrival frequency of each other server node; the arrival frequency of each other server node is sent to the alarm platform for display. In this scheme, when the single-node root cause algorithm mode is enabled, the correlation probability between other data indicators of the abnormal server node within the alarm time period and the abnormal data indicator is calculated and displayed. When the multi-indicator root cause algorithm mode is enabled, the call relationship graph corresponding to the abnormal server node is randomly walked using multiple first data indicators of the abnormal server node within the alarm time period and multiple second data indicators of other server nodes within the alarm time period, and the arrival frequency of each other server node is obtained and displayed. It supports multiple modes for root cause analysis and supports multi-data indicator tracing, which improves the accuracy of fault determination and meets various business scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0041] Figure 1 A schematic diagram of the architecture of the aviation information algorithm platform provided by an embodiment of the present invention;

[0042] Figure 2 A flow chart of a root cause analysis method provided by an embodiment of the present invention;

[0043] Figure 3 An example diagram of a call relationship diagram provided by an embodiment of the present invention;

[0044] Figure 4 A structural block diagram of a root cause analysis device provided by an embodiment of the present invention;

[0045] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0048] As can be seen from the background technology, currently the public cloud anomaly root cause analysis algorithm is mainly relied on to determine the fault. However, since the public cloud anomaly root cause analysis algorithm only supports single indicator tracing, and the server usually uses different microservices when calling, different microservices require different indicators to measure anomalies. The accuracy of the public cloud anomaly root cause analysis algorithm in determining faults is low.

[0049] Therefore, an embodiment of the present invention provides a root cause analysis method and device. When the single-node root cause algorithm mode is enabled, the correlation probability between other data indicators of the abnormal server node within the alarm time period and the abnormal data indicator is calculated and displayed. When the multi-indicator root cause algorithm mode is enabled, the call relationship graph corresponding to the abnormal server node is randomly walked using multiple first data indicators of the abnormal server node within the alarm time period and multiple second data indicators of other server nodes within the alarm time period, and the arrival frequency of each other server node is obtained and displayed. Multiple modes are supported for root cause analysis, and multiple data indicator tracing is supported to improve the accuracy of fault determination and meet various business scenarios.

[0050] It should be noted that the root cause analysis method and device provided in the embodiment of the present invention can be applied to a corresponding algorithm platform, such as an aviation information algorithm platform; the aviation information algorithm platform can provide a variety of algorithm modes, such as Figure 1The schematic diagram of the architecture of the Air Information Algorithm Platform is shown. The Air Information Algorithm Platform at least includes a single-node root cause algorithm mode, a single-indicator root cause algorithm mode, a multi-indicator root cause algorithm mode and other algorithm modes. The specific operation mode is: obtain relevant data from the database, select and enable the single-node root cause algorithm mode (also known as the single-node multi-indicator root cause algorithm mode), the single-indicator root cause algorithm mode or the multi-indicator root cause algorithm mode to calculate the relevant data, store the calculation results in the database, and display the calculation results in the alarm platform.

[0051] It can be understood that the root cause analysis method mentioned in the following embodiments of the present invention is mainly an explanation of the data processing flow of the single-node root cause algorithm mode and the multi-indicator root cause algorithm mode. For details, please refer to the contents of the following embodiments.

[0052] See also Figure 2 , shows a flow chart of a root cause analysis method provided by an embodiment of the present invention, the root cause analysis method comprising:

[0053] Step S201: obtaining at least the abnormal data index and alarm time period corresponding to the abnormal server node from the alarm platform.

[0054] It should be noted that the application performance monitoring system collects various data indicators of each server node every minute (for example only, other time granularity is also possible) and stores them in the database, for example: collecting data indicators such as memory usage, CPU idle data and network connection. The alarm platform obtains various data indicators of each server node from the database, and enables the pre-set anomaly detection algorithm mode to analyze whether anomalies occur, and determines abnormal data indicators (or alarm data indicators). When multiple anomalies occur in a continuous period of time, for example, when two or more anomalies occur within 5 minutes, the alarm platform will send an alarm email to the front end.

