Container abnormality detection method, device, computer storage medium, and electronic device

Abstract

The application discloses an abnormality detection method and device of a container, a computer storage medium and an electronic device. It relates to the field of financial technology. The method comprises the following steps: judging the container state according to the abnormal container and the log of the abnormal container, and obtaining a judgment result; in the case that the container has log output and the container state of the container is abnormal, or the container has no log output, analyzing the logical container of the container corresponding to the judgment result, and obtaining a first analysis result; in the case that the container has log output and the container state of the container is normal, analyzing the log of the container corresponding to the judgment result, and obtaining a second analysis result; if there is a container abnormality reason in the first analysis result or the second analysis result, the container abnormality reason is extracted; and if there is no container abnormality reason, the performance of the container is analyzed to obtain the container abnormality reason. Through the application, the problem that it is difficult to quickly locate and detect abnormal containers in the related art is solved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and more specifically, to a method, apparatus, computer storage medium, and electronic device for detecting anomalies in containers. Background Technology

[0002] With the rapid development of cloud computing, more and more enterprises are accessing PaaS platforms and using container technology within these platforms to achieve digital transformation and upgrades, enabling servers to be developed and upgraded independently, and achieving faster deployment and migration.

[0003] For containers, a stable operating environment is crucial. For example, when a container's engine encounters an inconsistent underlying environment, it may malfunction, thus reducing the container's service capabilities. Conversely, if no resource limits are set for the service, and the application happens to be running in a resource-constrained container, resource over-allocation may occur, leading to service interruptions. Therefore, ensuring the stable operation of containers is a pressing issue that needs to be addressed.

[0004] In related technologies, the monitoring and analysis of containers still rely on manual operation, that is, by downloading the container process logs and manually confirming whether the container has started successfully. However, when there are too many containers, the confirmation process becomes time-consuming and labor-intensive. In particular, when a container fails, the development and operation personnel cannot locate the faulty container in time, analyze the cause of the failure and deal with the problem in a timely manner, resulting in huge economic losses.

[0005] There is currently no effective solution to the problem of quickly locating and detecting abnormal containers in related technologies. Summary of the Invention

[0006] This application provides a method, apparatus, computer storage medium, and electronic device for detecting abnormal containers, in order to solve the problem of difficulty in quickly locating, detecting, and handling abnormal containers in related technologies.

[0007] According to one aspect of this application, an anomaly detection method for containers is provided. The method includes: acquiring the container that is experiencing an anomaly and its logs; determining the container's state based on the container and the logs to obtain a determination result; if the determination result indicates that the container has log output and its container state is abnormal, or if the determination result indicates that the container has no log output, analyzing the logical container of the container corresponding to the determination result to obtain a first analysis result; if the determination result indicates that the container has log output and its container state is normal, analyzing the logs of the container corresponding to the determination result to obtain a second analysis result; if the first or second analysis result contains a cause for the container's anomaly, extracting the cause of the container's anomaly; if the first or second analysis result does not contain a cause for the container's anomaly, performing performance analysis on the container to obtain the cause of the container's anomaly.

[0008] Optionally, obtaining the abnormal container and its logs includes: when a platform alarm is detected, obtaining the container name in the alarm information, identifying the container indicated by the container name as the abnormal container, and downloading the logs associated with the container name to obtain the abnormal container's logs, wherein the platform is used to run the container; when the service's transaction success rate is lower than the success rate threshold or the service's transaction volume is lower than the transaction volume threshold, identifying the container where the service's connected interface is located, obtaining the abnormal container, and downloading the logs of the container where the service's connected interface is located to obtain the abnormal container's logs.

[0009] Optionally, the root container and the logs are used to determine the container status, and the determination results include: determining whether the number of containers and the number of logs are the same; if the number of containers and the number of logs are different, detecting whether the container has log output; if the container has no log output, obtaining a first determination result; if the container has log output, determining whether the container status of the container is abnormal, and obtaining a second determination result.

[0010] Optionally, when the container has log output, it is determined whether the container state is abnormal, and the second determination result includes: when the container state is abnormal and the container restarts, the container state is determined to be abnormal; when the container state is normal and there is no restart, the container state is determined to be normal.

[0011] Optionally, if the judgment result indicates that the container has log output and the container status is normal, the logs of the container corresponding to the judgment result are analyzed to obtain the second analysis result, including: obtaining the log type of the log, obtaining the startup judgment rule associated with the log type, judging whether the startup status of the container is normal through the startup judgment rule, and obtaining the first analysis result; and / or judging whether the log contains runtime error keywords, and determining whether the running status of the container is normal based on the judgment result, and obtaining the first analysis result.

