Problem positioning method, apparatus, device, medium, and program product

Abstract

The present disclosure provides a problem positioning method, which can be applied to the field of artificial intelligence technology. The problem positioning method comprises: acquiring monitoring data and production logs of each production node in a production environment in real time; when the monitoring data indicates an alarm, extracting feature values of the monitoring data and the production logs in an alarm period; classifying the current alarm based on the feature values of the monitoring data and the production logs to obtain a problem type and a problem level of the current alarm; and performing corresponding tests according to the problem type and the problem level to obtain positioning of the current alarm. The present disclosure also provides a problem positioning device, equipment, a storage medium and a program product.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence, and more specifically to a problem localization method, apparatus, device, medium, and program product. Background Technology

[0002] In the current development of credit systems and related engineering projects, it is difficult to quickly and accurately locate and resolve problems when anomalies occur. Traditional problem-solving methods include: testers discovering production issues; testers downloading logs from remote servers, manually analyzing them, and then raising questions with developers; developers then locating the root cause of the problem from architectural, program, and configuration levels; and finally, developers resolving the problem by modifying the program.

[0003] The above methods have the following main drawbacks: First, the process of analyzing the root cause of a problem involves many steps, especially the communication, analysis, and problem localization process, which is the most time-consuming and significantly increases development costs. Second, it is difficult for testers to quickly locate the cause of anomalies in the production environment through simple manual analysis of logs, which may lead to inaccurate problem localization. Third, when developers solve problems, they cannot locate the root cause at the program level and must also use methods such as writing unit tests to locate the root cause, further increasing the time investment. How to quickly discover, locate, and solve problems has become a bottleneck in current software development. Summary of the Invention

[0004] In view of the above problems, this disclosure provides automated and rapid problem localization methods, apparatus, devices, media, and program products.

[0005] The first aspect of this disclosure provides a problem localization method, comprising: acquiring monitoring data and production logs of each production node in a production environment in real time; when the monitoring data indicates an alarm, extracting feature values ​​of the monitoring data and the production logs within the alarm period; classifying the current alarm based on the feature values ​​of the monitoring data and the production logs to obtain the problem type and problem level of the current alarm; and performing corresponding tests according to the problem type and problem level to obtain the localization of the current alarm.

[0006] According to an embodiment of this disclosure, when the monitoring data indicates an alarm, extracting the feature values ​​of the monitoring data and the production log within the alarm period includes: extracting the log keywords of the production log; and serializing the production log and multiple monitoring indicators included in the monitoring data to obtain the feature values ​​of the monitoring data and the production log.

[0007] According to an embodiment of this disclosure, before extracting the log keywords from the production logs, the method further includes: cleaning the production logs during the alarm period, extracting log data whose production weight exceeds a preset threshold, and extracting the log keywords from the log data.

[0008] According to embodiments of this disclosure, classifying the current alarm based on the feature values ​​of the monitoring data and the production log to obtain the problem type and problem level of the current alarm includes: inputting the feature values ​​of the monitoring data and the production log into multiple decision trees in a preset random forest model to obtain corresponding decision results; calculating a weighted value of the decision results of the multiple decision trees based on their respective decision weights, so as to obtain the problem type and problem level of the current alarm based on the weighted value.

[0009] According to an embodiment of this disclosure, the step of performing corresponding tests based on the problem type and problem level to locate the current alarm includes: obtaining a corresponding test case based on the problem type and problem level; and running the test case in the test environment of the production environment to locate the current alarm.

[0010] According to embodiments of this disclosure, after acquiring the monitoring data, the method includes: persisting the monitoring data to a time-series database to analyze whether the monitoring data indicates an alarm.

[0011] According to an embodiment of this disclosure, the method includes: when the duration for which the monitoring data has been stored in the time-series database reaches a preset duration, the monitoring data is cleared.

[0012] A second aspect of this disclosure provides a problem localization device, comprising: a data acquisition module for acquiring monitoring data and production logs of each production node in a production environment in real time; a feature extraction module for extracting feature values ​​of the monitoring data and production logs within an alarm period when the monitoring data indicates an alarm; a type classification module for inputting the feature values ​​of the monitoring data and production logs into a preset random forest model for problem classification to obtain the problem type and problem level of the current alarm; and a problem localization module for performing tests in a test environment corresponding to the problem type and problem level to obtain the localization of the current alarm.

[0013] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the aforementioned problem localization method.