[0055] In the process of implementing step S201, the alarm platform is called to obtain at least the node name, abnormal data indicators and alarm time period corresponding to the abnormal server node from the alarm platform. It can be understood that the cluster name where the abnormal server node is located can also be obtained from the alarm platform. The content that can be obtained from the alarm platform is not illustrated one by one here.

[0056] It should be noted that the algorithm modes such as the single-node root cause algorithm mode and the multi-indicator root cause algorithm mode mentioned above can be provided through gRPC (a PRC framework). Specifically, the algorithm platform can call the single-node root cause algorithm mode and the multi-indicator root cause algorithm mode by calling the gRPC algorithm service, and then perform root cause analysis based on the content obtained from the alarm platform, and enable the alarm platform to process and display the results of the root cause analysis by calling the gRPC algorithm service.

[0057] After obtaining the node name, abnormal data indicator and alarm time period corresponding to the abnormal server node from the alarm platform, the number of server nodes to be processed is determined according to the actual application scenario; when the number of server nodes to be processed is 1, the single-node root cause algorithm mode is enabled; when the number of server nodes to be processed is not 1, the multi-indicator root cause algorithm mode is enabled. It can be understood that the multi-indicator root cause algorithm mode can also be used to process the case of multiple nodes and a single indicator.

[0058] When the single-node root cause algorithm mode is enabled, steps S202 to S203 are executed; when the multi-indicator root cause algorithm mode is enabled, steps S204 to S208 are executed.

[0059] Step S202: When the single-node root cause algorithm mode is enabled, the correlation probability between other data indicators of the abnormal server node within the alarm time period and the abnormal data indicator is calculated.

[0060] It is understandable that when the single-node root cause algorithm mode is enabled, there is no need to use a call relationship graph. In the specific implementation of step S202, when the single-node root cause algorithm mode is enabled, the abnormal data indicators of the abnormal server node and other data indicators within the alarm time period are obtained.

[0061] The correlation probability (or correlation) between the abnormal data indicator and other data indicators of the abnormal server node is calculated by formula (1).

[0062]

[0063] In formula (1), abnormal is the abnormal data indicator, metric is other data indicators, and time t s to e is the alarm time period, Cov is the covariance, σ is the variance, R(metric,abnormal,t s ,t e ) represents the correlation probability between other data indicators and abnormal data indicators within the alarm time period.

[0064] It can be understood that for any other data indicator, the higher the correlation probability between the other data indicator and the abnormal data indicator (i.e., the value of R), the closer the other data indicator and the abnormal data indicator are during the alarm time period, and thus the greater the possibility that the other data indicator is the root cause of the abnormality of the abnormal server node.

[0065] In some specific embodiments, since all other data indicators are taken into consideration, after calculating the relevant probabilities corresponding to each other data indicator, the calculated relevant probabilities are normalized, and the normalized values ​​are the probabilities that the other data indicators are the root causes (the fundamental causes of the abnormal server node abnormality).

[0066] Step S203: Send the calculated related probability to the alarm platform for display.

[0067] In the specific implementation of step S203, after calculating the correlation probabilities of each other data indicator and the abnormal data indicator within the alarm time period, the relevant probabilities are sorted from high to low, and the sorting results are sent to the alarm platform for display, that is, the alarm platform displays the relevant probabilities in order from high to low. The user can check the root cause of the abnormal server node from the relevant probabilities displayed by the alarm platform, thereby helping the user to solve the abnormality.

[0068] Step S204: When the multi-indicator root cause algorithm mode is enabled, determine the call relationship graph corresponding to the abnormal server node.

[0069] It should be noted that the call relationship graph is composed of abnormal server nodes and other server nodes.

[0070] It is understandable that the application performance monitoring system can build a call relationship graph of the server nodes by collecting the call request data and port information of the server nodes in the database.

