Methods and apparatus for determining the causes of indicator failures

Abstract

This invention discloses a method and apparatus for determining the cause of indicator failure, relating to the field of computer technology and applicable to areas such as cloud computing and intelligent supply chains. A specific implementation of the method includes: acquiring a first time-series curve of an abnormal indicator in a first time period, the first time-series curve containing the abnormal points of the abnormal indicator; acquiring second time-series curves of multiple indicators to be analyzed in a second time period, the second time period corresponding to the first time period; calculating the similarity between the first time-series curve and each of the second time-series curves; and determining the cause of the abnormal indicator failure based on the similarity corresponding to each of the second time-series curves. This implementation utilizes the correlation between indicators to accurately determine the cause of indicator failure.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for determining the cause of an indicator failure. Background Technology

[0002] In major internet companies, operations and maintenance personnel monitor various system metrics to promptly identify anomalies and investigate the root causes, ensuring the system's normal operation. However, in actual operations and maintenance, when a particular metric becomes abnormal, there are many possible causes, making troubleshooting difficult. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a method and apparatus for determining the cause of indicator failure, which can accurately determine the cause of indicator failure by utilizing the correlation between indicators.

[0004] In a first aspect, embodiments of the present invention provide a method for determining the cause of an indicator failure, comprising:

[0005] Obtain the first time-series curve of the abnormal indicator in the first time period, and the first time-series curve contains the abnormal points of the abnormal indicator.

[0006] Obtain the second time-series curves of multiple indicators to be analyzed in the second time period, which corresponds to the first time period.

[0007] Calculate the similarity between the first time series curve and each of the second time series curves;

[0008] The cause of failure of the abnormal index is determined based on the similarity of each of the second time series curves.

[0009] Optionally, obtaining the first time-series curve of the abnormal indicator in the first time period includes:

[0010] Obtain historical data for the aforementioned abnormal indicators;

[0011] Based on the historical data of the abnormal indicators, a time-series curve of the abnormal indicators is generated;

[0012] Detect the target time point when the abnormal indicator shows an abnormal value, and determine the first time period that includes the target time point;

[0013] The first time series curve is generated by extracting the time series curve corresponding to the first time period from the time series curve of the abnormal indicator.

[0014] Optionally, obtaining the second time-series curves of multiple indicators to be analyzed in the second time period includes:

[0015] Obtain historical data for the indicator to be analyzed;

[0016] Based on the historical data of the indicator to be analyzed, a time series curve of the indicator to be analyzed is generated;

[0017] Determine the second time period corresponding to the first time period;

[0018] From the time series curve of the indicator to be analyzed, extract the time series curve corresponding to the second time period to generate the second time series curve.

[0019] Optionally, calculating the similarity between the first time-series curve and each of the second time-series curves includes:

[0020] Preprocessing is performed on the first timing curve and the second timing curve respectively;

[0021] Calculate the shape distance between the preprocessed first time series curve and each preprocessed second time series curve;

[0022] The shape distances corresponding to each of the second time series curves are normalized to obtain the similarity of each of the second time series curves.

[0023] Optionally, determining the cause of failure of the abnormal index based on the similarity of each of the second time-series curves includes:

[0024] Determine whether a second time-series curve with a similarity greater than a similarity threshold exists;

[0025] In response to the existence of a second time series curve with a similarity greater than a similarity threshold, the index to be analyzed corresponding to the second time series curve with a similarity greater than a similarity threshold is determined as the associated index corresponding to the abnormal index.

[0026] Determine whether the associated indicator shows any outliers during the second time period;

[0027] In response to the occurrence of an abnormal value in the associated indicator during the second time period, the cause of the failure of the abnormal indicator is determined to be the abnormality of the associated indicator.

[0028] Optionally, the abnormal indicators include: application indicators of the target application, and the indicators to be analyzed include: performance indicators of the target host, wherein the target application is deployed on the target host.

[0029] Optionally, the abnormal indicators include: the slow query frequency of the target database instance, the indicators to be analyzed include: the performance indicators of the target database instance, and the abnormal point is the point where the slow query frequency exceeds the frequency threshold;

[0030] The step of determining the cause of failure of the abnormal index based on the similarity of each of the second time-series curves includes:

[0031] Determine whether a second time-series curve with a similarity greater than a similarity threshold exists;

[0032] Since there is no second time-series curve with a similarity greater than the similarity threshold, the cause of the abnormal slow query frequency is determined to be a problem with the query statement.