[0012] Optionally, determining whether the container's startup status is normal based on startup judgment rules includes: checking whether the log contains startup error keywords; if the log contains startup error keywords, the container's startup status does not meet the first rule; if the log does not contain startup error keywords, the container's startup status meets the first rule; checking whether the container's system has been initialized; if the system has not been initialized, the container's startup status does not meet the second rule; if the system has been initialized, the container's startup status meets the second rule; checking whether the container's system has been successfully initialized and whether the functional components have been successfully updated; if the system has not been successfully initialized or the functional components have not been successfully updated, the container's startup status does not meet the third rule; if the system has been successfully initialized and the functional components have been successfully updated, the container's startup status meets the third rule; if the container's startup status meets the first, second, and third rules simultaneously, the container's startup status is normal; if the container's startup status does not meet at least one of the first, second, and third rules, the container's startup status is abnormal.

[0013] Optionally, the performance analysis of the container can be performed to determine the cause of the container exception, including: determining whether the container memory is abnormal, and if the container memory is abnormal, determining that the cause of the container exception is a memory exception; determining whether the controller thread of the container is abnormal, and if the controller thread is abnormal, determining that the cause of the container exception is a controller exception.

[0014] According to another aspect of this application, an anomaly detection device for containers is provided. The device includes: an acquisition unit, configured to acquire an abnormal container and its logs, and to determine the container's state based on the container and the logs to obtain a determination result; a first analysis unit, configured to analyze the logical container of the container corresponding to the determination result to obtain a first analysis result when the determination result indicates that the container has log output and its container state is abnormal, or when the determination result indicates that the container has no log output; a second analysis unit, configured to analyze the logs of the container corresponding to the determination result to obtain a second analysis result when the determination result indicates that the container has log output and its container state is normal; an extraction unit, configured to extract the cause of the container anomaly if the first or second analysis result contains a cause for the container anomaly; and a third analysis unit, configured to perform performance analysis on the container to obtain the cause of the container anomaly if the first or second analysis result does not contain a cause for the container anomaly.

[0015] According to another aspect of the present invention, a computer storage medium is also provided for storing a program, wherein the program, when running, controls the device where the non-volatile storage medium is located to execute a container anomaly detection method.

[0016] According to another aspect of the present invention, an electronic device is also provided, comprising a processor and a memory; the memory stores computer-readable instructions, and the processor is configured to execute the computer-readable instructions, wherein the computer-readable instructions, when executed, perform an anomaly detection method for a container.

[0017] This application employs the following steps: acquiring the abnormal container and its logs, and determining the container's status based on the container and logs to obtain a judgment result; if the judgment result indicates that the container has log output and its container status is abnormal, or if the judgment result indicates that the container has no log output, analyzing the logical container corresponding to the judgment result to obtain a first analysis result; if the judgment result indicates that the container has log output and its container status is normal, analyzing the logs of the container corresponding to the judgment result to obtain a second analysis result; if the first or second analysis result contains a cause for the container's abnormality, extracting the cause of the container's abnormality; if the first or second analysis result does not contain a cause for the container's abnormality, performing performance analysis on the container to obtain the cause of the container's abnormality. This solves the problem of difficulty in quickly locating and detecting abnormal containers in related technologies. By acquiring abnormal containers through a monitoring system and analyzing and processing the abnormal containers and their logs, the application achieves the effect of quickly locating problematic containers, finding the cause of the abnormality, and providing solutions. Attached Figure Description

[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a flowchart of an anomaly detection method for containers provided according to an embodiment of this application;

[0020] Figure 2 This is a flowchart for determining the container state according to an embodiment of this application;

[0021] Figure 3 This is a flowchart of an optional container anomaly detection method provided according to an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of an anomaly detection device for a container provided according to an embodiment of this application. Detailed Implementation

[0023] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties.

[0027] According to an embodiment of this application, an anomaly detection method for a container is provided.

[0028] Figure 1 This is a flowchart of an anomaly detection method for containers according to an embodiment of this application. Figure 1 As shown, the method includes the following steps:

[0029] Step S101: Obtain the container that encountered the error and its logs, and determine the container status based on the container and the logs to obtain the determination result.

[0030] Specifically, a container is an operating system-level, lightweight virtualization technology that encapsulates the necessary details and complete runtime environment for running an application. For example, it includes all the libraries, other binary files, configuration files, application dependencies, and the operating system required by the application. It is characterized by standardization, security, and lightweightness.