[0071] In the process of specifically implementing step S204, when the multi-indicator root cause algorithm mode is enabled, the application performance monitoring system is called to obtain the call request data corresponding to the abnormal server node from the database, and the port information of the abnormal server node is scanned. The port information indicates the connection relationship between the abnormal server node and other server nodes, and the call request data represents the call link of the abnormal server node; based on the call request data and / or port information, a call relationship graph corresponding to the abnormal server node is constructed.

[0072] It can be understood that if all call request data of the abnormal server node are monitored and recorded by the application performance monitoring system, the call request data of the abnormal server node can be directly used to construct a call relationship graph; but if the abnormal server node is not included in the monitoring, the port information can be used to construct a call relationship graph corresponding to the abnormal server node (this is equivalent to an undirected graph); if the call request data of the abnormal server node is lost, the call request data and port information can be combined to construct a call relationship graph corresponding to the abnormal server node.

[0073] It should be noted that the call relationship graph corresponding to the abnormal server node is an acyclic graph G = (V, E), where V is the set of the abnormal server node and other server nodes, and E is the set of edges in the call relationship graph, where each edge in E may be a directed edge or an undirected edge. For undirected edges, the starting point and end point can be set randomly. The example diagram of the call relationship graph is as follows: Figure 3 shown.

[0074] Figure 3 In the figure, V is {A, B, C, D, E, F}, and E is {(A, B), (A, D), …, (C, F)}. For the edge connecting two server nodes, the server node at the arrow of the directed edge is affected by the server node at the undirected edge. The undirected edge indicates that the two server nodes affect each other or the direction of influence is uncertain.

[0075] It should be noted that, for two server nodes in the call relationship graph, if there is a call relationship between the two server nodes (that is, one server node is the caller and the other server node is the callee), then the edge between the two server nodes in the call relationship graph is a directed edge; if there is no call relationship between the two server nodes but there is a port connection relationship, then the edge between the two server nodes in the call relationship graph is an undirected edge.

[0076] Step S205: Acquire a plurality of first data indicators of the abnormal server node within the alarm time period, and acquire a plurality of second data indicators of other server nodes within the alarm time period.

[0077] It should be noted that the application performance monitoring system will collect data indicators of each server node and store them in the database. Other server nodes are server nodes other than the abnormal server node in the call relationship graph.

[0078] In the specific implementation of step S205, multiple (n) first data indicators of the abnormal server node within the alarm time period are obtained, and multiple (m) second data indicators of other server nodes within the alarm time period are obtained. The obtained first data indicators and second data indicators are packaged into a string (such as a json string). When the multi-index root cause algorithm mode is enabled, the string is a multiindex multidimensional matrix, which can be directly used for analysis in the root cause analysis algorithm.

[0079] Preferably, multiple first data indicators and multiple second data indicators are interpolated and filtered. In a specific implementation, a string packaged by the first data indicator and the second data indicator is substituted into the root cause analysis algorithm corresponding to the multi-indicator root cause algorithm mode, and the root cause analysis algorithm parses the string and interpolates and filters multiple first data indicators and multiple second data indicators. Among them, the interpolation process is: interpolating null values ​​and filling null values ​​backward and forward; the filtering process is: filtering out the variables required by the root cause analysis algorithm.

[0080] It is understandable that after the first data indicator and the second data indicator are interpolated, the columns that are still null values ​​are deleted.

[0081] Step S206: Determine the data correlation coefficient between the abnormal server node and other server nodes according to the first data indicator and the second data indicator.

[0082] In the process of implementing step S206, after obtaining m second data indicators of each other server node within the alarm time period, for each other server node, the data correlation coefficient between the abnormal server node and the other server node is calculated using the n first data indicators of the abnormal server node and the m second data indicators of the other server node; specifically, the data correlation coefficient between the abnormal server node and the other server node is calculated using formula (2).

