Crash clustering method, device, electronic device and storage medium

Abstract

The present disclosure provides a crash clustering method, apparatus, electronic device, and storage medium, wherein the method comprises: obtaining multiple system crash messages generated after an operating system crash occurs; for each system crash message, extracting crash features from the system crash message based on the type of the system crash message; generating a feature identifier corresponding to the system crash message based on the crash features; and clustering the multiple system crash messages based on the feature identifier to obtain a system crash message group corresponding to at least one crash cause. In embodiments of the present disclosure, system crash messages generated after an operating system crash occur are classified according to certain features, and crashes caused by the same cause are grouped into the same category, thereby reducing the number of problem types and facilitating review by developers.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a crash clustering method, device, electronic device, and storage medium. Background Art

[0002] Currently, after a user terminal crashes, the crash information will be uploaded to the database, making it easier for developers to view and analyze the cause of the crash and fix the problem. Since the number of reported crashes is very large, it is necessary to classify the crashes according to certain characteristics, and classify crashes caused by the same reason into the same category, reducing the number of problems for developers to handle. The number of occurrences of certain problems can also represent the importance and impact of such problems to a certain extent. User terminal crashes include application crashes and operating system crashes. Existing similar technologies only cluster crashes that occur in applications, and lack crash clustering methods for operating system crashes. Summary of the Invention

[0003] The embodiments of the present disclosure at least provide a crash clustering method, apparatus, electronic device, and storage medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a crash aggregation method, comprising:

[0005] Obtain multiple system crash messages generated after the operating system crashes;

[0006] For each piece of system crash information, extracting a crash feature from the system crash information based on the type of the system crash information;

[0007] Based on the crash feature, generating a feature identifier corresponding to the system crash information;

[0008] Based on the characteristic identifier, the plurality of system crash information are clustered to obtain a system crash information group corresponding to at least one crash cause.

[0009] In an optional implementation manner, the crash of the operating system includes a thread crash;

[0010] The obtaining of a plurality of system crash information generated after the operating system crashes includes:

[0011] Obtaining call stack information corresponding to a thread that crashed in the operating system;

[0012] The system crash information is generated based on the call stack information.

[0013] In an optional implementation, extracting crash features from the system crash information based on the type of the system crash information includes:

[0014] In the case where the system crash information is generated based on the call stack information, target identification information of the crashing process, summary information of the system crash information, and call information of the target process are extracted from the system crash information as the crash feature.

[0015] In an optional implementation, extracting the call information of the target process from the system crash information includes:

[0016] The class name of the target object called by the target process, the method name of the target object, and the lock information corresponding to the target object are extracted from the system crash information.

[0017] In an optional implementation manner, the crash of the operating system includes a kernel crash;

[0018] The obtaining of a plurality of system crash information generated after the operating system crashes includes:

[0019] Obtaining kernel running log information of the operating system before it is restarted due to kernel crash;

[0020] The system crash information is generated based on the kernel operation log information.

[0021] In an optional implementation, extracting crash features from the system crash information based on the type of the system crash information includes:

[0022] In a case where the system crash information is generated based on the kernel operation log information, determining crash type information indicated in the system crash information;

[0023] Determining a regular expression that matches the crash type information;

[0024] Extracting crash cause information from the system crash information using the regular expression;

[0025] Extracting the to-be-executed instruction information and the memory address information of the abnormality at the time of the crash from the system crash information;

[0026] The crash type information, the crash cause information, the to-be-executed instruction information, and the memory address information are used as the crash feature.

[0027] In an optional implementation, generating a feature identifier corresponding to the system crash information based on the crash feature includes:

[0028] An information digest value of the crash feature is determined, and the information digest value is used as a feature identifier corresponding to the system crash information.

[0029] In a second aspect, an embodiment of the present disclosure further provides a crash clustering device, comprising:

[0030] An acquisition module, used to acquire multiple system crash information generated after the operating system crashes;

[0031] an extraction module, configured to extract crash features from each piece of system crash information based on the type of the system crash information;

[0032] A calculation module, configured to generate a feature identifier corresponding to the system crash information based on the crash feature;

[0033] The classification module is configured to cluster the plurality of system crash information based on the feature identifier to obtain a system crash information group corresponding to at least one crash cause.