[0031] When a container malfunctions, if the indicator light does not turn green, the platform issues an alarm. Based on the container name mentioned in the alarm message, the platform retrieves the container and downloads its corresponding logs. It can also identify the malfunctioning container based on the execution status of the transaction service and download its logs. Since the logs are stored in a compressed file, a script is needed to decompress the file. The downloaded logs are primarily of three types: commonLog.log, ctp4.log, and message.log.

[0032] Specifically, the script compares the number of downloaded containers with the number of logs obtained. If the two are inconsistent, it checks whether the abnormal container has log output. The container status can include whether there is a restart or a hibernation. The restart can be a single restart or continuous restarts.

[0033] Step S102: If the judgment result indicates that the container has log output and the container status is abnormal, or if the judgment result indicates that the container has no log output, analyze the logical container of the container corresponding to the judgment result to obtain the first analysis result.

[0034] Specifically, if an abnormal container has no log output, it is necessary to analyze the error information and event information of the logical container status to obtain the first analysis result, and then determine the cause of the container abnormality. The logical container, also known as a pod, is the smallest scheduling unit in the container coding platform. One pod encapsulates one container.

[0035] The first analysis result may include logical container status errors and repeated container restarts, container startup errors, and container name errors.

[0036] Specifically, logical container status errors and repeated container restarts can include no log output and no errors but the container keeps restarting, requiring checking the values ​​in the application startup file configuration and increasing resource allocation to resolve the anomaly; it can also include containers constantly restarting but with no log errors, requiring modification of template information and adjustment of the external port number; it can also include incorrect health check configuration, requiring adjustment of the program's health check strategy; and it can also include event log errors, requiring changing to a tag with sufficient resources and reducing the image's hardware and software limitations. Container startup errors can include template tag mismatch, requiring setting the tag in the tag configuration; it can also include insufficient resources on the machine, requiring checking the host machine's usage; and it can also include port congestion and unreasonable resource allocation configuration. When the container name is incorrect, it is necessary to confirm whether the values ​​of the layered parameters or environment variables in this section can be retrieved.

[0037] Step S103: If the judgment result indicates that the container has log output and the container status is normal, analyze the log of the container corresponding to the judgment result to obtain the second analysis result.

[0038] Specifically, when it is determined that the container is outputting logs and its status is normal, further analysis of the container's logs is needed, namely, analyzing the container's running and startup status. The second analysis result can include the findings from the analysis of the container's running and startup status.

[0039] The analysis of container runtime status involves using regular expressions to filter common runtime error keywords from the acquired logs. If the abnormal container is an alarm container detected by the monitoring system, the logs are downloaded and filtered for common runtime error keywords to investigate the cause of the alarm. If the abnormal container is a template container where the monitoring system detects transaction anomalies, the analysis of the container's runtime status requires using regular expressions to match the corresponding service connection interfaces, examine the interface call behavior, and then determine the cause of the anomaly.

[0040] Step S104: If there is a container abnormality cause in the first analysis result or the second analysis result, extract the container abnormality cause.

[0041] Specifically, if the cause of the abnormal container is found by analyzing the logical containers within the container, and the cause of the abnormality is found by analyzing the running and startup status of the container, then it can be concluded that there is a problem with the container.

[0042] Step S105: If there is no cause for container abnormality in the first analysis result or the second analysis result, then perform performance analysis on the container to obtain the cause of container abnormality.

[0043] Specifically, if analyzing the logical containers within a container or analyzing the container's running and startup status yields no results, further analysis of the container's hardware is needed, such as checking the container's CPU and memory, i.e., performance analysis. If the cause cannot be found in the container hardware either, further manual inspection is required.

[0044] The container anomaly detection method provided in this application embodiment acquires the abnormal container and its logs, and performs a container status judgment based on the container and logs to obtain a judgment result. If the judgment result indicates that the container has log output and its container status is abnormal, or if the judgment result indicates that the container has no log output, the logical container corresponding to the judgment result is analyzed to obtain a first analysis result. If the judgment result indicates that the container has log output and its container status is normal, the logs of the container corresponding to the judgment result are analyzed to obtain a second analysis result. If the first or second analysis result contains a cause for the container anomaly, the cause is extracted. If the first or second analysis result does not contain a cause for the container anomaly, performance analysis is performed on the container to obtain the cause of the container anomaly. This method solves the problem of difficulty in quickly locating and detecting abnormal containers in related technologies. By acquiring abnormal containers through a monitoring system and analyzing and processing the abnormal containers and their logs, it achieves the effect of quickly locating problematic containers, finding the cause of the anomaly, and providing a solution.