[0033] In response to the existence of a second time-series curve with a similarity greater than the similarity threshold, the cause of the abnormal slow query frequency was determined to be a database instance performance failure.

[0034] Secondly, embodiments of the present invention provide an apparatus for determining the cause of an indicator failure, comprising:

[0035] The first acquisition module is used to acquire the first time-series curve of the abnormal indicator in a first time period, wherein the first time-series curve contains the abnormal points of the abnormal indicator.

[0036] The second acquisition module is used to acquire the second time-series curves of multiple indicators to be analyzed in a second time period, the second time period corresponding to the first time period.

[0037] The calculation module is used to calculate the similarity between the first time series curve and each of the second time series curves;

[0038] The cause determination module is used to determine the cause of failure of the abnormal index based on the similarity of each of the second time series curves.

[0039] Thirdly, embodiments of the present invention provide an electronic device, including:

[0040] One or more processors;

[0041] Storage device for storing one or more programs.

[0042] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

[0043] Fourthly, embodiments of the present invention provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the methods described in any of the above embodiments.

[0044] One embodiment of the above invention has the following advantages or beneficial effects: First time-series curves corresponding to abnormal indicators and second time-series curves corresponding to each indicator to be analyzed are obtained respectively. The correlation between the abnormal indicators and each indicator to be analyzed is determined by calculating the similarity between the first and second time-series curves. Utilizing the correlation between indicators, the cause of indicator failure can be quickly and accurately determined, reducing the difficulty of troubleshooting abnormal indicator failures.

[0045] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0046] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0047] Figure 1 This is a schematic diagram of the process for determining the cause of an indicator failure according to an embodiment of the present invention;

[0048] Figure 2 This is a schematic diagram of a method for determining the cause of an indicator failure according to another embodiment of the present invention;

[0049] Figure 3 This is a schematic diagram of a multi-time-series curve comparison for determining the cause of a fault, provided by an embodiment of the present invention;

[0050] Figure 4 This is a schematic diagram of comparing the time series curves of abnormal indicators with the time series curves of related indicators according to an embodiment of the present invention;

[0051] Figure 5 This is a schematic diagram of a device for determining the cause of an indicator failure, provided in an embodiment of the present invention;

[0052] Figure 6 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0053] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0054] It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of this invention comply with the relevant provisions of national laws and regulations.

[0055] When a system malfunctions, the monitoring system will generate a series of indicator alarms. Some indicator alarms of certain devices are caused by indicator alarms of other devices, that is, there may be correlations between indicators of different types of devices, and there are some strongly correlated rules hidden between the indicators.

[0056] Considering the propagation relationships between indicator alerts, business-side failures may be affected by the underlying resource layer. This invention proposes a similarity recognition algorithm based on the time series data of indicators. By mining the mutual influence relationships between indicators, the algorithm analyzes the correlation between indicators and thus determines the cause of indicator anomalies.

[0057] Figure 1 This is a schematic diagram of a method for determining the cause of an indicator failure according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0058] Step 101: Obtain the first time series curve of the abnormal indicator in the first time period. The first time series curve contains the abnormal points of the abnormal indicator.

[0059] Anomaly metrics are those that exhibit outliers within a statistical period. These metrics can directly impact application operation or user experience, or are key metrics monitored by the system. Users can define anomaly metrics. Examples include: application success rate, application response rate, application transaction volume, database response time, and slow query frequency.

[0060] The first time series curve contains the abnormal points of the abnormal indicators, that is, the abnormal indicators show abnormal values ​​at the target time point, and the target time point is included in the first time period. By analyzing the first time series curve, the cause of the abnormal values ​​of the abnormal indicators can be determined.

[0061] The first time-series curve can be obtained in the following ways: acquiring historical data of abnormal indicators; generating time-series curves of abnormal indicators based on the historical data of abnormal indicators; detecting the target time point when abnormal values ​​of abnormal indicators occur, and determining the first time period containing the target time point; extracting the time-series curve corresponding to the first time period from the time-series curves of abnormal indicators to generate the first time-series curve.

[0062] Obtain historical data of abnormal indicators within the statistical period and generate time-series curves for the abnormal indicators. Determine when the abnormal indicators exhibit outliers at the target time point, generate the first time-series curve for the abnormal indicators, and analyze and monitor the outliers of the abnormal indicators using the time-series curves.

[0063] Step 102: Obtain the second time series curves of multiple indicators to be analyzed in the second time period, which corresponds to the first time period.