[0014] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the aforementioned problem localization method.

[0015] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned problem localization method. Attached Figure Description

[0016] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustrations depict application scenarios of problem localization methods, apparatus, devices, media, and program products according to embodiments of the present disclosure.

[0018] Figure 2 A flowchart illustrating a problem localization method according to an embodiment of the present disclosure is shown schematically;

[0019] Figure 3 A flowchart illustrating operation S220 according to an embodiment of the present disclosure is shown schematically;

[0020] Figure 4 A flowchart illustrating operation S230 according to an embodiment of the present disclosure is shown schematically;

[0021] Figure 5 A flowchart illustrating operation S240 according to an embodiment of the present disclosure is shown schematically;

[0022] Figure 6 A schematic block diagram of a problem location apparatus according to an embodiment of the present disclosure is shown; and

[0023] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a problem localization method according to an embodiment of the present disclosure. Detailed Implementation

[0024] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0027] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0028] It should be noted that the problem localization method and apparatus disclosed herein can be used in software development, operation and maintenance scenarios in the financial field, as well as in software development, operation and maintenance scenarios in any field other than the financial field. The application fields of the problem localization method and apparatus disclosed herein are not limited.

[0029] The embodiments of this disclosure provide a problem localization method that uses formatted and standardized logs to aggregate multiple real-time Prometheus indicators for problem classification, thereby enabling rapid problem localization.

[0030] Figure 1 The illustration shows an application scenario diagram of a problem localization method, apparatus, device, medium, and program product according to embodiments of the present disclosure.

[0031] like Figure 1 As shown, application scenario 100 according to this embodiment may include scenarios involving the development, operation, and maintenance of banking software. Network 104 serves as a medium for providing a communication link between terminal devices 101, 102, 103, and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0032] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various bank client applications can be installed on terminal devices 101, 102, and 103, which transmit their production logs and monitoring data to server 105 via network 104.

[0033] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0034] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0035] It should be noted that the problem localization method provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the problem localization device provided in this disclosure embodiment can generally be located in server 105. The problem localization method provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the problem localization device provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105.

[0036] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0037] The following will be based on Figure 1 The described scene, through Figures 2-5 The problem localization method of the disclosed embodiments is described in detail.

[0038] Figure 2 A flowchart illustrating a problem localization method according to an embodiment of the present disclosure is shown schematically.

[0039] like Figure 2 As shown, the problem localization method of this embodiment includes operations S210 to S240, and the transaction processing method can be executed sequentially.

[0040] The S210 is used to obtain real-time monitoring data and production logs from each production node in the production environment.

[0041] In operation S220, when the monitoring data indicates an alarm, the feature values ​​of the monitoring data and the production log within the alarm period are extracted.

[0042] In operation S230, the current alarm is classified based on the feature values ​​of the monitoring data and the production log to obtain the problem type and problem level of the current alarm.

[0043] In operation S240, corresponding tests are performed according to the problem type and problem level to locate the current alarm.

[0044] In this embodiment, the Prometheus monitoring system can be deployed on various nodes in the production environment. Pods and container IDs in Kubernetes are configured via configuration files, and API calls are provided to enable PrometheusSQL to obtain real-time monitoring data. The monitoring data includes real-time CPU usage, memory usage, container CPU utilization, container memory utilization, JVM free memory, thread pool utilization, connection pool utilization, and other key metrics that significantly impact the reliability, security, and performance of the current application node.

[0045] In this embodiment, the monitoring data is persisted to a time-series database to analyze whether the monitoring data indicates an alarm. The real-time monitoring metrics obtained above are persisted in the time-series database InfluxDB. The time-series database has real-time characteristics, and the retention time of the monitoring data can be set in advance when the table is created, or the persistence policy can be configured by setting the retention policy 'promethes' on 'perf_cpu' duration 24h to help improve storage and detection efficiency. When the monitoring data has been stored in the time-series database for a preset duration, the monitoring data is cleared to reduce the detection efficiency problem caused by the persistence of invalid data.

[0046] Production logs can include application logs, Jenkins logs, etc. To reduce noise pollution and improve the accuracy of problem localization, the production logs are cleaned after capture. The system executing the problem localization method can filter out the log information with the highest weight in the production environment through log formatting. The production environment weight of various log information can be set by experts based on experience, or it can be calculated based on the correlation between various log information and various alarm issues.