[0034] In an optional implementation manner, the crash of the operating system includes a thread crash;

[0035] The acquisition module is used to obtain a plurality of system crash information generated after the operating system crashes:

[0036] The obtaining of a plurality of system crash information generated after the operating system crashes includes:

[0037] Obtaining call stack information corresponding to a thread that crashed in the operating system;

[0038] The system crash information is generated based on the call stack information.

[0039] In an optional implementation, when extracting crash features from the system crash information based on the type of the system crash information, the extraction module is configured to:

[0040] In the case where the system crash information is generated based on the call stack information, target identification information of the crashing process, summary information of the system crash information, and call information of the target process are extracted from the system crash information as the crash feature.

[0041] In an optional implementation, when extracting the call information of the target process from the system crash information, the extraction module is configured to:

[0042] The class name of the target object called by the target process, the method name of the target object, and the lock information corresponding to the target object are extracted from the system crash information.

[0043] In an optional implementation manner, the crash of the operating system includes a kernel crash;

[0044] When acquiring a plurality of system crash information generated after the operating system crashes, the acquisition module is specifically used to:

[0045] Kernel operation log information of the operating system before it is restarted due to kernel crash is obtained, and the system crash information is generated based on the kernel operation log information.

[0046] In an optional implementation, when the extraction module extracts the crash features from the system crash information based on the type of the system crash information, it is specifically configured to:

[0047] In the case where the system crash information is generated based on the kernel operation log information, the crash type information indicated in the system crash information is determined, and the crash cause information is extracted from the system crash information using the regular expression. The to-be-executed instruction information at the time of the crash and the memory address information where the exception occurred are extracted from the system crash information, and the crash type information, the crash cause information, the to-be-executed instruction information and the memory address information are used as the crash features.

[0048] In an optional implementation manner, when the calculation module generates a feature identifier corresponding to the system crash information based on the crash feature, it is specifically configured to:

[0049] An information digest value of the crash feature is determined, and the information digest value is used as a feature identifier corresponding to the system crash information.

[0050] In a third aspect, an embodiment of the present disclosure further provides an electronic device comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the above-mentioned first aspect or any possible implementation of the first aspect are performed.

[0051] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned first aspect or any possible implementation of the first aspect are executed.

[0052] The crash clustering method, apparatus, electronic device, and storage medium provided by the embodiments of the present disclosure first obtain multiple system crash information generated after an operating system crashes. Then, for each piece of system crash information, based on the type of the system crash information, a crash feature is extracted from the system crash information. Thereafter, based on the crash feature, a feature identifier corresponding to the system crash information is generated. Finally, based on the feature identifier, the multiple system crash information are clustered to obtain a system crash information group corresponding to at least one crash cause.

[0053] The disclosed embodiment extracts crash features from system crash information based on the type of system crash information. The crash features can reflect characteristic points about the crash in the system crash information and are representative. The feature identifiers generated by the crash features can characterize the characteristics of the crash features. Therefore, the crash identifiers can reflect various characteristics of the crash and achieve a high degree of generalization of the crash. Instead of directly clustering the system crash information, the feature identifiers are clustered, which can eliminate a large amount of irrelevant information. While retaining various features related to the crash, the clustering efficiency is improved, the types of problems are reduced, and they are convenient for developers to view and correct.

[0054] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. The drawings herein are incorporated into and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and, together with the specification, are used to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without inventive effort.

[0056] Figure 1 A flowchart of a crash clustering method provided by an embodiment of the present disclosure is shown;

[0057] Figure 2 A schematic diagram of a crash clustering device provided by an embodiment of the present disclosure is shown;

[0058] Figure 3 A schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the disclosure for which protection is sought, but merely represents selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present disclosure.