[0064] The second time period corresponds to the first time period and can be determined in various ways. For example, the start and end times of the second time period are the same as those of the first time period. Alternatively, the start time of the second time period is the start time of the first time period, and the end time of the second time period is the end time of the first time period delayed by a preset duration. Or, the start time of the second time period is the start time of the first time period preceding a preset duration, and the end time of the second time period is the end time of the first time period, etc.

[0065] The second time series curve can be obtained in the following ways: acquiring historical data of the indicator to be analyzed; generating a time series curve of the indicator to be analyzed based on the historical data of the indicator to be analyzed; determining a second time period corresponding to the first time period; and extracting the time series curve corresponding to the second time period from the time series curve of the indicator to be analyzed to generate the second time series curve.

[0066] The metrics to be analyzed are those that may be related to the abnormal metrics. These metrics and the abnormal metrics can originate from different devices. Metrics to be analyzed can be selected based on experience, multiple monitoring metrics from the system can be selected, or they can be randomly selected from multiple monitoring metrics. Metrics to be analyzed may include: host process count, host CPU metrics, memory metrics, load metrics, disk space metrics, disk I / O metrics, connection count metrics, network interface card metrics, etc.

[0067] Step 103: Calculate the similarity between the first time series curve and each of the second time series curves.

[0068] The system can calculate the target distance between the first time-series curve and each of the second time-series curves, and use this target distance as the similarity between the first time-series curve and each of the second time-series curves. The target distance can be: Euclidean distance, edit distance, SBD (shape-based distance), etc.

[0069] Cross-correlation SBD distance is one of the methods for measuring distance in time series data, and it can find the correlation between two sets of features under uncertain delays. SBD is a method for comparing the similarity of curve shapes based on cross-correlation distance. Cross-correlation calculates the sliding inner product between two time series data and is commonly used in signal processing, exhibiting natural robustness to phase deviations. For two time series curves (x... 1, x 2, x 3, x 4, …x n ) and (y 1, y 2, y 3, y 4, …y nThe phase deviation s, standardized cross-correlation NCC, and distance metric SBD can be calculated as follows:

[0070]

[0071]

[0072] SBD(X,Y)=1-NCC(X,Y)

[0073] Here, NCC is the standardized cross-correlation coefficient of sequences X and Y, with a value ranging from -1 to 1, similar to the Pearson correlation coefficient. The final calculated SBD algorithm result is between 0 and 2; the closer to 0, the stronger the correlation between the two sets of data. When SBD is 0, it indicates that the fluctuation curves of sequences X and Y are consistent, suggesting they are the same sequence.

[0074] Shape-based SBD distance is inherently robust to phase deviations. Using SBD as a similarity metric can eliminate the influence of phase deviations between curves, making the similarity results between time series curves more accurate.

[0075] Step 104: Determine the cause of the abnormal index failure based on the similarity of each second time series curve.

[0076] The target distance is used to calculate the similarity of abnormal fluctuations of various indicators within the fault period. Based on the similarity, the correlation of the fault is explored, which facilitates subsequent alarm convergence and fault cause localization.

[0077] In this embodiment of the invention, a first time-series curve corresponding to the abnormal indicator and a second time-series curve corresponding to each indicator to be analyzed are obtained. By calculating the similarity between the first and second time-series curves, the correlation between the abnormal indicator and each indicator to be analyzed is determined. Utilizing the correlation between indicators, the cause of indicator failure can be quickly and accurately determined, reducing the difficulty of troubleshooting abnormal indicator failures.

[0078] This method, which mines fault correlations based on indicator fluctuation patterns, first models the time-series data obtained from monitoring various indicators of the application and basic resource layers to obtain time-series curves. Then, an improved SBD distance algorithm is used to calculate the similar time-series curves between the application and basic resource layers, and these similar time-series curves are used as correlation indicators for application indicators.

[0079] When monitoring various metrics of application or system resources, sampling is performed for the time periods when abnormal values ​​occur, resulting in time-series curves for multiple metrics. Common curve discrepancies include the following:

[0080] Noise and anomalies: fluctuations on the curve that do not conform to normal values.

[0081] Differences in dimensions: The index curve may have amplitudes of different orders of magnitude. For example, different categories of indicators have different dimensions, which leads to differences in the amplitude of the curve.

