Method, device and electronic equipment for locating data anomaly

Abstract

The present application discloses a method, device and electronic device for locating data anomalies. The method includes: obtaining local business log information of a terminal device from a data cluster, wherein the local business log information includes a target field in a collection log corresponding to a service grid component; analyzing multiple types of information in the target field of the local business log information to determine the access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; in the case where there is abnormal information in the target field, determining the cause of the abnormality based on the access node information. The present application solves the technical problem that the traditional backend service deployment method cannot meet the needs of large traffic, and has low service efficiency and inaccurate abnormality positioning.

Description

Technical Field

[0001] The present application relates to the field of abnormal data processing, and in particular to a method, device and electronic device for locating data anomalies. Background Art

[0002] With the rapid development of Internet technology, the process of applying for number cards and packages has become very convenient. Users can purchase the number cards and corresponding number card packages they want by downloading the corresponding app or on the Internet platform. As the number of users applying for packages through online channels increases, the pressure on the background naturally increases. The traditional background service deployment method can no longer meet the needs of large traffic. Therefore, it is urgent to bring services into the cloud and introduce service grids. Due to the sharp increase in the number of online channel users, various complex package scenarios have also emerged, which has brought about a sharp increase in quantity and the complexity of service functions, and service errors are inevitable; but for the business platform of the container cloud platform, the business pod will drift with the usage rate of the node. It is definitely unrealistic to log in to the host to query the business log. In order to improve user satisfaction and service quality, each log of each cloud-based business platform must be collected into the log system through multiple components such as filebeat, kafka and logstash. However, for systems that have been connected to the service grid, if a service reports an error, such as a service return code of 503, then this return code is a service error or a sidecard error in the pod where the service is located. It is difficult for the current log collection system to distinguish.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, device and electronic device for locating data anomalies, so as to at least solve the technical problems that the traditional background service deployment method cannot meet the needs of large traffic, has low service efficiency and inaccurate anomaly positioning.

[0005] According to one aspect of an embodiment of the present application, a method for locating data anomalies is provided, comprising: obtaining local business log information of a terminal device from a data cluster, wherein the local business log information includes a target field in a collection log corresponding to a service grid component; analyzing multiple types of information in the target field of the local business log information to determine access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; when there is abnormal information in the target field, determining the cause of the abnormality based on the access node information.

[0006] Optionally, local business log information of the terminal device is obtained from the data cluster, including: obtaining local business log information of the terminal device and obtaining a collection log of a service grid component; determining a target field in the collection log; associating the local business log with the target field in the collection log to obtain local business log information containing the target field.

[0007] Optionally, associating the local business log with the target field in the collection log includes: obtaining a storage location for recording the local business log; obtaining the target field of the collection log from a header; and storing the target field in the storage location to associate the local business log with the target field.

[0008] Optionally, the multiple categories of information in the target field of the local business log information include: first category information, second category information, third category information and fourth category information, wherein the first category information represents the remote address in the downstream connection, the second category information is the address of the upstream host, the third category information is used to distinguish the traffic type of the current traffic, and the fourth category information is used to distinguish the cause of the abnormality.

[0009] Optionally, when the traffic type of the first category information is ingress traffic, the first category information represents the address of the scheduling unit of the caller; when the traffic type of the first category information is egress traffic, the first category information represents the address of the current scheduling unit.

[0010] Optionally, when the traffic type of the second category information is ingress traffic, the second category information represents the address of the current scheduling unit; when the traffic type of the second category information is egress traffic, the second category information represents the address of the scheduling unit of the callee.

[0011] Optionally, the cause of the exception includes an exception occurring in the service or an exception occurring in the sidecar mode.

[0012] According to another aspect of an embodiment of the present application, a device for locating data anomalies is also provided, including: an acquisition module, used to obtain local business log information of a terminal device from a data cluster, wherein the local business log information includes a target field in a collection log corresponding to a service grid component; an analysis module, used to analyze multiple types of information in the target field of the local business log information to determine access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; a determination module, used to determine the cause of the anomaly based on the access node information when there is abnormal information in the target field.