[0047] In this embodiment, based on monitoring data and production logs within the alarm period, the type of problem can be analyzed. Optionally, a model can be trained based on historical data to quickly classify problems based on monitoring data and production logs within the alarm period. Furthermore, the model can be used to classify problems into levels to further narrow down the problem scope and enable targeted problem localization.

[0048] According to the method provided in this disclosure, the intermediate links of traditional operation and maintenance are eliminated. When production problems occur, the formatted production logs are used to obtain the text-formatted log documents in the index library in real time. Combined with monitoring indicators, the characteristics of the current alarm problem are extracted to analyze the problem type based on the characteristics, and then test the problem type to quickly locate the problem. This saves the time cost of manual problem analysis, improves the accuracy of problem location, frees up human resources, and greatly improves development and testing efficiency.

[0049] Figure 3 A flowchart illustrating operation S220 according to an embodiment of the present disclosure is shown schematically.

[0050] like Figure 3 As shown, in operation S220, when the monitoring data indicates an alarm, the feature values ​​of the monitoring data and the production log within the alarm period are extracted, including operations S221 to S222.

[0051] In operation S221, the log keywords of the production log are extracted.

[0052] Before extracting log keywords, the production logs within the alarm period are cleaned, and log data with production weights exceeding a preset threshold are extracted from them in order to extract the log keywords from the log data.

[0053] Optionally, log keywords may include log type, duration, transaction amount, upstream application name, upstream node IP, input information, output information, service name, method name, return code, region code, etc.

[0054] Extracting keywords from logs can further reduce the amount of data while maintaining the accuracy of problem classification, thereby improving the efficiency of problem localization.

[0055] In operation S222, the production log and the monitoring data, including multiple monitoring indicators, are concatenated and serialized to obtain the feature values ​​of the monitoring data and the production log.

[0056] Log keywords and monitoring metrics are concatenated into text files to form a final feature value sequence. This sequence allows for mathematical calculations to categorize alert issues according to a standardized format. The model used for issue classification is trained on this serialized data. The data includes key monitoring metrics, which enhances the accuracy of the model's classification results.

[0057] Figure 4 A flowchart illustrating operation S230 according to an embodiment of the present disclosure is shown schematically.

[0058] like Figure 4As shown, in operation S230, the current alarm is classified based on the feature values ​​of the monitoring data and the production log to obtain the problem type and problem level of the current alarm, including operations S231 to S232.

[0059] In operation S231, the feature values ​​of the monitoring data and the production log are input into multiple decision trees in a preset random forest model to obtain the corresponding decision results.

[0060] Because the structure of feature value sequences is complex, including feature values ​​from various monitoring metrics and production logs, and each feature has a different evaluation scale, with both binary and serialized feature values ​​present, normalization is quite difficult. Tree-structured models can filter through multiple sets of different feature values ​​layer by layer to obtain the final problem type classification result located at the leaf nodes. Tree-structured decision models can also visualize the classification process, facilitating monitoring.

[0061] In this embodiment, a random forest model comprising multiple random decision trees is pre-trained based on historical data. To ensure generalization ability, the trees are constructed using a double randomness of random feature sampling and random feature selection. After the trees are built, the trained weak classifiers are used to perform secondary training on multiple weak classifiers using a Bagging model. These multiple trees are then executed in parallel to ultimately select the most suitable tree. In this random forest model, multiple random decision trees are trained. Each decision tree can perform decision calculations for alarm issues, and the decision results map to the corresponding problem type and problem level.

[0062] In this embodiment, entropy is used as the basis for the node selection algorithm. The entropy value is calculated to determine the classification after branching based on different features. The greater the uncertainty in branching based on this feature value, the greater the entropy value, the greater the disorder in the data domain, and the lower the discriminative power. Theoretically, nodes with lower information entropy are selected as tree branch nodes. The optimal feature is found as the root node based on the classification after branching based on different features, and so on.

[0063] Furthermore, information gain is used as an evaluation algorithm to further select nodes in the tree model. When selecting features for classification, features with higher information gain are chosen, resulting in more accurate classification capabilities. Nodes with insufficient information gain are pruned to reduce interference.

[0064] To ensure generalization ability, tree construction can be achieved through a double randomness of random feature sampling and random feature selection.

[0065] In operation S232, based on the decision weights of the multiple decision trees, a weighted value of the decision results of the multiple decision trees is calculated, so as to obtain the current alarm problem type and problem level based on the weighted value.