[0083]

[0084] In formula (2), abnormal j is the jth first data indicator of the abnormal server node (referred to as abnormal here), metric i is the ith second data indicator of some other server node (here denoted by metric), R(metric,abnormal,t s ,t e ) represents the data correlation coefficient between the abnormal server node and some other server node, time t s to e is the alarm time period, Cov is the covariance, and σ is the variance.

[0085] It can be understood that, for a certain other server node, in the process of using formula (2) to calculate the data correlation coefficient between the abnormal server node and the other server node, m*n values ​​can be obtained, and the maximum value among the m*n values ​​is used as the data correlation coefficient between the abnormal server node and the other server node.

[0086] For a certain other server node, the larger the data correlation coefficient between the abnormal server node and the other server node, the closer the other server node is to the abnormal server node during the alarm period, and the greater the possibility that the other server node is the root cause of the abnormality of the abnormal server node. In the above manner, the data correlation coefficient between each other server node and the abnormal server node in the call relationship graph is calculated.

[0087] It is worth noting that for a certain other server node whose data association coefficient is calculated, the other server node may not be connected to the abnormal server node in the call relationship graph, or the other server node and the abnormal server node are in different branches in the call relationship graph; therefore, it is not accurate to perform anomaly analysis only through the data association coefficient between the other server node and the abnormal server node, and it is necessary to screen the data association coefficients between each other server node and the abnormal server node through the call relationship graph, see the content of step S207 for details.

[0088] Step S207: Based on the data association coefficient, a random walk is performed on the relationship call graph starting from the abnormal server node to obtain the arrival frequency of each other server node.

[0089] It should be noted that the random walk of the relationship call graph starting from the abnormal server node specifically means: starting from the abnormal server node, moving forward or backward on the relationship call graph with a given probability distribution, and counting the number of arrivals at each other server node in the relationship call graph; in a random walk of the relationship call graph (usually requiring thousands of steps), the more arrivals at other server nodes, the greater the probability of being the root cause of the abnormality of the abnormal server node.

[0090] In the specific implementation of step S207, for any pair of adjacent server nodes in the relationship call graph, the transfer probability between the pair of adjacent server nodes is calculated according to the data association coefficient. Specifically, for any pair of adjacent server nodes in the relationship call graph, the transfer probability between the pair of adjacent server nodes is calculated using the data association coefficient between the pair of adjacent server nodes and the abnormal server node. A transfer probability matrix is ​​constructed using all calculated transfer probabilities; based on the transfer probability matrix, a random walk is performed on the relationship call graph starting from the abnormal server node to obtain the arrival frequency of each other server node.

[0091] In some specific embodiments, for any pair of adjacent server nodes i and server nodes j in the relationship call graph, the transition probability Q between server nodes i and server nodes j is calculated by formula (3): ij .

[0092]

[0093] In formula (3), R(i, abnormal) is the data association coefficient between server node i and the abnormal server node calculated by formula (2), R(k, abnormal) is the data association coefficient between server node k and the abnormal server node calculated by formula (2), server node k is all server nodes connected to server node j, ρ is the penalty coefficient, (i, j) is the edge between server node i and server node j, and E is the relationship call graph.

[0094] It should be noted that since the callee (the called server node) is more likely to be the root cause of the caller (the server node that initiates the call), a penalty coefficient ρ is required to reduce the probability of the wandering item returning to the callee during wandering, that is, the impact of the call relationship during control transfer.

[0095] It is worth noting that after repeated research and verification by the inventor, it is found that random walks on the relationship call graph are directional. When the value of the penalty coefficient ρ is small, the random walk tends to increase the probability of reaching deep server nodes in a single direction, and can find the deepest root cause. However, this situation has the following disadvantages: the random walk may mistakenly fall into a branch and fail to take into account other branches, which leads to failure in finding the root cause. When the value of the penalty coefficient ρ is large, the random walk weakens the trend of in-depth exploration, and it is difficult to find the deep-seated reasons that cause abnormal server nodes to be abnormal. Therefore, it is necessary to determine the optimal penalty coefficient ρ by calling the root cause analysis algorithm multiple times. Preferably, the penalty coefficient ρ can be set to 0.3. The specific value of the penalty coefficient ρ can be adjusted according to actual conditions and is not limited here.

