Fault reconstruction methods, apparatus, electronic devices and storage media

Abstract

This embodiment discloses a fault reconstruction method, apparatus, device, system, and computer storage medium. The method includes: obtaining an original log set including logs from various servers; the logs of each server are used to represent event logs of various services within the corresponding server; the event logs are used to represent logs of fault occurrence events; determining the event set of each service from the logs of each server in the original log set; determining the chronological relationship between events in different services based on the time information of each event in the event set of each service; and reconstructing the fault information corresponding to the original log set according to the chronological relationship between events in different services.

Description

Technical Field

[0001] This application relates to distributed system technology, and more particularly to a fault reconstruction method, apparatus, electronic device, and computer storage medium. Background Technology

[0002] Currently, many network management systems based on wireless communication networks adopt a distributed architecture. Once a node in the network fails, the common method for locating the fault in a distributed system is to check the system logs. For a single machine or a single service, time-series problems are relatively easy to handle. However, in the field of big data distributed systems, fault diagnosis requires cross-machine and cross-service troubleshooting. The problem is that it is not possible to correctly identify the sequential relationships or dependencies between instances when the fault event occurs in different time-series spaces, thus making it impossible to accurately locate the root cause of the fault. Summary of the Invention

[0003] This application provides a technical solution for fault reconstruction, which can reconstruct fault information in a distributed system, thereby facilitating the accurate determination of the root cause of faults in the distributed system.

[0004] This application provides a fault reconstruction method, the method comprising:

[0005] Obtain a raw log set including logs from each server; the logs of each server are used to represent the event logs of each service in the corresponding server; the event logs are used to represent logs of fault occurrence events;

[0006] From the logs of each server in the original log set, determine the event set of each service in each service;

[0007] Based on the time information of each event in the event set of each service, the chronological relationship between events in different services is determined; and the fault information corresponding to the original log set is reconstructed according to the chronological relationship between events in different services.

[0008] In some embodiments, determining the event set for each service from the logs of each server in the original log set includes:

[0009] In the logs of each of the servers, determine the set of event logs for each service;

[0010] The physical location information of the server is removed from the event log set of each service to obtain the event set of each service.

[0011] In some embodiments, events in the event set of each service are represented by messages of a custom protocol; the message of the custom protocol includes at least a message header and a message body, the message header including a timestamp of the event and an identifier of the service to which the event occurred, and the message body representing the retrieved fault information.

[0012] In some embodiments, the message of the custom protocol may further include at least one of the following: the health of the operating system on which the event occurs, the resource utilization rate corresponding to the event, the status information of the device on which the event occurred, and the status information of the network on which the device on which the event occurred.

[0013] In some embodiments, before determining the chronological relationship between events in different services based on the time information of each event in the event set of each service, the method further includes:

[0014] Based on the offset between the device time of each event in the event set of each service and the standard time, the time of each event in the event set of each service is aligned along the dimension of the standard time to obtain the time information of each event in the event set of each service.

[0015] In some embodiments, determining the sequence of events between different services based on the time information of each event in the event set of each service includes:

[0016] When i is an integer greater than or equal to 1, for a target event in the event set of the i-th service, determine the event result set associated with the target event. The event result set associated with the target event includes an event set consisting of neighboring events of each other service except the i-th service. The neighboring events of the other services represent the events in the event set of the other services that are closest to the target event. The target event is any event in the event set of the i-th service.

[0017] Based on the event result set associated with each event in the event set of each service, the sequential relationship between events in different services is determined.

[0018] In some embodiments, the time distance between the neighboring events of the other services and the target event is within a set time range.

[0019] This application embodiment also provides a fault reconstruction apparatus, the apparatus comprising: an acquisition module, a first processing module, and a second processing module, wherein...

[0020] The acquisition module is used to acquire a raw log set including logs from various servers; the logs of each server are used to represent the event logs of each service in the corresponding server; the event logs are used to represent logs of fault occurrence events.

[0021] The first processing module is used to determine the event set of each service in the original log set from the logs of each server.

[0022] The second processing module is used to determine the chronological relationship between events in different services based on the time information of each event in the event set of each service; and to reconstruct the fault information corresponding to the original log set according to the chronological relationship between events in different services.