[0045] There are multiple ways to obtain abnormal containers on the platform. Optionally, in the container anomaly detection method provided in this application embodiment, obtaining abnormal containers and their logs includes: when a platform alarm is detected, obtaining the container name in the alarm information, identifying the container indicated by the container name as the abnormal container, and downloading the log associated with the container name to obtain the log of the abnormal container, wherein the platform is used to run the container; when the transaction success rate of the service is detected to be lower than the success rate threshold or the transaction volume of the service is lower than the transaction volume threshold, identifying the container where the service connection interface is located, obtaining the abnormal container, and downloading the log of the container where the service connection interface is located to obtain the log of the abnormal container.

[0046] In one optional embodiment, during routine operations, a scheduled task is set up to download the logs corresponding to all containers on the platform periodically using a script, while a monitoring system monitors the container status on the platform in real time. When a container experiences an anomaly within the interval of the full log download, the platform issues an alarm. Based on the container name mentioned in the alarm information, the platform retrieves the container and downloads its corresponding logs.

[0047] In another optional embodiment, when the monitoring system detects that the transaction success rate is lower than a preset threshold or the service transaction volume is lower than a preset threshold, it determines the template container where the service connection interface is located and downloads the logs corresponding to the template container. Since the logs are stored in a compressed package, a script is needed to decompress the compressed package. The downloaded logs are mainly of three types: commonLog.log, ctp4.log, and message.log.

[0048] Before analyzing the cause of an anomaly in an abnormal container, the container can be classified according to whether there is log output. Optionally, in the container anomaly detection method provided in this application embodiment, the container status is judged based on the container and the log, and the judgment result includes: judging whether the number of obtained containers and the number of logs are the same; when the number of containers and the number of logs are different, detecting whether the container has log output; when the container has no log output, obtaining a first judgment result; when the container has log output, judging whether the container status of the container is abnormal, obtaining a second judgment result.

[0049] Specifically, the first judgment result can be the abnormal reason of the container when there is no log output, which may include: the resource request limit is too low, etc.; the second judgment result can be the container outputting logs and the container status is normal, and the container outputting logs but the container status is abnormal. The container status may include whether there is a restart phenomenon, whether there is a hibernation phenomenon, etc.

[0050] When there is no log output, or when there is log output but the container status is abnormal, the logical container of the abnormal container is analyzed. This analysis of the logical container can include error analysis of logical container event information and logical container status information. Logical container event information can include container operation phenomena and management; logical container status can include waiting, running, and normal termination states.

[0051] Before analyzing the cause of an anomaly in an abnormal container, it is necessary to determine whether the container status is normal. Optionally, in the container anomaly detection method provided in this application embodiment, when the container has log output, it is determined whether the container status is abnormal, and the second determination result includes: when the container status is abnormal and the container restarts, it is determined that the container status is abnormal; when the container status is normal and there is no restart, it is determined that the container status is normal.

[0052] Specifically, abnormal container status can include container restarts or container hibernation; normal container status means there are no restarts and the container is running normally. Container restarts can include a single restart or a rolling restart, where a rolling restart occurs continuously during an upgrade.

[0053] A container may have log output and appear to be in a normal state, but an exception may occur, including container startup exceptions and runtime exceptions. Figure 2 This is a flowchart for determining the container state according to an embodiment of this application, such as... Figure 2 As shown, optionally, in the container anomaly detection method provided in this application embodiment, when the judgment result indicates that the container has log output and the container status is normal, the log of the container corresponding to the judgment result is analyzed to obtain a second analysis result, including:

[0054] Step S1031: Obtain the log type and the startup judgment rule associated with the log type; determine whether the container's startup status is normal based on the startup judgment rule, and obtain the first analysis result; and / or

[0055] Step S1032: Determine whether the log contains runtime error keywords, and determine whether the container's running status is normal based on the determination result, thus obtaining the first analysis result.

[0056] Specifically, when the container is in a normal state and has log output, it is necessary to perform startup and runtime checks on the container. Since there are three types of logs, it is necessary to apply rule-based checks to these three types of logs. Each of the three log types corresponds to a different rule. When all three rules are met, it indicates that the abnormal container's startup state is normal. The runtime state of the abnormal container is then determined by filtering the acquired logs for runtime error keywords. This leads to the first analysis result, which can include whether the abnormal container's startup and runtime states are normal.