[0096] In the above formula (3), if the edge (i, j) between server node i and server node j is a directed edge, the penalty coefficient ρ can be a specified value, and the penalty coefficient ρ can be set to 0.3 by default; if (i, j) is an undirected edge, (i, j) can be regarded as a directed edge with ρ = 1, so that the call relationship graph is converted into a directed acyclic graph.

[0097] It should be noted that when calculating the transition probability Q ij After that, it needs to be normalized, and only after normalization can it be truly represented as a transition probability.

[0098] In some specific embodiments, a transition probability matrix is ​​constructed using all calculated transition probabilities. According to the transition probability matrix, a random walk is performed on the relationship call graph starting from the abnormal server node. During the random walk, each walk will reach another server node. For a certain other server node, after the walk is completed, the number of arrivals to the other server node is counted. After the number of arrivals of each other server node is obtained, the arrival frequency of each other server node is calculated in an equal proportion. The calculated arrival frequency can be used as a basis for locating the root cause of the abnormality of the abnormal server node.

[0099] Step S208: Send the arrival frequency of each other server node to the alarm platform for display.

[0100] In the specific implementation of step S208, after the arrival frequency of each other server node is calculated, the arrival frequency of each other server node is stored in the database. After receiving the request sent by the user, the arrival frequency of each other server node is sorted (such as sorted in descending order of arrival frequency), and the sorting result is sent to the alarm platform for display. The user can learn the arrival frequency of each other server node after sorting in the alarm platform, and check the root cause of the abnormality of the abnormal server node, thereby helping the user to solve the abnormality.

[0101] In some specific embodiments, the arrival frequency of each other server node stored in the database is a json string. When a user request is received, the json string can be parsed into a data table, which contains the arrival frequency of each other server node. The arrival frequency of each other server node needs to be sorted before display.

[0102] In an embodiment of the present invention, when the single-node root cause algorithm mode is enabled, the correlation probability between other data indicators and abnormal data indicators of the abnormal server node within the alarm time period is calculated and displayed. When the multi-indicator root cause algorithm mode is enabled, the call relationship graph corresponding to the abnormal server node is randomly walked using multiple first data indicators of the abnormal server node within the alarm time period and multiple second data indicators of other server nodes within the alarm time period, and the arrival frequency of each other server node is obtained and displayed. Multiple modes are supported for root cause analysis, and multiple data indicator tracing is supported to improve the accuracy of fault determination and meet various business scenarios.

[0103] Corresponding to a root cause analysis method provided by the above embodiment of the present invention, see Figure 4, the embodiment of the present invention further provides a structural block diagram of a root cause analysis device, the root cause analysis device includes: a first acquisition unit 401, a first processing unit 402, a first display unit 403, a second processing unit 404, a second acquisition unit 405, a determination unit 406, a random walk unit 407 and a second display unit 408;

[0104] The first acquisition unit 401 is used to acquire at least an abnormal data indicator and an alarm time period corresponding to an abnormal server node from an alarm platform.

[0105] The first processing unit 402 is used to calculate the correlation probability between other data indicators and the abnormal data indicator of the abnormal server node within the alarm time period when the single-node root cause algorithm mode is enabled.

[0106] The first display unit 403 is used to send the calculated related probability to the alarm platform for display.

[0107] The second processing unit 404 is used to determine a call relationship graph corresponding to the abnormal server node when the multi-indicator root cause algorithm mode is enabled, where the call relationship graph is composed of the abnormal server node and other server nodes.

[0108] In the specific implementation, the second processing unit is specifically used to: when the multi-indicator root cause algorithm mode is enabled, obtain the call request data corresponding to the abnormal server node from the database, and scan the port information of the abnormal server node, the port information indicates the connection relationship between the abnormal server node and other server nodes; construct a call relationship graph corresponding to the abnormal server node based on the call request data and / or port information.