[0023] This application also provides an electronic device, including a processor and a memory for storing a computer program capable of running on the processor; wherein,

[0024] The processor is used to run the computer program to perform any of the above-described fault reconstruction methods.

[0025] This application also provides a computer storage medium storing a computer program that, when executed by a processor, implements any of the above-described fault reconstruction methods.

[0026] As can be seen, in this embodiment of the application, the event set of each service can be determined from the logs of each server in the original log set, thereby determining the event set of each service from a spatial dimension; and, based on the time information of each event in the event set of each service, the chronological relationship between events of different services can be determined, thus reconstructing the chronological relationship of each event from a time dimension; therefore, this embodiment of the application can accurately analyze the events of services of different servers from both time and space dimensions, thereby accurately locating the root cause of the fault. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating the fault reconstruction method according to an embodiment of this application;

[0028] Figure 2 This is a schematic diagram illustrating an application scenario of the fault reconstruction method according to an embodiment of this application;

[0029] Figure 3 This is a schematic diagram of the composition structure of the fault reconstruction device according to an embodiment of this application;

[0030] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0031] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments provided herein are merely illustrative of the present application and are not intended to limit the present application. Furthermore, the embodiments provided below are some embodiments for implementing the present application, and not all embodiments for implementing the present application. Unless otherwise specified, the technical solutions described in the embodiments of the present application can be implemented in any combination.

[0032] This application provides a fault reconstruction method that can be applied to electronic devices. The electronic devices may include terminals and / or servers. Here, the terminal may be a thin client, a thick client, a handheld or laptop device, a microprocessor-based system, a programmable consumer electronics product, a network PC, a minicomputer system, etc. The server may be a minicomputer system, a mainframe computer system, or a distributed cloud computing environment including any of the above systems, etc.

[0033] Servers and other electronic devices may include program modules that execute computer instructions. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks. Computer systems / servers can be implemented in a distributed cloud computing environment, where tasks are executed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules can reside on local or remote computing system storage media, including storage devices.

[0034] This application provides a fault reconstruction method that can be used to reconstruct and replay faults in a distributed system.

[0035] Figure 1 This is a flowchart illustrating the fault reconstruction method according to an embodiment of this application, as shown below. Figure 1 As shown, the process may include:

[0036] Step 101: Obtain the raw log set including logs from each server; the logs of each server are used to represent the event logs of each service on the corresponding server; the event logs are used to represent the logs of fault occurrence events.

[0037] In this embodiment of the application, the original log set can be denoted as S, and the event log of the i-th service on the j-th server in the original log set can be denoted as Si. ij , where i is an integer greater than or equal to 0, and j is an integer greater than or equal to 0.

[0038] Step 102: From the logs of each server in the original log set, determine the event set of each service in each service.

[0039] In some embodiments, step 102 can be implemented as follows: in the logs of each server, determine the set of event logs for each service; remove the physical location information of the server from the set of event logs for each service to obtain the event set for each service.

[0040] For example, the event set of the i-th service can be obtained according to formula (1).

[0041]

[0042] in, Indicates S ij The result after removing the physical location information of the server represents the event set of the i-th service, M. j This represents a formatting operation used to remove the physical location information of the servers, where n represents the number of servers.

[0043] In this embodiment of the application, removing the physical location information of the server facilitates the integration of the same services on different servers, thereby simplifying subsequent processing.

[0044] In some embodiments, events in the event set of each service are represented by messages of a custom protocol; the messages of the custom protocol include at least a message header and a message body, the message header including the timestamp of the event and the identifier of the service to which the event occurred, and the message body representing the retrieved fault information.

[0045] Here, the custom protocol can be named the Time-Space-Based Restructure Failure Protocol (TSBRFP); correspondingly, the fault reconstruction method of this application embodiment can be named the Time-Space-Based Restructure Failure (TSBRF) method.

[0046] Table 1

[0047]

[0048]

[0049] Referring to Table 1, in the TSBRFP message, the service instance identity document (id) is the identifier of the service to which the event is located. In the entire distributed system, each service is assigned a unique service instance id, which is a virtual id used to identify different services.