[0013] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: a memory for storing program instructions; a processor, connected to the memory, for executing program instructions to implement the following functions: obtaining local business log information of a terminal device from a data cluster, wherein the local business log information includes a target field in a collection log corresponding to a service grid component; analyzing multiple types of information in the target field of the local business log information to determine access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; in the event that abnormal information exists in the target field, determining the cause of the abnormality based on the access node information.

[0014] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned method for locating data anomalies by running the computer program.

[0015] In an embodiment of the present application, local business log information of a terminal device is obtained from a data cluster, wherein the local business log information includes a target field in a collection log corresponding to a service grid component; multiple types of information in the target field of the local business log information are analyzed to determine access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; in the case where there is abnormal information in the target field, the cause of the abnormality is determined based on the access node information, thereby achieving the purpose of determining the cause of the abnormality based on the target field in the collection log, thereby achieving the technical effect of improving the accuracy of abnormality positioning, and further solving the technical problems that the traditional background service deployment method cannot meet the needs of large traffic, and has low service efficiency and inaccurate abnormality positioning. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 It is a hardware structure block diagram of a computer terminal (or electronic device) for implementing a method for locating data anomalies according to an embodiment of the present application;

[0018] Figure 2 is a flow chart of a method for locating data anomalies according to an embodiment of the present application;

[0019] Figure 3a It is a flow chart of a log collection system according to an embodiment of the present application;

[0020] Figure 3bThis is a schematic diagram of a process of filebeat obtaining log field records into a database according to an embodiment of the present application;

[0021] Figure 4 It is a structural diagram of a device for locating data anomalies according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] The method embodiment of data anomaly locating provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or electronic device) for implementing a method for locating data anomalies is shown. Figure 1 As shown, the computer terminal 10 (or electronic device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0025] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or electronic device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0026] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the method for locating data anomalies in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the method for locating data anomalies described above is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0027] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0028] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or electronic device).

[0029] It should be noted that, in some optional embodiments, the above Figure 1The computer device (or electronic device) shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the above-described computer device (or electronic device).

[0030] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a method for locating data anomalies. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] Figure 2 is a flow chart of a method for locating data anomalies according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0032] Step S202, obtaining local business log information of the terminal device from the data cluster, wherein the local business log information includes a target field in the collection log corresponding to the service grid component;

[0033] Step S204, analyzing multiple types of information in the target field of the local service log information to determine the access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device;

[0034] Step S206: When there is abnormal information in the target field, determine the cause of the abnormality based on the access node information.

[0035] In the above steps S202 to S206, based on the local business log information in the existing log collection system, the logs of the service grid envoy component are collected. When an abnormal problem occurs, the pod with the problem can be quickly located to facilitate problem solving. Specifically, the special log field based on the service grid envoy (i.e., the above target field) is collected into the log system (i.e., containing the above local business log information), and according to the return code of the special field of envoy, it is quickly located whether it is an error return of the downstream business of the business platform or an error return corresponding to the downstream sidecard of the business platform (i.e., the above determination of the cause of the abnormality).

[0036] In step S202 of the above-mentioned method for locating data anomalies, local business log information of the terminal device is obtained from the data cluster, which specifically includes the following steps: obtaining the local business log information of the terminal device, and obtaining the collection log of the service grid component; determining the target field in the collection log; associating the local business log and the target field in the collection log to obtain local business log information containing the target field.

[0037] In the above steps, associating the local business log and the target field in the collection log specifically includes the following steps: obtaining the storage location for recording the local business log; obtaining the target field of the collection log from the header; storing the target field in the storage location to achieve the association between the local business log and the target field.

[0038] In an embodiment of the present application, each service accessing the log collection system needs to associate the business log (i.e., the above-mentioned local business log information) with the special field of the envoy log to ensure that the business log and the envoy log field are recorded in the log collection system at the same time. The specific steps for associating the business log and the envoy log field are as follows: Since envoy is a forwarding component of the service grid using the data plane, the service message accessing the service grid will carry the envoy log field. Therefore, in the business code, it is only necessary to obtain the envoy log field from the header (i.e., the above-mentioned header) at the place where the log is recorded (i.e., the storage location of the above-mentioned local business log), and then record it in the log file of the business.

[0039] In step S204 of the above-mentioned method for locating data anomalies, the multiple categories of information in the target field of the local business log information specifically include: first category information, second category information, third category information and fourth category information, wherein the first category information represents the remote address in the downstream connection, the second category information is the address of the upstream host, the third category information is used to distinguish the traffic type of the current traffic, and the fourth category information is used to distinguish the cause of the anomaly.