[0082] Phase deviation: The overall phase offset between two indicator curves, usually caused by time delay. For example, a group of applications and resources on the same system call chain may experience anomalies in certain indicators of the basic resource layer only after a certain period of time due to the lag in fault propagation. Therefore, the two indicator curves have similar shapes, but there is a certain time delay, resulting in phase deviation.

[0083] To accurately calculate the similarity between time-series curves, preprocessing is required to reduce the impact of curve differences on the similarity calculation. Specifically, the first and second time-series curves are preprocessed separately; the shape distance between the preprocessed first time-series curve and each preprocessed second time-series curve is calculated; and the shape distance of each second time-series curve is normalized to obtain the similarity of each second time-series curve.

[0084] Preprocessing includes noise and outlier removal, data cleaning, default value filling, and unit standardization. Normalization is used to map similarity values ​​to a preset interval. The scheme in this embodiment of the invention measures similarity based on an improved SBD distance and eliminates inaccurate matching issues caused by phase asynchrony, inconsistent units, and inconsistent increases or decreases in the curves through data standardization and normalization. This results in better robustness, higher accuracy, and stronger adaptability.

[0085] Figure 2 This is a schematic diagram of a method for determining the cause of an indicator failure according to another embodiment of the present invention. Figure 2 As shown, the method includes:

[0086] Step 201: Obtain the first time-series curve of the abnormal indicator in the first time period. The first time-series curve contains the abnormal points of the abnormal indicator.

[0087] Step 202: Obtain the second time series curves of multiple indicators to be analyzed in the second time period, which corresponds to the first time period.

[0088] Step 203: Calculate the similarity between the first time series curve and each of the second time series curves.

[0089] Step 204: Determine whether there is a second time series curve with a similarity greater than the similarity threshold.

[0090] If no second time-series curve with a similarity greater than the similarity threshold exists, then none of the multiple indicators to be analyzed are associated with the abnormal indicator. If a second time-series curve with a similarity greater than the similarity threshold exists, proceed to step 205.

[0091] Step 205: The index to be analyzed corresponding to the second time series curve with a similarity greater than the similarity threshold is identified as the associated index corresponding to the abnormal index.

[0092] Step 206: Determine whether any outliers appear in the associated indicators during the second time period.

[0093] If the associated indicator does not show any outliers in the second time period, then the associated indicator did not show any abnormalities during the fault period, and the fault cause of the abnormal indicator showing an outlier at the target time point cannot be attributed to the associated indicator being abnormal. If the associated indicator shows an outlier in the second time period, the fault cause of the abnormal indicator showing an outlier at the target time point is attributed to the associated indicator being abnormal, and step 207 is executed.

[0094] Step 207: Determine the cause of the abnormal indicator failure as an abnormal related indicator.

[0095] There may be multiple second-time-series curves with similarity greater than the similarity threshold, and abnormal indicators may correspond to multiple related indicators. The related indicators that exhibit outliers in the second time period are identified as target indicators, and the cause of failure for the abnormal indicators is attributed to the target indicator's anomaly.

[0096] This invention proposes an algorithm based on the similarity of the fluctuation shapes of the time-series curves of indicators to mine the correlation of indicator failures. It analyzes the correlation of failures by mining the mutual influence relationships between indicators. The algorithm calculates the similarity of abnormal fluctuations in the time-series curves of each indicator within the failure period, and mines the correlation of indicator failures based on the similarity, thereby enabling subsequent alarm convergence and root cause localization.

[0097] Figure 3 This is a schematic diagram illustrating a multi-time-series curve comparison method for determining the cause of a fault, provided by an embodiment of the present invention. Figure 3 As shown, Figure 3 The study involves one outlier and four indicators to be analyzed. The outlier and the indicators to be analyzed exhibit differences in their curves, including phase asynchrony, different dimensions, and inconsistent increases and decreases. Preprocessing of each time series curve reduces these differences, making the similarity results between the indicators more accurate.

[0098] To address the discrepancy between increases and decreases, the similarity between two time-series curves is calculated as follows: Determine the reverse curve 1 of the positive curve 1 for the abnormal indicator, and determine the reverse curve 2 of the positive curve 2 for the indicator to be analyzed. Calculate the target distances between positive curve 1 and positive curve 2, between positive curve 1 and reverse curve 2, between reverse curve 1 and positive curve 2, and between reverse curve 1 and reverse curve 2, respectively. Then, take the minimum value of these results as the final target distance between the abnormal indicator and the indicator to be analyzed, thereby reducing the impact of inconsistencies in increases and decreases. The smaller the target distance, the more similar the two indicators are; the target distance is then used as the similarity between the two indicators.