[0109] The second acquisition unit 405 is used to acquire a plurality of first data indicators of the abnormal server node within the alarm time period, and to acquire a plurality of second data indicators of other server nodes within the alarm time period.

[0110] Preferably, the second acquisition unit 405 is further used for: performing interpolation processing and screening processing on the plurality of first data indicators and the plurality of second data indicators.

[0111] The determination unit 406 is used to determine the data correlation coefficient between the abnormal server node and other server nodes according to the first data indicator and the second data indicator.

[0112] The random walk unit 407 is used to perform a random walk on the relationship call graph starting from the abnormal server node according to the data association coefficient to obtain the arrival frequency of each other server node.

[0113] In a specific implementation, the random walk unit 407 is specifically used to: for any pair of adjacent server nodes in the relationship call graph, calculate the transition probability between any pair of adjacent server nodes according to the data association coefficient; construct a transition probability matrix using all calculated transition probabilities; and based on the transition probability matrix, perform a random walk on the relationship call graph starting from the abnormal server node to obtain the arrival frequency of each other server node.

[0114] The second display unit 408 is used to send the arrival frequency of each other server node to the alarm platform for display.

[0115] In a specific implementation, the second display unit 408 is specifically used to sort the arrival frequency of each other server node, and send the sorting result to the alarm platform for display.

[0116] In an embodiment of the present invention, when the single-node root cause algorithm mode is enabled, the correlation probability between other data indicators and abnormal data indicators of the abnormal server node within the alarm time period is calculated and displayed. When the multi-indicator root cause algorithm mode is enabled, the call relationship graph corresponding to the abnormal server node is randomly walked using multiple first data indicators of the abnormal server node within the alarm time period and multiple second data indicators of other server nodes within the alarm time period, and the arrival frequency of each other server node is obtained and displayed. Multiple modes are supported for root cause analysis, and multiple data indicator tracing is supported to improve the accuracy of fault determination and meet various business scenarios.

[0117] An embodiment of the present invention also provides an electronic device, which includes: a processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; and the memory is used to store a program, wherein the program is used to implement a root cause analysis method.

[0118] Reference below Figure 5 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. The electronic device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0119] like Figure 5As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 506 into a random access memory (RAM) 503. In RAM 503, various programs and data required for the operation of the electronic device are also stored. The processing device 501, ROM 502, and RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0120] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0121] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0122] Furthermore, an embodiment of the present invention also provides a computer-readable storage medium, in which computer-executable instructions are stored, and the computer-executable instructions are used to execute the root cause analysis method.

[0123] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: when the single-node root cause algorithm mode is enabled, the correlation probability between other data indicators of the abnormal server node and the abnormal data indicator within the alarm time period is calculated and displayed. When the multi-indicator root cause algorithm mode is enabled, a random walk is performed on the call relationship graph corresponding to the abnormal server node using multiple first data indicators of the abnormal server node within the alarm time period and multiple second data indicators of other server nodes within the alarm time period, and the arrival frequency of each other server node is obtained and displayed.

[0124] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0125] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0126] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0127] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0128] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A root cause analysis method, characterized in that: The method comprises: Obtain at least the abnormal data indicators and alarm time period corresponding to the abnormal server node from the alarm platform; When the single-node root cause algorithm mode is enabled, calculating the correlation probability between other data indicators of the abnormal server node within the alarm time period and the abnormal data indicator; Sending the calculated correlation probability to the alarm platform for display; In the case where the multi-indicator root cause algorithm mode is enabled, determining a call relationship graph corresponding to the abnormal server node, wherein the call relationship graph is composed of the abnormal server node and other server nodes; Acquire a plurality of first data indicators of the abnormal server node within the alarm time period, and acquire a plurality of second data indicators of the other server nodes within the alarm time period; Determining a data correlation coefficient between the abnormal server node and the other server nodes according to the first data indicator and the second data indicator; According to the data association coefficient, starting from the abnormal server node, a random walk is performed on the relationship call graph to obtain the arrival frequency of each of the other server nodes; The arrival frequency of each of the other server nodes is sent to the alarm platform for display.