[0040] In the above-mentioned method for locating data anomalies, when the traffic type of the first category of information is ingress traffic, the first category of information represents the address of the scheduling unit of the caller; when the traffic type of the first category of information is egress traffic, the first category of information represents the address of the current scheduling unit.

[0041] In the above-mentioned method for locating data anomalies, when the traffic type of the second type of information is ingress traffic, the second type of information represents the address of the current scheduling unit; when the traffic type of the second type of information is egress traffic, the second type of information represents the address of the scheduling unit of the callee.

[0042] In the above-mentioned method for locating data anomalies, the causes of the anomalies include anomalies occurring in the service or anomalies occurring in the sidecar mode.

[0043] In the embodiment of the present application, by analyzing the envoy log field (i.e. the target field mentioned above), the access node of the terminal device can be quickly located, wherein the main log fields (i.e. the multiple types of information mentioned above) included are:

[0044] DOWNSTREAM_REMOTE_ADDRESS (i.e. the first type of information mentioned above): remote address in the downstream connection; divided into two cases. When the traffic type of this type of information is ingress traffic, it indicates the address of the caller's pod (i.e. the scheduling unit mentioned above); when the traffic type of this type of information is egress traffic, it indicates the address of the current pod.

[0045] UPSTREAM_HOST (the second type of information mentioned above): host address of the upstream host; it is divided into two cases. When the traffic type of this type of information is ingress traffic, it indicates the address of the current pod itself; when the traffic type of this type of information is egress traffic, it indicates the address of the called pod.

[0046] UPSTREAM_CLUSTER (ie, the third type of information mentioned above): is used to distinguish the traffic type of the current traffic, that is, to distinguish whether it is ingress traffic or egress traffic.

[0047] RESPONS_FLAGES (i.e. the fourth type of information mentioned above): is used to distinguish the cause of the exception, that is, to distinguish whether the service returns an exception or the sidecar (i.e. the sidecar mode mentioned above) returns an exception.

[0048] The following example illustrates this. For example, if you check the log field of a pod_A log, the corresponding IP address of DOWNSTREAM_REMOTE_ADDRESS is xxx.xx.xx.14, and the pod is the ingress traffic, you can determine that the pod corresponding to the IP address xxx.xx.xx.14 called pod_A. With the IP address of the pod, you can find the node of the caller by using the k8s command: kubectl getpods-n ns-o wide|grep ip.

[0049] Figure 3a is a flow chart of a log collection system according to an embodiment of the present application. Figure 3a In the example, local business logs include the following log fields: DOWNSTREAM_REMOTE_ADDRESS, UPSTREAM_HOST and other types of information. By collecting logs, local business log information is stored in filebeat.

[0050] Store local business log information and envoy logs in the kafka cluster, read log data from the kafka cluster and write them to elasticsearch. When querying logs, query logs from elasticsearch.

[0051] Figure 3b This is a flow chart of filebeat obtaining log field records into a database according to an embodiment of the present application, such as Figure 3b As shown in the figure, the system includes two pods, namely pod_1 and pod_2. Each pod includes a business container and filebeat. The log content is obtained from the pod and written to the kafka cluster. The data is read from the kafka cluster and written to the es cluster.

[0052] The above data anomaly location method is based on the log collection system, combined with the service grid envoy log, which is convenient for analyzing link information. The main steps include: Step 1: Modify the code of the access service to ensure that the necessary fields of the envoy log are written at the same time as a business log. The specific operation plan is that the business system obtains the envoy log field from the header while recording the business log, and then records it in the log file. Step 2: Access the log collection system to ensure that the business log and the envoy log are collected to elasticsearch at the same time. The specific operation steps are: 1: Edit the filebeat image and edit the business image; 2: Edit the business image and the filebeat image into the same yaml file, which can ensure that the business container and the filebeat container are in the same pod at the same time; through the k8s instruction (kubectl applyxxx.yaml-n ns), the pod can be run and started; Step 3: According to the envoy log field, the error return and the pod address where the transaction occurred can be easily divided and distinguished.