[0099] Similarity calculations revealed similarities of 1%, 18%, 50%, and 11% between the abnormal indicator and the four indicators to be analyzed. The third indicator showed a similarity of 50% with the abnormal indicator, exceeding the similarity threshold, indicating a strong correlation between the two. The root cause of the target indicator's anomaly may be the anomaly of the third indicator to be analyzed.

[0100] Figure 4 This is a schematic diagram illustrating the comparison of time-series curves of anomaly indicators and related indicators according to an embodiment of the present invention. Figure 4 As shown, the top graph is the first time series curve corresponding to the abnormal indicator, and the bottom graph is the second time series curve corresponding to the third indicator to be analyzed, which is most similar to the time series curve of the abnormal indicator. The points in the graphs are randomly labeled, representing the fluctuations of different indicator values. Figure 4 As can be seen, the first time series curve is very similar in shape to the second time series curve. The third indicator to be analyzed is identified as a related indicator of the abnormal indicator. The abnormality of the related indicator may be the root cause of the abnormal value of the abnormal indicator.

[0101] The solution presented in this invention can be used to locate the cause of application metric anomalies. By associating metrics with the correspondence between system application anomalies and the host layer, it facilitates root cause analysis of application failures. Anomaly metrics include: application metrics of the target application. Metrics to be analyzed include: performance metrics of the target host, on which the target application is deployed.

[0102] Application metrics can include application latency, success rate, response rate, and transaction volume. The following section uses application latency as an example to illustrate the calculation process of the application failure correlation root cause analysis algorithm:

[0103] Step S01: Detect various performance metrics for the application and the multiple hosts deploying the application, and plot time-series curves based on historical data. The historical data contains mostly normal values; for the few missing values ​​in the metrics, linear interpolation is used to fill them in. After filling, the original metric data is standardized and normalized to eliminate the influence of amplitude differences, thereby enabling comparison of the similarity between metrics of different systems and applications.

[0104] Step S02: Abnormal Pattern Extraction. The anomaly detection model is invoked to detect application time-consuming monitoring metrics. For time points where anomalies occur, time-series curves corresponding to multiple performance metrics of the host hosting the application are retrieved within that time period. The first time-series curve corresponding to the application time consumption and the second time-series curves corresponding to the performance metrics of each host are used as input to the algorithm for mining fault correlation based on metric fluctuation patterns.

[0105] Host performance metrics may include the number of processes, CPU usage, memory usage, load, disk space usage, disk I / O usage, number of connections, and network interface card (NIC) performance.

[0106] Step S03: Similarity calculation. After obtaining the time-series curves of the application and the host on which the application is located, the curve similarity between the application and each performance indicator is calculated. Shape-based SBD distance is used as the similarity measure to eliminate the influence of phase deviation between curves.

[0107] Step S04: Anomaly matching. The SBD distance between the curves obtained in step S03 is mapped to the (0,1) interval through a softmax function and converted into a probabilistic similarity. The final anomaly matching result is then obtained based on the probability value.

[0108] For example, if an application takes too long to complete, and the first timing curve corresponding to the application duration is highly similar to the second timing curve corresponding to the available memory of the target host, it can be determined that the reason for the excessive application duration is abnormal available memory of the target host. Therefore, the problem of excessive application duration can be eliminated by increasing the host memory.

[0109] The solution in this invention is applied to root cause analysis of application failure correlation. It calls an anomaly detection model to detect application time-consuming monitoring metrics. For anomaly occurrences, it retrieves multiple performance metric curves from the host machine hosting the application within that time period, using them as input for an algorithm to mine the correlation between metric fluctuation patterns. After obtaining the anomaly curves of the host machine hosting the application, it calculates the curve similarity of each performance metric between the application and the host. It uses shape-based SBD distance as a similarity metric to eliminate the influence of phase deviation between curves. The obtained SBD distances between curves are mapped to the (0,1) interval and converted into probabilistic similarity, thus obtaining the final anomaly matching result based on the probability value.

[0110] The solution in this invention can also be used to locate the cause of slow query anomalies. By observing the sudden increase in the frequency of slow queries and the abnormal fluctuations in various performance indicators of the database instance when the anomaly occurs, database performance problems can be located. By comparing the similarity of the fluctuation patterns of the instance's performance indicators, it can be diagnosed whether the slow query is related to the instance's own performance indicators, thereby determining whether the slow query problem is due to a performance issue of the database instance or a problem with the SQL statement itself, thus achieving accurate fault location.