[0057] The startup judgment rules can include multiple rules. Optionally, in the container anomaly detection method provided in this application embodiment, judging whether the startup status of the container is normal by the startup judgment rules includes: judging whether the log contains startup error keywords; if the log contains startup error keywords, it is determined that the startup status of the container does not meet the first rule; if the log does not contain startup error keywords, it is determined that the startup status of the container meets the first rule; judging whether the container's system has been initialized; if the system has not been initialized, it is determined that the startup status of the container does not meet the second rule; if the system has been initialized, it is determined that the startup status of the container meets the second rule; judging whether the container's system has been successfully initialized and the functional components have been successfully updated; if the system has not been successfully initialized or the functional components have not been successfully updated, it is determined that the startup status of the container does not meet the third rule; if the system has been successfully initialized and the functional components have been successfully updated, it is determined that the startup status of the container meets the third rule; if the startup status of the container meets the first rule, the second rule, and the third rule simultaneously, it is determined that the startup status of the container is normal; if the startup status of the container does not meet at least one of the first rule, the second rule, and the third rule, it is determined that the startup status of the container is abnormal.

[0058] Specifically, for containers that have log output and are in normal status without restarting, if it is after a container rolling upgrade or rolling restart, it is necessary to determine whether the container has started normally. There are three main types of logs obtained: commonLog.log, ctp4.log, and message.log. Rules need to be applied to each of the three types of logs.

[0059] Specifically, for logs of type commonLog.log, regular expressions are used to filter for startup error keywords, and to check for error messages before and after the keywords. Startup error keywords can include words with error meanings such as "failed" and "false." For logs of type ctp4.log, regular expressions are used to check if the container's message system has been initialized successfully. For logs of type message.log, regular expressions are used to determine if the container system has been successfully initialized and if functional components have been successfully updated. If the container's startup state meets the first, second, and third rules simultaneously, the container's startup state is considered normal, and further analysis of the possible causes of the anomaly is needed, i.e., performance analysis. Conversely, if one or more rules fail, it indicates an anomaly in the container's startup state, meaning the anomaly is due to an error in the container's startup state. Regular expressions refer to text patterns that use a single string to describe and match a series of strings that match a certain syntax rule, and are typically used to search for and replace text that conforms to a specific rule.

[0060] When logical container analysis and log analysis cannot determine the cause, performance analysis is performed on the container. Optionally, in the container anomaly detection method provided in this application embodiment, performance analysis of the container to obtain the cause of the container anomaly includes: determining whether the container memory is abnormal, and if the container memory is abnormal, determining that the cause of the container anomaly is a memory anomaly; determining whether the controller thread of the container is abnormal, and if the controller thread is abnormal, determining that the cause of the container anomaly is a controller anomaly.

[0061] Specifically, if the cause of the anomaly cannot be located after analyzing the logical containers inside the container and the container logs, performance analysis is required. Performance analysis can include analysis of the CPU, memory, disk I / O, network, controller threads, etc., and can be performed using benchmark testing, load testing, and testing tools such as sysbench.

[0062] Benchmarking refers to quantitatively and comparatively testing a specific performance indicator of a particular target scenario by designing reasonable test methods, selecting appropriate test tools and the system under test. Load testing refers to determining the amount of load that can be handled while meeting performance indicators by continuously increasing the load. If an anomaly is detected in the container's memory, that is, if the container's storage is abnormal, the cause of the abnormal container can be determined to be a memory anomaly; if an anomaly is detected in the container's threads, the cause of the container's anomaly is a thread anomaly.

[0063] It should be noted that if the cause of the anomaly is not detected after the performance analysis of the container, the container name, container logs, related performance information, etc., of the container with the anomaly need to be packaged and analyzed manually.

[0064] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0065] Figure 3 This is a flowchart of an optional container anomaly detection method provided according to an embodiment of this application. Figure 3 As shown, the method includes:

[0066] The system categorizes all container logs on the platform obtained through scheduled scripts during daily operations. When the monitoring system detects container alarms or service transaction volume or transaction success rate below a preset threshold, the system downloads and categorizes the logs of the corresponding container based on the alarm information. The logs are divided into three types: commonLog.log, ctp4.log, and message.log. The number of logs obtained is compared with the number of containers with abnormalities to check whether the numbers correspond.

[0067] When the quantities are inconsistent, determine whether there is log output. For abnormal containers without log output, analyze the error messages in the logical container event information and logical container status information. For abnormal containers with log output, it is necessary to determine whether the container status and restart count are normal. For containers with abnormal container status and restart count, the same analysis as for abnormal containers without log output is performed on the error messages in the logical container event information and logical container status information.

