A multi-fractal based fault root cause analysis method and system

Abstract

The application discloses a kind of based on multiple fractals's fault root cause analysis method and system, method includes: real-time acquisition multiple alarm objects;Based on multiple fractals's decline tendency algorithm, the KPI data of each alarm object is analyzed in real time, generates the characteristic parameter of each alarm object;Based on Euclidean distance function, the characteristic parameter is classified by preset algorithm;By successively comparing classification result, call chain in fault propagation graph, real-time generates fault propagation path.The application proposes based on multiple fractals's fault root cause analysis method, it is a kind of general fault root cause analysis scheme for application scene, the KPI index of alarm object is calculated by multiple fractals, can quickly locate the actual propagation path and root cause of system fault occurrence, and with scalability, can satisfy the requirement of production service.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a fault root cause analysis method and system based on multi-fractal. BACKGROUND

[0002] With the development of cloud platforms, 5G, Internet of Things and other infrastructures, the application of containerization, service-oriented and distributed architecture and other application systems, the modules and dependent scenarios of IT operation and maintenance objects are becoming more and more complex. With the continuous expansion of enterprise IT system scale, operation and maintenance objects involve multiple levels such as application services, middleware, hosts, networks and various complex dependent relationships. Each operation and maintenance object has multiple key performance indicators (KPIs), and these KPIs are different. For example, the KPIs at the service and business levels, such as network throughput, page views, online user numbers, and the KPIs of service bottom-level machines, such as the number of I / O requests processed per second by the server, container memory usage, etc. These KPIs have their own different characteristics.

[0003] The prior art scheme mainly analyzes KPI data when performing root cause analysis, attempts to find the most influential KPI data, and then analyzes the correlation of these KPI data to perform root cause analysis. When a complex system has an anomaly or a fault, how to quickly detect the fault cause from the KPIs of operation and maintenance objects with different characteristics has become one of the core difficulties of operation and maintenance work. In the process of finding the most influential KPI data, other KPI data is ignored, there is a risk that existing data cannot be fully utilized, and the characteristics of the data itself when an anomaly occurs are ignored in root cause analysis through the correlation of KPI data, and the information in the data cannot be fully explored. SUMMARY

[0004] Therefore, the fault root cause analysis method and system based on multi-fractal provided by the present application overcome the defects in the prior art that existing data cannot be fully utilized, root cause analysis through the correlation of KPI data ignores the characteristics of the data itself when an anomaly occurs, and information in the data cannot be fully explored.

[0005] To achieve the above object, the present application provides the following technical scheme:

[0006] In a first aspect, the present application embodiment provides a fault root cause analysis method based on multi-fractal, comprising:

[0007] real-time acquisition of a plurality of alarm objects;

[0008] real-time analysis of KPI data of each alarm object based on a multi-fractal reduction algorithm to generate characteristic parameters of each alarm object;

[0009] The feature parameters are classified by a preset algorithm based on the Euclidean distance function.

[0010] The fault propagation path is generated in real time by successively comparing the classification results and the call chains in the fault propagation graph.

[0011] Optionally, the feature parameters include a width of the multifractal spectrum and / or a dimension difference.

[0012] Optionally, the dimension difference is a difference between fractals of maximum and minimum probabilities.

[0013] Optionally, the preset algorithm includes a hierarchical clustering algorithm.

[0014] Optionally, the step of generating the fault propagation path in real time by successively comparing the classification results and the call chains in the fault propagation graph includes:

[0015] successively comparing each call path in the preset call path with each category sorted according to the number of nodes, wherein the category with the largest number of nodes is compared with the preset call path first, and then the sorted categories are successively compared with the preset call path.

[0016] For each category, the call chain in the preset call path that contains the largest number of nodes in the category is the call chain that is most likely to have a fault, wherein the more nodes in each category in the preset call path, the more likely the call chain is to have a fault.

[0017] Optionally, the call chains in the fault propagation graph include at least one preset call path.

[0018] Optionally, the call chains in the fault propagation graph are constructed by a configuration management database.

[0019] In a second aspect, an embodiment of the present application provides a multifractal-based fault root cause analysis system, which includes:

[0020] A data acquisition module is configured to acquire a plurality of alarm objects in real time.

[0021] A feature parameter generation module is configured to analyze KPI data of each alarm object in real time based on a multifractal reduction algorithm to generate feature parameters of each alarm object.