[0053] The method for locating data anomalies provided in the embodiment of the present application has the following advantages: 1. Based on the log collection system, the service grid envoy log is collected into the log system to facilitate problem troubleshooting; 2. When a problem occurs, the pod with the problem can be quickly located and the detailed log can be viewed, which is accurate and reliable.

[0054] Figure 4 is a structural diagram of a device for locating data anomalies according to an embodiment of the present application, such as Figure 4 As shown, the device comprises:

[0055] The acquisition module 402 is used to acquire local business log information of the terminal device from the data cluster, wherein the local business log information includes the target field in the collection log corresponding to the service grid component;

[0056] An analysis module 404 is used to analyze multiple types of information in the target field of the local service log information to determine the access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device;

[0057] The determination module 406 is used to determine the cause of the abnormality based on the access node information when there is abnormal information in the target field.

[0058] In the acquisition module in the above-mentioned data anomaly locating device, the local business log information of the terminal device is obtained from the data cluster, which specifically includes the following processes: obtaining the local business log information of the terminal device, and obtaining the collection log of the service grid component; determining the target field in the collection log; associating the local business log and the target field in the collection log to obtain the local business log information containing the target field.

[0059] In the acquisition module in the above-mentioned data anomaly locating device, the target fields in the local business log and the collection log are associated, which specifically includes the following processes: obtaining the storage location of the local business log; obtaining the target field of the collection log from the header; storing the target field in the storage location to realize the association between the local business log and the target field.

[0060] In the above-mentioned data anomaly locating device, the multiple categories of information in the target field of the local business log information specifically include the following categories: first category information, second category information, third category information and fourth category information, wherein the first category information represents the remote address in the downstream connection, the second category information is the address of the upstream host, the third category information is used to distinguish the traffic type of the current traffic, and the fourth category information is used to distinguish the cause of the anomaly.

[0061] In the above-mentioned device for locating data anomalies, when the traffic type of the first type of information is ingress traffic, the first type of information represents the address of the scheduling unit of the caller; when the traffic type of the first type of information is egress traffic, the first type of information represents the address of the current scheduling unit.

[0062] In the above-mentioned device for locating data anomalies, when the traffic type of the second type of information is ingress traffic, the second type of information represents the address of the current scheduling unit; when the traffic type of the second type of information is egress traffic, the second type of information represents the address of the scheduling unit of the callee.

[0063] In the above-mentioned device for locating data anomaly, the cause of the anomaly includes an anomaly occurring in the service or an anomaly occurring in the sidecar mode.

[0064] It should be noted that Figure 4 The device for locating data anomalies is used to perform Figure 2 The method for locating anomalies of data shown in the figure, therefore, the relevant explanations in the above method for locating anomalies of data are also applicable to the device for locating anomalies of data, and will not be repeated here.

[0065] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following data anomaly locating method by running the computer program: obtaining local business log information of the terminal device from the data cluster, wherein the local business log information includes a target field in the collection log corresponding to the service grid component; analyzing multiple types of information in the target field of the local business log information to determine the access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; when there is abnormal information in the target field, determining the cause of the abnormality based on the access node information.

[0066] In the above-mentioned non-volatile storage medium, local business log information of the terminal device is obtained from the data cluster, which specifically includes the following processes: obtaining the local business log information of the terminal device, and obtaining the collection log of the service grid component; determining the target field in the collection log; associating the local business log and the target field in the collection log to obtain local business log information containing the target field.

[0067] In the above-mentioned non-volatile storage medium, associating the local business log and the target field in the collection log specifically includes the following processes: obtaining the storage location for recording the local business log; obtaining the target field of the collection log from the header; storing the target field in the storage location to achieve the association between the local business log and the target field.

[0068] In the above-mentioned non-volatile storage medium, the multiple categories of information in the target field of the local business log information specifically include the following categories: first category information, second category information, third category information and fourth category information, wherein the first category information represents the remote address in the downstream connection, the second category information is the address of the upstream host, the third category information is used to distinguish the traffic type of the current traffic, and the fourth category information is used to distinguish the cause of the abnormality.

[0069] In the above-mentioned non-volatile storage medium, when the traffic type of the first category information is ingress traffic, the first category information represents the address of the scheduling unit of the caller; when the traffic type of the first category information is egress traffic, the first category information represents the address of the current scheduling unit.