[0068] For containers with normal status and restart counts, container startup and operation analysis is required. This involves using three types of logs, each corresponding to a specific startup rule: commonLog.log corresponds to rule A, ctp4.log to rule B, and message.log to rule C. Rule A filters for keywords indicating errors, rule B determines if the information system has completed initialization, and rule C determines if the system has been initialized and the server is ready. If all three rules pass, the container startup is normal. If one or more rules fail, the container's abnormality indicates a startup error.

[0069] When judging the running status of a container, keywords are used to filter the logs of abnormal containers to determine the container's running status. For example, keywords such as "error," "false," and "failed" can be used. For template containers with abnormal service transaction volume and transaction success rate detected by the monitoring system, keyword filtering is required on the container logs corresponding to the service connection interface. If keywords indicating runtime errors can be found, it means that the container is abnormal due to runtime issues; otherwise, it means that the container is running normally.

[0070] If the analysis results from the logical container analysis, the startup analysis, and the runtime analysis of the container do not reveal the cause of the potential anomaly, then it is necessary to check whether there are any anomalies in the container's central processing unit (CPU), memory, threads, etc., i.e., performance analysis. If the performance analysis does not reveal the cause of the anomaly, then it is necessary to package the name, logs, and runtime status of the anomaly container and perform manual analysis.

[0071] This application also provides an anomaly detection device for containers. It should be noted that the anomaly detection device for containers in this application can be used to execute the anomaly detection method for containers provided in this application. The anomaly detection device for containers provided in this application will be described below.

[0072] Figure 4 This is a schematic diagram of an anomaly detection device for a container according to an embodiment of this application. Figure 4 As shown, the device includes: an acquisition unit 40, a first analysis unit 41, a second analysis unit 42, an extraction unit 43, and a third analysis unit 44.

[0073] The acquisition unit 40 is used to acquire the container that has encountered an error and its logs, and to determine the container status based on the container and the logs to obtain the determination result.

[0074] The first analysis unit 41 is used to analyze the logical container of the container corresponding to the judgment result when the judgment result indicates that the container has log output and the container status of the container is abnormal, or when the judgment result indicates that the container has no log output, to obtain the first analysis result.

[0075] The second analysis unit 42 is used to analyze the logs of the container corresponding to the judgment result when the judgment result indicates that the container has log output and the container status of the container is normal, and to obtain the second analysis result.

[0076] Extraction unit 43 is used to extract the cause of container abnormality if the first analysis result or the second analysis result contains the cause of container abnormality.

[0077] The third analysis unit 44 is used to perform performance analysis on the container and obtain the cause of the container abnormality if there is no cause of the container abnormality in the first analysis result or the second analysis result.

[0078] The container anomaly detection device provided in this application embodiment includes an acquisition unit 40 for acquiring the abnormal container and its logs, and determining the container status based on the container and logs to obtain a determination result; a first analysis unit 41 for analyzing the logical container corresponding to the determination result to obtain a first analysis result when the determination result indicates that the container has log output and the container status is abnormal, or when the determination result indicates that the container has no log output; a second analysis unit 42 for analyzing the logs of the container corresponding to the determination result to obtain a second analysis result when the determination result indicates that the container has log output and the container status is normal; an extraction unit 43 for extracting the container anomaly cause if the first or second analysis result contains a container anomaly cause; and a third analysis unit 44 for performing performance analysis on the container to obtain the container anomaly cause if the first or second analysis result does not contain a container anomaly cause. This solves the problem of difficulty in quickly locating and detecting abnormal containers in related technologies. By acquiring abnormal containers through a monitoring system and analyzing and processing the abnormal containers and logs, the device achieves the effect of quickly locating problematic containers, finding the anomaly cause, and providing solutions.

[0079] Optionally, in the container anomaly detection device provided in this application embodiment, the acquisition unit 40 includes: a first acquisition module, used to acquire the container name in the alarm information when a platform alarm is detected, determine the container indicated by the container name as the abnormal container, and download the log associated with the container name to obtain the log of the abnormal container, wherein the platform is used to run the container; and a first determination module, used to determine the container where the service connection interface is located when the service transaction success rate is lower than the success rate threshold or the service transaction volume is lower than the transaction volume threshold, obtain the abnormal container, and download the log of the container where the service connection interface is located to obtain the log of the abnormal container.

[0080] Optionally, the container anomaly detection device provided in this application embodiment includes an acquisition unit 40 comprising: a first judgment module, used to judge whether the number of acquired containers and the number of logs are the same; a detection module, used to detect whether the container has log output when the number of containers and the number of logs are different; a first acquisition module, used to obtain a first judgment result when the container has no log output; and a second acquisition module, used to judge whether the container state of the container is abnormal when the container has log output, and obtain a second judgment result.