2. The method according to claim 1, characterized in that When the multi-indicator root cause algorithm mode is enabled, determining the call relationship graph corresponding to the abnormal server node includes: When the multi-indicator root cause algorithm mode is enabled, the call request data corresponding to the abnormal server node is obtained from the database, and the port information of the abnormal server node is scanned, where the port information indicates the connection relationship between the abnormal server node and other server nodes; A call relationship graph corresponding to the abnormal server node is constructed according to the call request data and / or the port information.

3. The method according to claim 1, characterized in that: According to the data association coefficient, starting from the abnormal server node, a random walk is performed on the relationship call graph to obtain the arrival frequency of each of the other server nodes, including: For any pair of adjacent server nodes in the relationship call graph, calculating the transition probability between the any pair of adjacent server nodes according to the data association coefficient; Constructing a transition probability matrix using all the calculated transition probabilities; According to the transition probability matrix, a random walk is performed on the relationship call graph starting from the abnormal server node to obtain the arrival frequency of each of the other server nodes.

4. The method according to claim 1, characterized in that: After obtaining a plurality of first data indicators of the abnormal server node within the alarm time period, and obtaining a plurality of second data indicators of the other server nodes within the alarm time period, the method further includes: The plurality of first data indicators and the plurality of second data indicators are interpolated and filtered.

5. The method according to claim 1, characterized in that Sending the arrival frequency of each of the other server nodes to the alarm platform for display, including: The arrival frequency of each of the other server nodes is sorted, and the sorting result is sent to the alarm platform for display.

6. A root cause analysis device, characterized in that: The device comprises: A first acquisition unit is used to obtain at least an abnormal data indicator and an alarm time period corresponding to an abnormal server node from an alarm platform; A first processing unit, configured to calculate, when a single-node root cause algorithm mode is enabled, a correlation probability between other data indicators of the abnormal server node within the alarm time period and the abnormal data indicator; A first display unit, used for sending the calculated correlation probability to the alarm platform for display; A second processing unit is used to determine a call relationship graph corresponding to the abnormal server node when a multi-indicator root cause algorithm mode is enabled, wherein the call relationship graph is composed of the abnormal server node and other server nodes; A second acquisition unit, configured to acquire a plurality of first data indicators of the abnormal server node within the alarm time period, and to acquire a plurality of second data indicators of the other server nodes within the alarm time period; a determining unit, configured to determine a data correlation coefficient between the abnormal server node and the other server nodes according to the first data indicator and the second data indicator; A random walk unit, configured to perform a random walk on the relationship call graph starting from the abnormal server node according to the data association coefficient, to obtain an arrival frequency of each of the other server nodes; The second display unit is used to send the arrival frequency of each of the other server nodes to the alarm platform for display.

7. The device according to claim 6, characterized in that The second processing unit is specifically used to: when the multi-indicator root cause algorithm mode is enabled, obtain the call request data corresponding to the abnormal server node from the database, and scan the port information of the abnormal server node, the port information indicating the connection relationship between the abnormal server node and other server nodes; and construct a call relationship graph corresponding to the abnormal server node based on the call request data and / or the port information.

8. The device according to claim 6, characterized in that The random walk unit is specifically used to: for any pair of adjacent server nodes in the relationship call graph, calculate the transfer probability between the any pair of adjacent server nodes according to the data association coefficient; construct a transfer probability matrix using all the calculated transfer probabilities; and based on the transfer probability matrix, perform a random walk on the relationship call graph starting from the abnormal server node to obtain the arrival frequency of each of the other server nodes.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; The memory is used to store a program, and the program is used to implement the root cause analysis method as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute the root cause analysis method described in any one of claims 1-5.

Images