[0111] In one embodiment of the present invention, the abnormal indicators include: the slow query frequency of the target database instance, the indicators to be analyzed include: the performance indicators of the target database instance, and the abnormal point is the point where the slow query frequency exceeds the frequency threshold; the cause of failure of the abnormal indicators is determined according to the similarity corresponding to each second time series curve, including: determining whether there is a second time series curve with a similarity greater than the similarity threshold; in response to the absence of a second time series curve with a similarity greater than the similarity threshold, determining that the cause of failure of the slow query frequency abnormality is a query statement problem; in response to the presence of a second time series curve with a similarity greater than the similarity threshold, determining that the cause of failure of the slow query frequency abnormality is a database instance performance failure.

[0112] Slow queries are used to identify SQL statements in the database that take longer than a specified threshold (e.g., 100ms). Slow queries indirectly reflect database performance issues. However, simply identifying slow SQL queries cannot accurately pinpoint whether the problem lies in database performance or the SQL statement itself. Some business operations are highly sensitive to latency. Even if some SQL statements do not meet the slow query criteria, the business may still perceive significant anomalies. Therefore, it is necessary to analyze all SQL statements executed on the database instance to understand which SQL statements are currently being executed and their performance. This information provides a comprehensive understanding of the health of the business's SQL statements, such as identifying SQL statements with high execution time but low efficiency, SQL statements with significant performance fluctuations, and newly added SQL statements.

[0113] The solution of this invention is applied to database anomaly diagnosis. Anomalies in the database system are uncovered through correlation analysis of the quantified slow query frequency change curve and multiple performance indicators of the instance. When the system detects a sudden increase in the number of slow queries for a database instance, the performance monitoring indicators of that database instance are observed to be abnormal within the same time period. Specifically, this includes the following steps:

[0114] Step S11: The system monitors the number of slow queries for each instance and calculates the number of slow queries occurring within a preset time period (e.g., every 30 seconds, every minute, every 5 minutes, etc.) to obtain the slow query frequency. This slow query frequency is used as an anomaly indicator. The slow query frequency is then standardized and normalized to create a first time-series curve.

[0115] When the frequency of slow queries for a certain instance suddenly increases, historical data of the instance's performance metrics (CPU, IO, LOAD, disk throughput, active connections, database query efficiency (slow SQL), network traffic, database concurrency, etc.) are obtained to generate multiple second time-series curves.

[0116] Step S12: Calculate the similarity between the first time series curve and the second time series curve. If the similarity is high, the slow query is most likely caused by an anomaly in the basic resource layer; conversely, if the similarity is low and the basic resource layer meets the high availability conditions, the cause may be a problem with the SQL statement itself rather than a system anomaly.

[0117] Using the methods described above, the system can diagnose whether slow queries are related to the instance's performance metrics. This allows it to determine whether the slow query is due to a performance issue with the database instance or a problem with the SQL statement itself, thus achieving precise fault location.

[0118] For example, regarding the issue of abnormal slow query frequency, if there is no first implementation curve corresponding to the slow query frequency, but a second implementation curve with high similarity, the cause of the abnormal slow query frequency is determined to be a problem with the query statement. The fault can be eliminated by optimizing the query statement, such as modifying or rewriting the query statement.

[0119] If a second implementation curve with high similarity exists, the abnormal slow query frequency is determined to be due to a database instance performance issue. Troubleshooting can be approached by optimizing database performance, such as increasing disk throughput, increasing caching, and optimizing indexes.

[0120] The solution of this invention is applied to database operation and maintenance scenarios. It converts the frequency of slow queries into a performance indicator that reflects the business. By comparing the similarity of the fluctuation shape of the performance indicators of the instances, it can diagnose whether there is a relationship between slow queries and the performance indicators of the instances themselves. This allows it to determine whether the slow query problem is due to the performance of the database instance or the SQL statement itself, thereby achieving accurate fault location.

[0121] Figure 5 This is a schematic diagram of a device for determining the cause of an indicator failure, provided in an embodiment of the present invention. Figure 5 As shown, the device includes:

[0122] The first acquisition module 501 is used to acquire the first time-series curve of the abnormal indicator in a first time period, wherein the first time-series curve contains the abnormal points of the abnormal indicator.

[0123] The second acquisition module 502 is used to acquire the second time-series curves of multiple indicators to be analyzed in a second time period, the second time period corresponding to the first time period.