[0060] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0061] The term "and / or" herein simply describes an association relationship, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, and the existence of B alone. In addition, the term "at least one" herein refers to any combination of at least two of any one or more of a plurality of items. For example, "at least one of A, B, and C" can represent any one or more elements selected from the set consisting of A, B, and C.

[0062] Research has found that after a user terminal crashes, the crash information will be uploaded to the database, which makes it easier for developers to view and analyze the cause of the crash and fix the problem. However, due to the huge amount of data, it takes a lot of time for developers to process it.

[0063] Based on the above research, the present disclosure provides a crash clustering method. For crashes of the operating system, the system crash information generated after the crash is classified according to certain characteristics, and crashes caused by the same reason are divided into the same category, reducing the number of problem types for developers to view.

[0064] To facilitate understanding of this embodiment, we first provide a detailed introduction to a crash clustering method disclosed in this embodiment. The crash clustering method provided in this embodiment is generally executed by a computer device with certain computing capabilities. In some possible implementations, the crash clustering method can be implemented by a processor invoking computer-readable instructions stored in a memory.

[0065] See also Figure 1 FIG. 1 is a flowchart of a crash clustering method provided by an embodiment of the present disclosure, wherein the method includes steps S101 to S104, wherein:

[0066] S101: Acquire multiple pieces of system crash information generated after an operating system crashes.

[0067] An operating system is a computer program that manages computer hardware and software resources. It handles basic tasks such as managing and configuring memory, determining the priority of system resource supply and demand, controlling input and output devices, operating networks, and managing file systems, providing an interface for users to interact with the system. Currently, operating systems are mainly of two types: PC and mobile. PC versions include but are not limited to Microsoft Windows systems (commonly used on ordinary computers) and Linux systems (commonly used on servers); mobile versions include but are not limited to Android and iOS systems. Operating systems are widely used, ranging from smart desk lamps, sweeping robots, mobile phones, computers to large servers.

[0068] Optionally, operating system crash refers to the symptom of the system being unable to operate normally and frequently freezing due to operational errors or virus invasion, including thread crashes and kernel crashes.

[0069] A thread crash refers to an operating system crash caused by a thread being unable to continue due to resource occupancy or other reasons. A watchdog is typically used to monitor the operating system's health. Essentially, a watchdog is a timer circuit with an input and an output. The input is called a "feed" signal, and the output is typically connected to the reset terminal of another component. When the operating system is running stably, it feeds the watchdog after executing specific instructions. If the watchdog does not receive a "feed" signal from the software within a certain period, the system is considered abnormal.

[0070] If the operating system times out after two dog feedings, the operating system crashes as a thread crash, and the system crash information is obtained from the call stack information of all threads.

[0071] Specifically, when the crash is a thread crash, call stack information corresponding to the thread where the operating system crashes may be obtained, and the system crash information may be generated based on the call stack information.

[0072] For example, a crash detection program can be run on the operating system to obtain the process name of the target process that crashed. The process name of the target process is the target identification information. Then, summary information of the system crash information is generated based on the features in the call stack information. Finally, system crash information is generated that includes the target identification information of the crashed process, the above summary information and the above call stack information.

[0073] Optionally, kernel crash refers to a crash that occurs in the kernel. If the operating system crash is a kernel crash, the system crash information is obtained from kernel operation log information before the kernel crash is restarted.

[0074] The kernel operation log is used to record information about kernel problems in the operating system and can also monitor events occurring in the system, which can be used to investigate the cause of a crash or to locate traces left by an attacker during an attack. If the system crash information is generated based on the kernel operation log information, the crash type indicated in the system crash information is a kernel crash.

[0075] Specifically, in the case where the crash is a kernel crash, kernel running log information of the operating system before it is restarted due to the kernel crash may be obtained; and then, the system crash information may be generated based on the kernel running log information.

[0076] Specifically, generating the system crash information based on the kernel operation log information includes:

[0077] By traversing the code lines of the backtrace stack in the kernel operation log from top to bottom, the extracted information is used as the system crash information.