[0050] Referring to Table 1, the message body may include keywords and exception information. Keywords refer to search keywords used to identify faults, such as the commonly used ERROR; exception information refers to the complete fault information retrieved through keywords.

[0051] For example, referring to Table 1, the message header may also include a node address, which represents the Internet Protocol (IP) and port of the server that generated the event.

[0052] In related technologies, fault diagnosis of distributed systems requires manual collection of logs from various services on each server. However, due to the inconsistent formats of logs from different servers, it is impossible to achieve unified data processing after collection. In this embodiment, however, a custom protocol message can be used to uniformly format the services from different servers, thereby facilitating the unified processing of events from services on different servers in the future.

[0053] In some embodiments, referring to Table 1, the message of the custom protocol may also include additional information, which may include at least one of the following: the health of the operating system on which the event occurs, the resource utilization rate corresponding to the event, the status information of the device on which the event occurred, and the status information of the network on which the device on which the event occurred.

[0054] For example, the meaning of the health status of the operating system in which the event occurs can be customized according to different application scenarios, thereby adapting to different devices.

[0055] For example, the resource utilization corresponding to an event can be the utilization of the central processing unit (CPU), memory, and disk, etc.

[0056] For example, the status information of the device that experienced the event may be information such as the current temperature and humidity of the corresponding device, and the status information of the device that experienced the event can be used for subsequent fault analysis.

[0057] For example, the network status information of the device where the event occurred can be other network status information such as network speed.

[0058] As can be seen, the embodiments of this application can facilitate accurate and comprehensive fault reconstruction by adding additional information to the custom message.

[0059] Step 103: Determine the chronological order of events between different services based on the time information of each event in the event set of each service; reconstruct the fault information corresponding to the original log set according to the chronological order of events between different services.

[0060] In practical applications, steps 101 to 103 can be implemented based on a processor in an electronic device. This processor can be at least one of an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a CPU, a controller, a microcontroller, or a microprocessor. It is understood that other electronic devices can also implement the above processor functions, and this application embodiment does not impose any limitations.

[0061] As can be seen, the embodiments of this application can determine the event set of each service from the logs of each server in the original log set, thereby determining the event set of each service from a spatial dimension; and, based on the time information of each event in the event set of each service, the chronological relationship between events of different services can be determined, thus reconstructing the chronological relationship of each event from a time dimension; therefore, the embodiments of this application can accurately analyze the events of services of different servers from both time and space dimensions, thereby accurately locating the root cause of the fault.

[0062] In some embodiments, before determining the chronological relationship between events in different services based on the time information of each event in the event set of each service, the method further includes:

[0063] Based on the offset between the device time of each event in the event set of each service and the standard time, the time of each event in the event set of each service is aligned on the dimension of the standard time to obtain the time information of each event in the event set of each service.

[0064] It can be seen that by aligning the time of each event in the event set of each service on the dimension of standard time, the time dimension of each event in the event set of each service can be reconstructed; the alignment of the time of each event is a time calibration process.

[0065] For the event set e of the i-th service i The time alignment of each event can be achieved according to formula (2).

[0066]

[0067] Where Δt represents the event set e of the i-th service. i The offset of the time of each event from the standard time. The offset of the time of different events from the standard time in the event set of the i-th service can be different. This represents sorting the aligned times of events in the event set of the i-th service; E i This represents the time-aligned events in the event set of the i-th service.

[0068] It can be seen that by using TSBRFP messages to represent events in the event set of each service and by aligning the time of each event in the event set of each service, the reconstruction of each service in the spatial and temporal dimensions can be achieved.

[0069] In some embodiments, the method of determining the sequence of events between different services based on the time information of each event in the event set of each service may include:

[0070] When i is an integer greater than or equal to 1, for the target event in the event set of the i-th service, determine the event result set associated with the target event. The event result set associated with the target event includes the event set composed of the neighboring events of each other service except the i-th service. The neighboring events of other services represent the events in the event set of other services that are closest to the target event. The target event is any event in the event set of the i-th service.

[0071] Based on the event result set associated with each event in the event set of each service, determine the sequential relationship between events in different services.

[0072] For example, if the services of each server include services 1 to 5, for service 2, the other services are service 1, service 3, service 4 and service 5; for each event of each other service, the event closest to the target event of service 2 is determined, thereby determining the event result set associated with the target event.