[0081] Optionally, in the container anomaly detection device provided in this application embodiment, the acquisition unit 40 includes: a second determination module, used to determine that the container state is abnormal when the container is running abnormally and the container is restarting; and a third determination module, used to determine that the container state is normal when the container is running normally and there is no restarting phenomenon.

[0082] Optionally, in the container anomaly detection device provided in this application embodiment, the second analysis unit 42 includes: a second acquisition module, used to acquire the log type of the log and acquire the startup judgment rule associated with the log type, and determine whether the startup status of the container is normal through the startup judgment rule to obtain a first analysis result; and / or a second judgment module, used to determine whether the log contains running error keywords, and determine whether the running status of the container is normal based on the judgment result to obtain a first analysis result.

[0083] Optionally, in the container anomaly detection device provided in this application embodiment, the second analysis unit 42 includes: a third judgment module, used to judge whether the log contains a startup error keyword; if the log contains a startup error keyword, determine that the container's startup state does not conform to the first rule; if the log does not contain a startup error keyword, determine that the container's startup state conforms to the first rule; a fourth judgment module, used to judge whether the container's system has been initialized; if the system has not been initialized, determine that the container's startup state does not conform to the second rule; if the system has been initialized, determine that the container's startup state conforms to the second rule; a fifth judgment module, used to judge whether the container's system has been successfully initialized and whether the functional components have been successfully updated; if the system has not been successfully initialized or the functional components have not been successfully updated, determine that the container's startup state does not conform to the third rule; if the system has been successfully initialized and the functional components have been successfully updated, determine that the container's startup state conforms to the third rule; a fourth determination module, used to determine that the container's startup state is normal if the container's startup state conforms to the first rule, the second rule, and the third rule simultaneously; and a fifth determination module, used to determine that the container's startup state is abnormal if the container's startup state does not conform to at least one of the first rule, the second rule, and the third rule.

[0084] Optionally, in the container anomaly detection device provided in this application embodiment, the third analysis unit 44 includes: a first judgment module, used to judge whether the container memory is abnormal, and if the container memory is abnormal, to determine that the container anomaly is caused by memory anomaly; and a second judgment module, used to judge whether the controller thread of the container is abnormal, and if the controller thread is abnormal, to determine that the container anomaly is caused by controller anomaly.

[0085] The aforementioned container anomaly detection device includes a processor and a memory. The acquisition unit 40, the first analysis unit 41, the second analysis unit 42, the extraction unit 43, and the third analysis unit 44 are all stored as program units in the memory, and the processor executes the aforementioned program units stored in the memory to implement the corresponding functions.

[0086] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can address the difficulty in quickly locating, detecting, and handling abnormal containers in related technologies.

[0087] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0088] This application also provides a computer storage medium for storing a program, wherein the program, when running, controls the device where the non-volatile storage medium is located to execute a container anomaly detection method.

[0089] This application also provides an electronic device comprising a processor and a memory; the memory stores computer-readable instructions, and the processor executes the computer-readable instructions, wherein the computer-readable instructions, when executed, perform an anomaly detection method for a container. The electronic device described herein may be a server, PC, PAD, mobile phone, etc.

[0090] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0091] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0092] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0093] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0094] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0095] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0096] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0097] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0098] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for detecting anomalies in a container, characterized in that, include: Obtain the container that has encountered an error and its logs, and make a judgment based on the container status of the container and the logs to obtain a judgment result; If the judgment result indicates that the container has log output and the container status of the container is abnormal, or if the judgment result indicates that the container has no log output, the logical container of the container corresponding to the judgment result is analyzed to obtain the first analysis result. If the judgment result indicates that the container has log output and the container status of the container is normal, the log of the container corresponding to the judgment result is analyzed to obtain a second analysis result, including: obtaining the log type of the log and obtaining the startup judgment rule associated with the log type; The process involves several steps: First, determining whether the log contains startup error keywords. If the log contains startup error keywords, the container's startup state does not conform to the first rule. If the log does not contain startup error keywords, the container's startup state conforms to the first rule. Second, determining whether the container's system has been fully initialized. If the system has not been fully initialized, the container's startup state does not conform to the second rule. If the system has been fully initialized, the container's startup state conforms to the second rule. Third, determining whether the container's system has been successfully initialized and whether its functional components have been successfully updated. If the system has not been successfully initialized or the functional components have not been successfully updated, the container's startup state does not conform to the third rule. If the system has been successfully initialized and the functional components have been successfully updated, the container's startup state conforms to the third rule. If the container's startup state conforms to the first, second, and third rules simultaneously, the container's startup state is considered normal. If the container's startup state does not conform to at least one of the first, second, and third rules, the container's startup state is considered abnormal, thus obtaining the second analysis result. If the first or second analysis results contain a cause for container abnormality, extract the cause of container abnormality. If no cause for container anomaly is found in the first or second analysis results, then a performance analysis is performed on the container to determine the cause of the anomaly.