[0078] S102: For each piece of system crash information, extract a crash feature from the system crash information based on the type of the system crash information.

[0079] When the system crash information is generated based on the call stack information, target identification information of the crashing process, summary information of the system crash information, and call information of the target process may be extracted from the system crash information as the crash feature.

[0080] Furthermore, the class name of the target object called by the target process, the method name of the target object, and the lock information corresponding to the target object are extracted from the calling information of the target process excluding the interference of the address information.

[0081] Among them, locks are used to reasonably allocate resources during multi-threaded operation, and holding a lock means that a thread is occupying a certain resource.

[0082] It should be noted that since the lock information in the call information usually contains the memory address corresponding to the locked object, and the address of the locked object in the memory will change, if the memory address is still used for clustering, the same type of problems will be clustered into different types of problems. Therefore, the address information of the locked object can be deleted, thereby eliminating the impact of the address information on the feature identification.

[0083] Exemplarily, if the system crash information is generated based on the kernel operation log information, the following steps may be performed to extract crash features from the system crash information:

[0084] In the case where the system crash information is generated based on the kernel operation log information, the crash type information indicated in the system crash information is determined, and then a regular expression matching the crash type information is determined. Based on the regular expression, the crash cause information is extracted from the system crash information, and then the to-be-executed instruction information at the time of the crash and the memory address information where the exception occurred are extracted from the system crash information; finally, the extracted crash type information, the crash cause information, the to-be-executed instruction information and the memory address information are used as the crash feature.

[0085] Specifically, according to the custom crash type, the crash types of kernel crash include KE (kernel crash) type and non-KE type; for KE type, the crash type information value may be KE (kernel exception), JE (Java exception) and NE (native exception); for non-KE type, the crash type information value may be HWT, HW_REBOOT, THERMAL_REBOOT, OCP, SPAR, UVLO, HANG_DETECT, etc.

[0086] After determining the crash type of the system crash information, a regular expression matching the crash type information is determined, and crash cause information is extracted from the system crash information using the regular expression.

[0087] For the KE type, the crash type information of the crash cause information has the following five values:

[0088] 1. For kernel bug on (the location where the crash occurred), use the regular expression field kernel BUGat as a handle to extract the crash cause information, which is used to extract common crash information causes;

[0089] 2. Virtual address issues: Use regular expressions to use the field "Unable to handlekernel paging request at virtual address" as a handle to extract crash cause information for virtual address exception information.

[0090] 3. Null pointer issues: Use regular expressions to use the field "Unable to handlekernel NULL pointer dereference at virtual address" as a handle to extract crash cause information, which is used to extract exception information caused by pointer misuse.

[0091] 4. The sysrq-trigger (system request trigger) problem uses regular expressions to use the field sysrq (system request) as a handle to extract crash cause information. This is used to extract exception information when the system encounters difficult-to-reproduce exceptions.

[0092] 5. For other issues, directly use the information in the exception_info field (the crash information) as the crash cause information.

[0093] For non-KE problems, the information in the exception_info field (the crash information) is directly used as the crash cause information.

[0094] S103: Based on the crash feature, generate a feature identifier corresponding to the system crash information.

[0095] Exemplarily, the information digest value of the crash feature may be determined first, and then the information digest value may be used as the feature identifier corresponding to the system crash information.

[0096] Among them, the message digest value can be determined by the Message-Digest Algorithm (MD5), which is a cryptographic hash function that can generate a 128-bit (16-byte) hash value. It is usually used to ensure the integrity and consistency of information transmission. Specifically, by inputting multiple character strings, a string of corresponding fixed values ​​can be obtained through the MD5 algorithm. In other words, by inputting character strings with the same characteristics, the same feature identifier will be obtained. Therefore, by using the MD5 message digest algorithm to determine the message digest value, system crash information with the same characteristics can be classified into one category, thereby improving the efficiency of crash information classification.

[0097] S104: Clustering the plurality of system crash information based on the feature identifier to obtain a system crash information group corresponding to at least one crash cause.