[0124] Calculation module 503 is used to calculate the similarity between the first time series curve and each of the second time series curves;

[0125] The cause determination module 504 is used to determine the cause of failure of the abnormal index based on the similarity of each of the second time series curves.

[0126] Optionally, the first acquisition module 501 is specifically used for:

[0127] Obtain historical data for the aforementioned abnormal indicators;

[0128] Based on the historical data of the abnormal indicators, a time-series curve of the abnormal indicators is generated;

[0129] Detect the target time point when the abnormal indicator shows an abnormal value, and determine the first time period that includes the target time point;

[0130] The first time series curve is generated by extracting the time series curve corresponding to the first time period from the time series curve of the abnormal indicator.

[0131] Optionally, the second acquisition module 502 is specifically used for:

[0132] Obtain historical data for the indicator to be analyzed;

[0133] Based on the historical data of the indicator to be analyzed, a time series curve of the indicator to be analyzed is generated;

[0134] Determine the second time period corresponding to the first time period;

[0135] From the time series curve of the indicator to be analyzed, extract the time series curve corresponding to the second time period to generate the second time series curve.

[0136] Optionally, the calculation module 503 is specifically used for:

[0137] Preprocessing is performed on the first timing curve and the second timing curve respectively;

[0138] Calculate the shape distance between the preprocessed first time series curve and each preprocessed second time series curve;

[0139] The shape distances corresponding to each of the second time series curves are normalized to obtain the similarity of each of the second time series curves.

[0140] Optionally, the cause determination module 504 is specifically used for:

[0141] Determine whether a second time-series curve with a similarity greater than a similarity threshold exists;

[0142] In response to the existence of a second time series curve with a similarity greater than a similarity threshold, the index to be analyzed corresponding to the second time series curve with a similarity greater than a similarity threshold is determined as the associated index corresponding to the abnormal index.

[0143] Determine whether the associated indicator shows any outliers during the second time period;

[0144] In response to the occurrence of an abnormal value in the associated indicator during the second time period, the cause of the failure of the abnormal indicator is determined to be the abnormality of the associated indicator.

[0145] Optionally, the abnormal indicators include: application indicators of the target application, and the indicators to be analyzed include: performance indicators of the target host, wherein the target application is deployed on the target host.

[0146] Optionally, the abnormal indicators include: the slow query frequency of the target database instance, the indicators to be analyzed include: the performance indicators of the target database instance, and the abnormal point is the point where the slow query frequency exceeds the frequency threshold;

[0147] The cause determination module 504 is specifically used for:

[0148] Determine whether a second time-series curve with a similarity greater than a similarity threshold exists;

[0149] Since there is no second time-series curve with a similarity greater than the similarity threshold, the cause of the abnormal slow query frequency is determined to be a problem with the query statement.

[0150] In response to the existence of a second time-series curve with a similarity greater than the similarity threshold, the cause of the abnormal slow query frequency was determined to be a database instance performance failure.

[0151] This invention provides an electronic device, comprising:

[0152] One or more processors;

[0153] Storage device for storing one or more programs.

[0154] When one or more programs are executed by one or more processors, the one or more processors implement the methods of any of the above embodiments.

[0155] The following is for reference. Figure 6 It shows a schematic diagram of the structure of a computer system 600 suitable for implementing a terminal device of the present invention. Figure 6 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0156] like Figure 6As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 602 or programs loaded from storage section 608 into random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the system 600. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0157] The following components are connected to I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 610 as needed so that computer programs read from it can be installed into storage section 608 as needed.

[0158] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by central processing unit (CPU) 601, it performs the functions defined above in the system of this invention.

[0159] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0160] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0161] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be housed in a processor, and for example, can be described as: a first acquisition module, a second acquisition module, a calculation module, and a cause determination module. The names of these modules do not necessarily limit the module itself; for example, the first acquisition module can also be described as "a module that acquires the first time-series curve of an abnormal indicator in a first time period".

[0162] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include:

[0163] Obtain the first time-series curve of the abnormal indicator in the first time period, and the first time-series curve contains the abnormal points of the abnormal indicator.

[0164] Obtain the second time-series curves of multiple indicators to be analyzed in the second time period, which corresponds to the first time period.

[0165] Calculate the similarity between the first time series curve and each of the second time series curves;

[0166] The cause of failure of the abnormal index is determined based on the similarity of each of the second time series curves.