[0066] Optionally, the formula for calculating the weighted value of the decision results of multiple decision trees is as follows:

[0067]

[0068] Where i represents the decision tree number, T represents the total number of decision trees, and h i (x) represents the decision result of the i-th decision tree, w i Let x represent the decision weight of the i-th decision tree, and let x represent the alarm problem.

[0069] By combining the decision results from multiple random decision trees to determine the problem type and severity level of an alarm issue, the accuracy of the decision can be improved.

[0070] Figure 5 A flowchart illustrating operation S240 according to an embodiment of the present disclosure is shown schematically.

[0071] like Figure 5 As shown, in operation S240, corresponding tests are performed according to the problem type and problem level to obtain the location of the current alarm, which may include operations S241 to S242.

[0072] In operation S241, the corresponding test case is obtained according to the problem type and the problem level.

[0073] In operation S242, the test case is run in the test environment of the production environment to locate the current alarm.

[0074] In this embodiment, a problem drill factory supporting various abnormal scenarios can be provided based on a preset high-availability expert library. According to the problem type hierarchy obtained after the problem analysis, corresponding exceptions are injected through bytecode and other technologies to conduct tests in order to accurately locate the problem.

[0075] The method provided in this disclosure addresses the risks associated with the inability to resolve production issues promptly through manual intervention, as well as the slow communication and problem-solving speed of development and testing personnel during system anomalies, inaccurate problem identification based on experience, and low efficiency in handling problems. Furthermore, this method offers the following advantages: online real-time indicators are provided by acquiring real-time online monitoring data through a monitoring system, effectively filling feature gaps and ensuring more accurate problem analysis results. Tree and forest models are used to analyze the root causes of problems, saving time and resources that may result from incomplete considerations in manual problem analysis. Human resources are freed up, significantly improving development and testing efficiency. Developers only need to inject problem-related data into the system; the use of an expert database allows for more precise problem identification, and fault simulation further liberates the development and testing personnel.

[0076] Based on the above problem localization method, this disclosure also provides a problem localization device. The following will be combined with... Figure 6 The device is described in detail.

[0077] Figure 6 A schematic block diagram of a problem location device according to an embodiment of the present disclosure is shown.

[0078] like Figure 6 As shown, the problem localization device 600 of this embodiment includes a data acquisition module 610, a feature extraction module 620, a type classification module 630, and a problem localization module 640.

[0079] The data acquisition module 610 is used to acquire monitoring data and production logs of each production node in the production environment in real time. In one embodiment, the data acquisition module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0080] The feature extraction module 620 is used to extract feature values ​​from the monitoring data and the production log during the alarm period when the monitoring data indicates an alarm. In one embodiment, the data acquisition module 610 can be used to perform the operation S220 described above, which will not be repeated here.

[0081] The type classification module 630 is used to input the feature values ​​of the monitoring data and the production logs into a preset random forest model for problem classification, thereby obtaining the problem type and problem level of the current alarm. In one embodiment, the data acquisition module 610 can be used to perform the operation S230 described above, which will not be repeated here.

[0082] The problem location module 640 is used to perform tests in a test environment corresponding to the problem type and problem level to locate the current alarm. In one embodiment, the data acquisition module 610 can be used to perform the operation S240 described above, which will not be repeated here.

[0083] According to the apparatus provided in this embodiment, the data acquisition module 610 is used to acquire production logs and monitoring data of the production environment. When the Prometheus monitoring system used to acquire monitoring data detects a production problem, the feature extraction module 620 uses the formatted production logs to acquire text-formatted log documents in the index library in real time. Combined with monitoring indicators, it extracts the features of the current alarm problem and provides them to the type classification module 630 to determine the problem type and problem level of the current problem. Then, the problem location module 640 combines the feature analysis to perform the problem type test, thereby quickly locating the problem, saving the time cost of manual problem analysis, improving the accuracy of location, freeing up human resources, and greatly improving development and testing efficiency.

[0084] The problem localization device provided in this disclosure solves the risks associated with the inability to resolve production issues promptly through manual intervention, as well as the problems of slow communication and problem localization by development and testing personnel during system anomalies, inaccurate problem localization based on experience, and low efficiency in problem handling. The device also offers the following advantages: online real-time indicators, acquiring real-time online monitoring data through a monitoring system to effectively fill feature gaps and ensure more accurate problem analysis results; tree and forest model training to analyze root causes of problems, saving time and avoiding the potential for incomplete consideration in manual problem analysis; freeing up human resources and significantly improving development and testing efficiency; developers only need to inject problem-related data into the system; using an expert database for more precise problem localization, and further freeing up development and testing personnel through fault simulation to more accurately locate analyzed problems.