[0022] A feature parameter classification module is configured to classify the feature parameters by a preset algorithm based on a Euclidean distance function.

[0023] A fault propagation path generation module is configured to generate a fault propagation path in real time by successively comparing classification results and call chains in a fault propagation graph.

[0024] In a third aspect, an embodiment of the present application provides a terminal, comprising at least one processor, and a memory connected with the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method for analyzing a root cause of a fault based on multifractal in the first aspect of the present application.

[0025] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer instructions for enabling a computer to perform the method for analyzing a root cause of a fault based on multifractal in the first aspect of the present application.

[0026] The technical scheme of the present application has the following advantages:

[0027] The method and system for analyzing a root cause of a fault based on multifractal provided by the present application can quickly locate the actual propagation path and the root cause of the occurrence of a system fault, and has scalability, and can meet the requirements of production services. BRIEF DESCRIPTION OF DRAWINGS

[0028] In order to more clearly illustrate the specific embodiments of the present application or the technical scheme in the prior art, the drawings needed in the following specific embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0029] Figure 1 A flow chart of one specific example of the method for analyzing a root cause of a fault based on multifractal provided by an embodiment of the present application;

[0030] Figure 2 A module composition diagram of the system for analyzing a root cause of a fault based on multifractal provided by an embodiment of the present application;

[0031] Figure 3 A composition diagram of one specific example of the terminal provided by an embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solutions of the present application will be described clearly and completely below with reference to the drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0033] In the description of the present application, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like indicate the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the present application. In addition, the terms "first", "second", "third" are only for the purpose of description, and cannot be understood as indicating or implying relative importance.

[0034] In the description of the present application, it should be noted that unless otherwise explicitly specified and limited, the terms "mounting", "connection", "connection" should be understood broadly, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium; it can be the communication between two elements inside, it can be wireless connection, or it can be wired connection. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0035] In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0036] Embodiment 1

[0037] The fault root cause analysis method provided by the embodiment of the present application is based on multi-fractal, as shown in the figure, comprising the following steps: Figure 1

[0038] Step S1: Real-time acquisition of a plurality of alarm objects.

[0039] In the embodiment of the present application, when the IT system encounters a fault, the operation and maintenance object that occurs a fault will generate a plurality of alarm data, and a plurality of alarm objects are acquired in real time.

[0040] Step S2: Real-time analysis of KPI data of each alarm object based on multi-fractal reduction algorithm, and generating characteristic parameters of each alarm object.

[0041] ​In the embodiment of the present application, the multi-fractal can be used to describe the nonlinear and non-stationary characteristics of the KPI data of the operation and maintenance object, and can more finely depict the local characteristics of the KPI data. Compared with the traditional method of trying to find the most influential KPI data of each operation and maintenance object, the multi-fractal can use all the KPI data of the operation and maintenance object, without causing information loss; when performing classification analysis, not only the correlation of the KPI data is considered, but also the characteristics of each KPI data itself are included.

[0042] In the embodiment of the present application, the characteristic parameters include: width of the multi-fractal spectrum, and / or difference in dimension. This is only an example, and is not limited thereto. In actual application, the corresponding characteristic parameters are selected according to actual needs. The selection of the characteristic parameters can be one or a combination of several, which is not limited herein, and is selected according to actual conditions. The difference in dimension is the difference between the largest and smallest probability fractals.

[0043] Step S3: Based on the Euclidean distance function, the characteristic parameters are classified by a preset algorithm.

[0044] In the embodiment of the present application, the preset algorithm includes: a hierarchical clustering algorithm. This is only an example, and is not limited thereto. In actual application, the corresponding preset algorithm is selected according to actual needs. The hierarchical clustering algorithm is used to classify the characteristic parameters hierarchically, so that the analysis result is more accurate and fine.

[0045] Step S4: The fault propagation path is generated in real time by sequentially comparing the classification results and the call chain in the fault propagation graph.

[0046] In the embodiment of the present application, the call chain in the fault propagation graph is constructed by the configuration management database.