[0167] According to the technical solution of this invention, a first time-series curve corresponding to the abnormal indicator and a second time-series curve corresponding to each indicator to be analyzed are obtained. The correlation between the abnormal indicator and each indicator to be analyzed is determined by calculating the similarity between the first and second time-series curves. Utilizing the correlation between indicators, the cause of indicator failure can be quickly and accurately determined, reducing the difficulty of troubleshooting abnormal indicator failures.

[0168] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for determining the cause of an indicator failure, characterized in that, include: Obtain the first time-series curve of the abnormal indicator in the first time period, and the first time-series curve contains the abnormal points of the abnormal indicator. Obtain the second time-series curves of multiple indicators to be analyzed in the second time period, which corresponds to the first time period. Calculate the similarity between the first time series curve and each of the second time series curves; The cause of failure of the abnormal index is determined based on the similarity of each of the second time series curves. The abnormal indicators include: the slow query frequency of the target database instance; the indicators to be analyzed include: the performance indicators of the target database instance, including: CPU, IO, LOAD, disk throughput, active connections, database query efficiency, network traffic and database concurrency; the abnormal point is the point where the slow query frequency exceeds the frequency threshold. The number of slow queries occurring within a preset time period is calculated to obtain the slow query frequency; the slow query frequency is then standardized and normalized to form a model, resulting in the first time series curve. The step of determining the cause of failure of the abnormal index based on the similarity of each of the second time-series curves includes: Determine whether a second time-series curve with a similarity greater than a similarity threshold exists; In response to the absence of a second time-series curve with a similarity greater than the similarity threshold, the cause of the abnormal slow query frequency was determined to be a problem with the query statement. In response to the existence of a second time-series curve with a similarity greater than the similarity threshold, the cause of the abnormal slow query frequency was determined to be a database instance performance failure.

2. The method according to claim 1, characterized in that, The acquisition of the first time-series curve of the abnormal indicator in the first time period includes: Obtain historical data for the aforementioned abnormal indicators; Based on the historical data of the abnormal indicators, a time-series curve of the abnormal indicators is generated; Detect the target time point when the abnormal indicator shows an abnormal value, and determine the first time period that includes the target time point; The first time series curve is generated by extracting the time series curve corresponding to the first time period from the time series curve of the abnormal indicator.

3. The method according to claim 1, characterized in that, The acquisition of the second time-series curves of multiple indicators to be analyzed in the second time period includes: Obtain historical data for the indicator to be analyzed; Based on the historical data of the indicator to be analyzed, a time series curve of the indicator to be analyzed is generated; Determine the second time period corresponding to the first time period; From the time series curve of the indicator to be analyzed, extract the time series curve corresponding to the second time period to generate the second time series curve.

4. The method according to claim 1, characterized in that, The calculation of the similarity between the first time series curve and each of the second time series curves includes: Preprocessing is performed on the first timing curve and the second timing curve respectively; Calculate the shape distance between the preprocessed first time series curve and each preprocessed second time series curve; The shape distances corresponding to each of the second time series curves are normalized to obtain the similarity of each of the second time series curves.

5. A device for determining the cause of an indicator failure, characterized in that, include: The first acquisition module is used to acquire the first time-series curve of the abnormal indicator in a first time period, wherein the first time-series curve contains the abnormal points of the abnormal indicator. The second acquisition module is used to acquire the second time-series curves of multiple indicators to be analyzed in a second time period, the second time period corresponding to the first time period. The calculation module is used to calculate the similarity between the first time series curve and each of the second time series curves; The cause determination module is used to determine the cause of failure of the abnormal index based on the similarity of each of the second time series curves. The abnormal indicators include: the slow query frequency of the target database instance; the indicators to be analyzed include: the performance indicators of the target database instance, including: CPU, IO, LOAD, disk throughput, active connections, database query efficiency, network traffic and database concurrency; the abnormal point is the point where the slow query frequency exceeds the frequency threshold. The number of slow queries occurring within a preset time period is calculated to obtain the slow query frequency; the slow query frequency is then standardized and normalized to form a model, resulting in the first time series curve. The cause determination module is specifically used for: Determine whether a second time-series curve with a similarity greater than a similarity threshold exists; In response to the absence of a second time-series curve with a similarity greater than the similarity threshold, the cause of the abnormal slow query frequency was determined to be a problem with the query statement. In response to the existence of a second time-series curve with a similarity greater than the similarity threshold, the cause of the abnormal slow query frequency was determined to be a database instance performance failure.

6. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-4.

7. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-4.

Images