[0098] Specifically, the system crash information group includes one or more pieces of operating system crash information with the same or similar characteristic identifiers.

[0099] The identical or similar feature identifiers are determined using the MD5 message digest algorithm: a common operating system crash information feature identifier (a 128-bit hash value) is extracted, and a first threshold is set. If the feature identifier of the operating system crash information determined using the MD5 message digest algorithm is within the first threshold of a common operating system crash information feature identifier, the operating system crash information is classified into the common operating system crash information group. This allows for the classification of large amounts of operating system crash information, reducing the amount of operating system crash information that developers must process.

[0100] The crash clustering method provided by the embodiment of the present disclosure obtains multiple system crash information generated after an operating system crash occurs; for each system crash information, based on the type of the system crash information, crash features are extracted from the system crash information; based on the crash features, feature identifiers corresponding to the system crash information are generated; based on the feature identifiers, the multiple system crash information are clustered to obtain a system crash information group corresponding to at least one crash cause. The embodiment of the present disclosure extracts crash features from the system crash information based on the type of the system crash information. The crash features can reflect the characteristic points about the crash in the system crash information and are representative. The feature identifiers generated from the crash features can characterize the characteristics of the crash features. Therefore, the crash identifiers can reflect various characteristics of the crash, achieving a high degree of generalization of the crash. Instead of directly clustering the system crash information, the feature identifiers are clustered, which can eliminate a large amount of irrelevant information. While retaining various features related to the crash, the clustering efficiency is improved, and the types of problems are reduced to facilitate developers to view and correct them.

[0101] Those skilled in the art will understand that in the above-mentioned method of the specific implementation method, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0102] Based on the same inventive concept, a crash clustering device corresponding to the crash clustering method is also provided in the embodiment of the present disclosure. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned crash clustering method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0103] Reference Figure 2 FIG. 1 is a schematic diagram of a crash clustering device provided by an embodiment of the present disclosure, the device comprising:

[0104] The acquisition module 201 is used to acquire a plurality of system crash information generated after the operating system crashes;

[0105] An extraction module 202 is configured to extract crash features from each piece of system crash information based on the type of the system crash information;

[0106] A calculation module 203 is configured to generate a feature identifier corresponding to the system crash information based on the crash feature;

[0107] The classification module 204 is configured to cluster the plurality of system crash information based on the feature identifier to obtain a system crash information group corresponding to at least one crash cause.

[0108] In the disclosed embodiment, based on the type of system crash information, crash features are extracted from the system crash information. The crash features can reflect the characteristic points about the crash in the system crash information and are representative. The feature identifiers generated by the crash features can characterize the characteristics of the crash features. Therefore, the crash identifiers can reflect various characteristics of the crash and achieve a high degree of generalization of the crash. Instead of directly clustering the system crash information, the feature identifiers are clustered, which can eliminate a large amount of irrelevant information. On the premise of retaining various crash-related features, the clustering efficiency is improved, and the types of problems are reduced to facilitate developers to view and correct them.

[0109] In an optional implementation manner, the crash of the operating system includes a thread crash;

[0110] When acquiring a plurality of pieces of system crash information generated after an operating system crashes, the acquisition module 201 is used to:

[0111] Obtaining call stack information corresponding to a thread that crashed in the operating system;

[0112] The system crash information is generated based on the call stack information.

[0113] In an optional implementation, when extracting crash features from the system crash information based on the type of the system crash information, the extraction module 202 is configured to:

[0114] In the case where the system crash information is generated based on the call stack information, target identification information of the crashing process, summary information of the system crash information, and call information of the target process are extracted from the system crash information as the crash feature.

[0115] In an optional implementation, when extracting the call information of the target process from the system crash information, the extraction module 202 is configured to:

[0116] The class name of the target object called by the target process, the method name of the target object, and the lock information corresponding to the target object are extracted from the system crash information.