[0047] In a specific embodiment, all possible call chains between the entire IT operation and maintenance objects are constructed by a configuration management database (CMDB). The CMDB is a database that stores information of all components in an IT system and calling and dependency relationships between the components. The components include: software, hardware and services of the IT system, which are not limited herein, i.e., operation and maintenance objects in the IT system. At the same time, the CMDB provides an organization view of the IT system, and a user can view the calling and dependency relationships between all components in the IT system from any desired angle. The components stored in the CMDB are sequentially connected according to the mutual dependency and calling relationship, to obtain complete call chains between all components. Each call chain is a possible fault propagation chain when a fault occurs in the IT system, and the components in each fault propagation chain are nodes that may occur faults.

[0048] In the embodiment of the present application, the step of generating the fault propagation path in real time by comparing the classification results and the call chain in the fault propagation graph in sequence comprises: comparing the nodes in each preset call path with each category sorted by the number of nodes in sequence, i.e., first comparing the nodes in the preset call path with the category with the largest number of nodes, and then comparing the nodes in the preset call path with the categories sorted in sequence, wherein the call chain in the fault propagation graph comprises at least one preset call path. For each category, the path in the preset call path with the largest number of nodes in the category is the call chain most likely to have a fault, and the more nodes in each category in the preset call path, the more likely it is to become a call chain with a fault.

[0049] In another specific embodiment, when the IT system encounters a fault, the operation and maintenance object that has a fault generates a variety of alarm data, and the specific components that have an anomaly are obtained through the alarm data. The KPI data of the alarm objects that have an anomaly are calculated by using the multifractal detrended algorithm to obtain the index multifractal spectrum width Δα and the maximum and minimum probability fractal dimension difference Δf. The traditional Euclidean distance function is used as a measure function, and the hierarchical clustering method is used to classify each operation and maintenance object that has an anomaly. The nodes in the classified categories are sorted from high to low, and are compared with all fault propagation chains in sequence, and the fault causes are searched according to the fault propagation chains with the largest number of nodes in sequence.

[0050] The multifractal-based fault root cause analysis method provided in the embodiment of the present application comprises: using the multifractal detrended algorithm to analyze the KPI data of each alarm object in real time to generate characteristic parameters of each alarm object based on the Euclidean distance function; classifying the characteristic parameters by using a preset algorithm; and generating a fault propagation path in real time by comparing the classification results and the call chain in the fault propagation graph in sequence. The method provided in the present application can quickly locate the actual propagation path and the root cause of the system fault, and has scalability and can meet the requirements of production services.

[0051] Embodiment 2

[0052] The multifractal-based fault root cause analysis system provided in the embodiment of the present application comprises: Figure 2 as shown in the figure, comprising:

[0053] The data acquisition module 1 is configured to acquire a plurality of alarm objects in real time. This module performs the method described in step S1 in embodiment 1, and will not be described here again.

[0054] The characteristic parameter generation module 2 is configured to analyze the KPI data of each alarm object in real time based on the multifractal detrended algorithm to generate characteristic parameters of each alarm object. This module performs the method described in step S2 in embodiment 1, and will not be described here again.

[0055] The feature parameter classification module 3 is configured to classify the feature parameters based on a Euclidean distance function through a preset algorithm.

[0056] The fault propagation path generation module 4 is configured to generate a fault propagation path in real time by sequentially comparing the classification results and the call chain in the fault propagation graph.

[0057] The embodiment of the present application provides a fault root cause analysis system based on multiple fractals, which acquires a plurality of alarm objects in real time through a data acquisition module. A feature parameter generation module analyzes KPI data of each alarm object in real time based on a multiple fractal reduction algorithm, and generates feature parameters of each alarm object. A feature parameter classification module classifies the feature parameters through a preset algorithm using a Euclidean distance function. A fault propagation path generation module generates a fault propagation path in real time by sequentially comparing the classification results and the call chain in the fault propagation graph. The system provided by the present application can quickly locate the actual propagation path and the root cause of the system fault, and has scalability, which can meet the requirements of production services.