[0070] In the above-mentioned non-volatile storage medium, when the traffic type of the second type of information is ingress traffic, the second type of information represents the address of the current scheduling unit; when the traffic type of the second type of information is egress traffic, the second type of information represents the address of the scheduling unit of the callee.

[0071] In the above non-volatile storage medium, the cause of the exception includes an exception occurring in the service or an exception occurring in the sidecar mode.

[0072] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0073] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0074] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0075] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0076] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0077] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0078] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for locating data anomalies, characterized in that: include: Acquire local business log information of the terminal device from the data cluster, wherein the local business log information includes a target field in the collection log corresponding to the service grid component; Analyze multiple types of information in the target field of the local service log information to determine the access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; In the case where abnormal information exists in the target field, determining the cause of the abnormality according to the access node information; The multiple types of information in the target field of the local business log information include: first type of information, second type of information, third type of information and fourth type of information, wherein the first type of information indicates the remote address in the downstream connection, the second type of information is the address of the upstream host, the third type of information is used to distinguish the traffic type of the current traffic, and the fourth type of information is used to distinguish the cause of the abnormality; When the traffic type of the first category of information is ingress traffic, the first category of information represents the address of the scheduling unit of the caller; when the traffic type of the first category of information is egress traffic, the first category of information represents the address of the current scheduling unit.

2. The method according to claim 1, characterized in that Obtain local service log information of terminal devices from the data cluster, including: Obtaining local business log information of the terminal device and obtaining collection logs of the service grid component; Determining a target field in the collection log; The local business log is associated with the target field in the collection log to obtain local business log information including the target field.

3. The method according to claim 2, characterized in that Associating the local business log with a target field in the collection log includes: Obtaining a storage location for recording the local business log; Obtain the target field of the collected log from the header; The target field is stored in the storage location to achieve association between the local business log and the target field.

4. The method according to claim 1, characterized in that: When the traffic type of the second category information is ingress traffic, the second category information represents the address of the current scheduling unit; when the traffic type of the second category information is egress traffic, the second category information represents the address of the scheduling unit of the callee.

5. The method according to claim 1, characterized in that The cause of the exception includes an exception occurring in the service or an exception occurring in the sidecar mode.

6. A device for locating data anomalies, characterized in that: include: An acquisition module, used to acquire local business log information of a terminal device from a data cluster, wherein the local business log information includes a target field in a collection log corresponding to a service grid component; An analysis module, used for analyzing multiple types of information in the target field of the local service log information to determine the access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; A determination module, configured to determine the cause of the abnormality according to the access node information when abnormal information exists in the target field; The multiple types of information in the target field of the local business log information include: first type of information, second type of information, third type of information and fourth type of information, wherein the first type of information indicates the remote address in the downstream connection, the second type of information is the address of the upstream host, the third type of information is used to distinguish the traffic type of the current traffic, and the fourth type of information is used to distinguish the cause of the abnormality; When the traffic type of the first category of information is ingress traffic, the first category of information represents the address of the scheduling unit of the caller; when the traffic type of the first category of information is egress traffic, the first category of information represents the address of the current scheduling unit.

7. An electronic device, characterized in that: include: A memory for storing program instructions; A processor, connected to the memory, is used to execute program instructions that implement the following functions: obtaining local business log information of a terminal device from a data cluster, wherein the local business log information includes a target field in a collection log corresponding to a service grid component; analyzing multiple types of information in the target field of the local business log information to determine access node information of the terminal device, wherein the multiple types of information are used to locate the access node of the terminal device; in the case where there is abnormal information in the target field, determining the cause of the abnormality based on the access node information; the multiple types of information in the target field of the local business log information include: first type information, second type information, third type information and fourth type information, wherein the first type information represents a remote address in a downstream connection, the second type information is an address of an upstream host, the third type information is used to distinguish a traffic type of the current traffic, and the fourth type information is used to distinguish a cause of the abnormality; in the case where the traffic type of the first type information is ingress traffic, the first type information represents an address of a scheduling unit of a caller; in the case where the traffic type of the first type information is egress traffic, the first type information represents an address of a current scheduling unit.

8. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the method for locating data anomalies as described in any one of claims 1 to 5 by running the computer program.

Images