[0117] In an optional implementation manner, the crash of the operating system includes a kernel crash;

[0118] When acquiring a plurality of pieces of system crash information generated after an operating system crashes, the acquisition module 201 is used to:

[0119] Obtaining kernel running log information of the operating system before it is restarted due to kernel crash;

[0120] The system crash information is generated based on the kernel operation log information.

[0121] In an optional implementation, when extracting crash features from the system crash information based on the type of the system crash information, the extraction module 202 is configured to:

[0122] In a case where the system crash information is generated based on the kernel operation log information, determining crash type information indicated in the system crash information;

[0123] Determining a regular expression that matches the crash type information;

[0124] Extracting crash cause information from the system crash information using the regular expression;

[0125] Extracting the to-be-executed instruction information and the memory address information of the abnormality at the time of the crash from the system crash information;

[0126] The crash type information, the crash cause information, the to-be-executed instruction information, and the memory address information are used as the crash feature.

[0127] In an optional implementation, when generating a feature identifier corresponding to the system crash information based on the crash feature, the calculation module 203 is configured to:

[0128] An information digest value of the crash feature is determined, and the information digest value is used as a feature identifier corresponding to the system crash information.

[0129] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference can be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0130] Corresponding to Figure 1 The embodiment of the present disclosure further provides an electronic device 300, such as Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device 300 provided in an embodiment of the present disclosure, including:

[0131] Processor 31, memory 32, and bus 33; memory 32 is used to store execution instructions, including internal memory 321 and external memory 322; the internal memory 321 is also called internal memory, which is used to temporarily store operation data in the processor 31 and data exchanged with external memory 322 such as a hard disk. The processor 31 exchanges data with the external memory 322 through the internal memory 321. When the electronic device 300 is running, the processor 31 communicates with the memory 32 via the bus 33, so that the processor 31 executes the following instructions:

[0132] Obtain multiple system crash messages generated after the operating system crashes;

[0133] For each piece of system crash information, extracting a crash feature from the system crash information based on the type of the system crash information;

[0134] Based on the crash feature, generating a feature identifier corresponding to the system crash information;

[0135] Based on the characteristic identifier, the plurality of system crash information are clustered to obtain a system crash information group corresponding to at least one crash cause.

[0136] In a possible implementation, in the instructions executed by the processor 31, the crash of the operating system includes a thread crash;

[0137] The obtaining of a plurality of system crash information generated after the operating system crashes includes:

[0138] Obtaining call stack information corresponding to a thread that crashed in the operating system;

[0139] The system crash information is generated based on the call stack information.

[0140] In a possible implementation, the instructions executed by the processor 31, wherein extracting crash features from the system crash information based on the type of the system crash information, includes:

[0141] In the case where the system crash information is generated based on the call stack information, target identification information of the crashing process, summary information of the system crash information, and call information of the target process are extracted from the system crash information as the crash feature.

[0142] In a possible implementation, the instructions executed by the processor 31 to extract the call information of the target process from the system crash information include:

[0143] The class name of the target object called by the target process, the method name of the target object, and the lock information corresponding to the target object are extracted from the system crash information.

[0144] In a possible implementation, in the instructions executed by the processor 31, the crash of the operating system includes a kernel crash;

[0145] The obtaining of a plurality of system crash information generated after the operating system crashes includes:

[0146] Obtaining kernel running log information of the operating system before it is restarted due to kernel crash;

[0147] The system crash information is generated based on the kernel operation log information.

[0148] In a possible implementation, the instructions executed by the processor 31, wherein extracting crash features from the system crash information based on the type of the system crash information, includes:

[0149] In a case where the system crash information is generated based on the kernel operation log information, determining crash type information indicated in the system crash information;

[0150] Determining a regular expression that matches the crash type information;

[0151] Extracting crash cause information from the system crash information using the regular expression;

[0152] Extracting the to-be-executed instruction information and the memory address information of the abnormality at the time of the crash from the system crash information;

[0153] The crash type information, the crash cause information, the to-be-executed instruction information, and the memory address information are used as the crash feature.