[0058] Embodiment 3

[0059] The embodiment of the present application provides a terminal, such as Figure 3As shown, it includes at least one processor 401, such as a CPU (Central Processing Unit), at least one communication interface 403, a memory 404, and at least one communication bus 402. The communication bus 402 is used to realize the connection and communication between the components. The communication interface 403 can include a display, a keyboard, and can also include a standard wired interface and a wireless interface. The memory 404 can be a high-speed RAM memory, and can also be a non-volatile memory, such as at least one disk memory. The memory 404 can also be at least one storage device located away from the aforementioned processor 401. The processor 401 can execute the multi-fractal-based fault root cause analysis method in embodiment 1. The memory 404 stores a set of program codes, and the processor 401 calls the program codes stored in the memory 404 to execute the multi-fractal-based fault root cause analysis method in embodiment 1. The communication bus 402 can be a PCI (peripheral component interconnect) bus or an EISA (extended industry standard architecture) bus, etc. The communication bus 402 can be divided into an address bus, a data bus, and a control bus. For ease of representation, Figure 3 The memory 404 can include a volatile memory, such as a RAM (random-access memory), and can also include a non-volatile memory, such as a flash memory, a hard disk (HDD) or a solid-state disk (SSD), and can also include a combination of the above-mentioned types of memories. The processor 401 can be a CPU (central processing unit), a network processor (NP), or a combination of a CPU and an NP.

[0060] The memory 404 can include a volatile memory, such as a random-access memory (RAM), and / or can include a non-volatile memory, such as a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The memory 404 can also include a combination of the above-mentioned types of memories.

[0061] The processor 401 can be a central processing unit (CPU), a network processor (NP), or a combination of CPU and NP.

[0062] The processor 401 can further include a hardware chip. The hardware chip can be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0063] Optionally, the memory 404 is further configured to store program instructions. The processor 401 can invoke the program instructions to implement the method for fault root cause analysis based on multi-fractals as described in Embodiment 1.

[0064] The embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores computer executable instructions. The computer executable instructions can execute the multi-fractal based fault root cause analysis method in the embodiment 1. The storage medium can be a disk, an optical disc, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above-mentioned types of memories.

[0065] Obviously, the above-mentioned embodiments are only examples for clearly illustrating the present application, and are not intended to limit the embodiments. Based on the above-mentioned description, other different forms of changes or variations can be made by those skilled in the art. Here, all the embodiments do not need to be exhausted, and the obvious changes or variations derived therefrom are still within the protection scope of the present application.

Claims

1. A multifractal-based root cause analysis method for faults, characterized in that, include: Real-time acquisition of multiple alarm objects; Based on the multifractal descent algorithm, the KPI data of each alarm object is analyzed in real time to generate the characteristic parameters of each alarm object; The feature parameters include: the width of the multifractal spectrum and / or the dimension difference; the dimension difference is: the difference between the fractals with the maximum and minimum probabilities; The feature parameters are classified based on the Euclidean distance function and a preset algorithm; the preset algorithm includes a hierarchical clustering algorithm. By sequentially comparing the classification results and the call chain in the fault propagation graph, a fault propagation path is generated in real time, including: The nodes in each preset call path are compared sequentially with each category sorted by the number of nodes. First, the category with the most nodes is compared with the nodes in the preset call path. Then, the sorted categories are compared with the preset call paths in turn. For each category, the path containing the most nodes of that category in the preset call path is the fault propagation path. The more nodes of each category in the preset call path, the more likely it is to become a fault propagation path. The call chain in the fault propagation graph includes: at least one preset call path; the call chain in the fault propagation graph is constructed through the configuration management database.

2. A multifractal-based root cause analysis system, characterized in that, include: The data acquisition module is used to acquire multiple alarm objects in real time; The feature parameter generation module is used to analyze the KPI data of each alarm object in real time based on the multifractal descent algorithm and generate the feature parameters of each alarm object. The feature parameter classification module is used to classify the feature parameters based on the Euclidean distance function and a preset algorithm. The fault propagation path generation module is used to generate fault propagation paths in real time by sequentially comparing classification results and call chains in the fault propagation graph, including: The nodes in each preset call path are compared sequentially with each category sorted by the number of nodes. First, the category with the most nodes is compared with the nodes in the preset call path. Then, the sorted categories are compared with the preset call paths in turn. For each category, the path containing the most nodes of that category in the preset call path is the fault propagation path. The more nodes of each category in the preset call path, the more likely it is to become a fault propagation path. The call chain in the fault propagation graph includes: at least one preset call path; the call chain in the fault propagation graph is constructed through the configuration management database.

3. A terminal, characterized in that, include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the multifractal-based root cause analysis method of claim 1.

4. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the multifractal-based root cause analysis method of claim 1.

Images