2. The method according to claim 1, characterized in that, Obtaining the container that experienced the anomaly and its logs includes: When a platform alarm is detected, the container name in the alarm information is obtained, the container indicated by the container name is identified as the abnormal container, and the log associated with the container name is downloaded to obtain the log of the abnormal container. The platform is used to run the container. When the transaction success rate of a service is found to be lower than the success rate threshold or the transaction volume of a service is lower than the transaction volume threshold, the container where the interface of the service connection is located is determined, the container where the anomaly occurred is obtained, and the logs of the container where the interface of the service connection is located are downloaded to obtain the logs of the container where the anomaly occurred.

3. The method according to claim 1, characterized in that, Based on the container status and the log, the judgment results include: Determine whether the number of containers obtained is the same as the number of logs; If the number of containers and the number of logs are different, check whether the containers have log output; If the container does not output any logs, the first judgment result is obtained; If the container has log output, determine whether the container state is abnormal to obtain a second judgment result.

4. The method according to claim 3, characterized in that, If the container outputs logs, determine whether the container's state is abnormal, and obtain a second determination result including: When the container is malfunctioning and restarting, the container is determined to be in an abnormal state. When the container is running normally and there is no restart phenomenon, the container is determined to be in a normal state.

5. The method according to claim 1, characterized in that, Performance analysis of the container revealed the following causes of container anomalies: Determine whether the container's memory is abnormal, and if the container's memory is abnormal, determine that the cause of the abnormality is a memory abnormality; Determine whether the controller thread of the container is abnormal, and if the controller thread is abnormal, determine that the container abnormality is caused by a controller abnormality.

6. An anomaly detection device for a container, characterized in that, include: The acquisition unit is used to acquire the container that has an anomaly and the log of the container that has an anomaly, and to make a judgment based on the container status of the container and the log to obtain a judgment result. The first analysis unit is used to analyze the logical container of the container corresponding to the judgment result when the judgment result indicates that the container has log output and the container status of the container is abnormal, or when the judgment result indicates that the container has no log output, to obtain a first analysis result. The second analysis unit is used to analyze the logs of the container corresponding to the judgment result when the judgment result indicates that the container has log output and the container status of the container is normal, and to obtain a second analysis result. The second analysis unit includes: a second acquisition module, used to acquire the log type of the log and acquire the startup judgment rule associated with the log type; a third judgment module, used to determine whether the log contains startup error keywords; if the log contains startup error keywords, determine that the startup state of the container does not conform to the first rule; if the log does not contain startup error keywords, determine that the startup state of the container conforms to the first rule; a fourth judgment module, used to determine whether the system of the container has been initialized; if the system has not been initialized, determine that the startup state of the container does not conform to the second rule; if the system has been initialized, determine that the startup state of the container conforms to the second rule; a fifth judgment module, used to determine... The system initialization of the container is successful and the functional components are successfully updated. If the system initialization is unsuccessful or the functional components are not successfully updated, the startup state of the container is determined to be inconsistent with the third rule. If the system initialization is successful and the functional components are successfully updated, the startup state of the container is determined to be consistent with the third rule. The fourth determining module is used to determine that the startup state of the container is normal if the startup state of the container simultaneously conforms to the first rule, the second rule, and the third rule. The fifth determining module is used to determine that the startup state of the container is abnormal if the startup state of the container does not conform to at least one of the first rule, the second rule, and the third rule, and obtain the second analysis result. An extraction unit is used to extract the cause of container abnormality if the first analysis result or the second analysis result contains a cause of container abnormality. The third analysis unit is used to perform performance analysis on the container and obtain the cause of the container abnormality if there is no cause for the container abnormality in the first analysis result or the second analysis result.

7. A computer storage medium, characterized in that, The computer storage medium is used to store a program, wherein the program, when running, controls the device where the computer storage medium is located to execute the anomaly detection method for the container as described in any one of claims 1 to 5.

8. An electronic device, characterized in that, The device includes a processor and a memory, the memory storing computer-readable instructions, and the processor executing the computer-readable instructions, wherein the computer-readable instructions, when executed, perform the anomaly detection method for the container according to any one of claims 1 to 5.

Images