[0154] In a possible implementation, the instructions executed by the processor 31, wherein generating a feature identifier corresponding to the system crash information based on the crash feature, includes:

[0155] An information digest value of the crash feature is determined, and the information digest value is used as a feature identifier corresponding to the system crash information.

[0156] The present disclosure also provides a computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program executes the steps of the crash clustering method described in the above method embodiment. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0157] The present disclosure also provides a computer program product that carries program code. The program code includes instructions that can be used to execute the steps of the crash clustering method described in the above method embodiment. For details, please refer to the above method embodiment and will not be repeated here.

[0158] The computer program product may be implemented in hardware, software, or a combination thereof. In one embodiment, the computer program product is implemented as a computer storage medium. In another embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0159] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0160] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0161] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0162] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0163] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The scope of protection of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed in the present disclosure, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure shall be subject to the scope of protection of the claims.

Claims

1. A crash clustering method, characterized in that: include: Acquire a plurality of system crash information generated after the operating system crashes, wherein the system crash information is generated based on call stack information or based on kernel operation log information; For each piece of system crash information, extracting a crash feature from the system crash information based on the type of the system crash information, wherein the type of the system crash information includes a thread crash type or a kernel crash type; Based on the crash feature, generating a feature identifier corresponding to the system crash information; Based on the characteristic identifier, the plurality of system crash information are clustered to obtain a system crash information group corresponding to at least one crash cause.

2. The method according to claim 1, characterized in that In the case where the type of the system crash information is the thread crash type, The obtaining of a plurality of system crash information generated after the operating system crashes includes: Obtaining the call stack information corresponding to the thread that crashed in the operating system; The system crash information is generated based on the call stack information.

3. The method according to claim 2, characterized in that The extracting crash features from the system crash information based on the type of the system crash information includes: In the case where the system crash information is generated based on the call stack information, target identification information of the crashing process, summary information of the system crash information, and call information of the target process are extracted from the system crash information as the crash feature.

4. The method according to claim 3, characterized in that Extracting the call information of the target process from the system crash information includes: From the system crash information, the class name of the target object called by the target process, the method name of the target object, and the lock information corresponding to the target object are extracted, wherein the lock information includes a memory address corresponding to the locked object.

5. The method according to claim 1, wherein In the case where the type of the system crash information is the kernel crash type, The obtaining of a plurality of system crash information generated after the operating system crashes includes: Obtaining kernel operation log information of the operating system before it is restarted due to kernel crash; The system crash information is generated based on the kernel operation log information.

6. The method according to claim 5, characterized in that The extracting crash features from the system crash information based on the type of the system crash information includes: In a case where the system crash information is generated based on the kernel operation log information, determining crash type information indicated in the system crash information; Determining a regular expression that matches the crash type information; Extracting crash cause information from the system crash information using the regular expression; Extracting the to-be-executed instruction information and the memory address information of the abnormality at the time of the crash from the system crash information; The crash type information, the crash cause information, the to-be-executed instruction information, and the memory address information are used as the crash feature.

7. The method according to claim 1, characterized in that The generating, based on the crash feature, a feature identifier corresponding to the system crash information includes: An information digest value of the crash feature is determined, and the information digest value is used as a feature identifier corresponding to the system crash information.

8. A crash clustering device, characterized in that: include: An acquisition module, configured to acquire a plurality of system crash information generated after an operating system crashes, wherein the system crash information is generated based on call stack information or kernel operation log information; an extraction module, configured to extract crash features from each piece of system crash information based on a type of the system crash information, wherein the type of the system crash information includes a thread crash type or a kernel crash type; A calculation module, configured to generate a feature identifier corresponding to the system crash information based on the crash feature; The classification module is configured to cluster the plurality of system crash information based on the feature identifier to obtain a system crash information group corresponding to at least one crash cause.

9. An electronic device, characterized in that: include: A processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate via the bus. When the machine-readable instructions are executed by the processor, the steps of the crash clustering method according to any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the crash clustering method according to any one of claims 1 to 7.

Images