[0085] Any one or more of the modules, submodules, units, and subunits according to embodiments of the present disclosure, or at least part of the functions of any one or more of them, can be implemented in one module. Any one or more of the modules, submodules, units, and subunits according to embodiments of the present disclosure can be implemented by dividing them into multiple modules. Any one or more of the modules, submodules, units, and subunits according to embodiments of the present disclosure can be at least partially implemented as hardware circuitry, such as Field Programmable Gate Arrays (FPGAs), Programmable Logic Arrays (PLAs), Systems-on-Chip, Systems-on-Substrate, Systems-on-Package, Application-Specific Integrated Circuits (ASICs), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, one or more of the modules, submodules, units, and subunits according to embodiments of the present disclosure can be at least partially implemented as computer program modules, which, when run, can perform corresponding functions.

[0086] For example, any plurality of the data acquisition module 610, feature extraction module 620, type classification module 630, and problem localization module 640 can be combined into one module / unit / subunit, or any one of these modules / units / subunits can be split into multiple modules / units / subunits. Alternatively, at least part of the functionality of one or more of these modules / units / subunits can be combined with at least part of the functionality of other modules / units / subunits and implemented in one module / unit / subunit. According to embodiments of this disclosure, at least one of the data acquisition module 610, feature extraction module 620, type classification module 630, and problem localization module 640 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the data acquisition module 610, feature extraction module 620, type classification module 630, and problem localization module 640 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0087] It should be noted that the problem location device part in the embodiments of this disclosure corresponds to the problem location method part in the embodiments of this disclosure. For a detailed description of the problem location device part, please refer to the problem location method part, which will not be repeated here.

[0088] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a problem localization method according to an embodiment of the present disclosure.

[0089] like Figure 7 As shown, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0090] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0091] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0092] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0093] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0094] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the item recommendation method provided in the embodiments of this disclosure.

[0095] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0096] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0097] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0098] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0099] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0100] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0101] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A problem localization method, comprising: Real-time acquisition of monitoring data and production logs from each production node in the production environment; When the monitoring data indicates an alarm, extract the feature values ​​of the monitoring data and the production log within the alarm period; Based on the feature values ​​of the monitoring data and the production logs, the current alarm is classified to obtain the problem type and problem level of the current alarm. Based on the problem type and the problem level, obtain the corresponding test cases; Run the test case in the test environment of the production environment to locate the current alarm.

2. The method according to claim 1, wherein when the monitoring data indicates an alarm, extracting the feature values ​​of the monitoring data and the production log during the alarm period includes: Extract the log keywords from the production logs; The production logs and the monitoring data, including multiple monitoring metrics, are concatenated and serialized to obtain the feature values ​​of the monitoring data and the production logs.

3. The method according to claim 2, further comprising, before extracting the log keywords from the production log: The production logs during the cleaning alarm period are used to extract log data whose production weight exceeds a preset threshold, so as to extract the log keywords from the log data.

4. The method according to claim 1, wherein classifying the current alarm based on the feature values ​​of the monitoring data and the production log to obtain the problem type and problem level of the current alarm includes: The feature values ​​of the monitoring data and the production logs are input into multiple decision trees in a preset random forest model to obtain the corresponding decision results; Based on the decision weights of the multiple decision trees, a weighted value is calculated for the decision results of the multiple decision trees, so as to obtain the current alarm problem type and problem level based on the weighted value.

5. The method according to claim 1, further comprising, after acquiring the monitoring data: The monitoring data is persisted to a time-series database to analyze whether the monitoring data indicates an alarm.

6. The method according to claim 1, comprising: When the monitoring data has been stored in the time-series database for a preset period of time, the monitoring data is cleared.

7. A problem location device, comprising: The data acquisition module is used to acquire monitoring data and production logs from various production nodes in the production environment in real time. The feature extraction module is used to extract feature values ​​of the monitoring data and the production log during the alarm period when the monitoring data indicates an alarm. The type classification module is used to input the feature values ​​of the monitoring data and the production log into a preset random forest model to classify the problems and obtain the problem type and problem level of the current alarm. The problem location module is used to obtain the corresponding test case according to the problem type and the problem level; and run the test case in the test environment of the production environment to obtain the location of the current alarm.

8. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images