[0073] For example, after determining the event result set associated with each event in the event set of each service, the event result sets associated with events in the event sets of each service can be combined to obtain the final result set R. t Through the final result set R t It is possible to determine the sequence of events between different services.

[0074] As can be seen, the embodiments of this application can accurately determine the sequential relationship between events in different services based on the event result set associated with each event in the event set of each service. This is beneficial for determining the causal relationship between events in different services when a fault occurs, based on the sequential relationship between events in different services, thereby facilitating accurate fault location and reconstruction.

[0075] In some embodiments, the time distance between the neighboring events of the other services and the target event is within a set time range.

[0076] Here, the duration range can be set according to actual needs.

[0077] It can be seen that by keeping the time distance between the neighboring events of other services and the target event within a set time range, it is beneficial to exclude events that are far away from the fault event in the time dimension, thereby facilitating a more accurate analysis of the root cause of the fault and achieving a more accurate fault reconstruction.

[0078] The application scenarios of the fault reconstruction method of the present invention will be illustrated below with reference to the accompanying drawings. Figure 2 Node 1 to node m represent m different servers, where m is an integer greater than 1; service 1 to service n represent n different services. The TSBRFP transformation engine is used to convert events in the event set of each service into TSBRFP messages. The TSBRFP core computing engine is used to perform the above step 103, thereby realizing the automated reconstruction and replay of faults.

[0079] In summary, the embodiments of this application can automatically identify the spatial and temporal relationships of events on various servers. By using the TSBRF method, a multi-dimensional fault playback system can be constructed, including time, resource utilization corresponding to the event, status information of the device where the event occurred, and status information of the network in which the device where the event occurred. This is beneficial for accurately reconstructing various environments and system states at the time of the fault, and effectively assists in fault diagnosis.

[0080] Based on the fault reconstruction method proposed in the foregoing embodiments, this application also proposes a fault reconstruction device; Figure 3 This is a schematic diagram of the composition structure of a fault reconstruction device according to an embodiment of this application, as shown below. Figure 3 As shown, the fault reconstruction device may include an acquisition module 300, a first processing module 301, and a second processing module 302, wherein...

[0081] The acquisition module 300 is used to acquire a raw log set including logs from various servers; the logs of each server are used to represent the event logs of each service in the corresponding server; the event logs are used to represent logs of fault occurrence events.

[0082] The first processing module 301 is used to determine the event set of each service in the original log set from the logs of each server.

[0083] The second processing module 302 is used to determine the chronological relationship between events in different services based on the time information of each event in the event set of each service; and to reconstruct the fault information corresponding to the original log set according to the chronological relationship between events in different services.

[0084] In some embodiments of this application, the first processing module 301 is configured to determine the event set of each service from the logs of each server in the original log set, including:

[0085] In the logs of each of the servers, determine the set of event logs for each service;

[0086] The physical location information of the server is removed from the event log set of each service to obtain the event set of each service.

[0087] In some embodiments of this application, events in the event set of each service are represented by messages of a custom protocol; the message of the custom protocol includes at least a message header and a message body, the message header including a timestamp of the event and an identifier of the service to which the event is located, and the message body representing the retrieved fault information.

[0088] In some embodiments of this application, the message of the custom protocol further includes at least one of the following: the health of the operating system on which the event occurs, the resource utilization rate corresponding to the event, the status information of the device on which the event occurred, and the status information of the network on which the device on which the event occurred.

[0089] In some embodiments of this application, the second processing module 302 is further configured to, before determining the sequential relationship between events in different services based on the time information of each event in the event set of each service, align the time of each event in the event set of each service on the dimension of the standard time according to the offset between the time of the device where each event is located in the event set of each service and the standard time, so as to obtain the time information of each event in the event set of each service.

[0090] In some embodiments of this application, the second processing module 302 is used to determine the chronological relationship between events in different services based on the time information of each event in the event set of each service, including:

[0091] When i is an integer greater than or equal to 1, for a target event in the event set of the i-th service, determine the event result set associated with the target event. The event result set associated with the target event includes an event set consisting of neighboring events of each other service except the i-th service. The neighboring events of the other services represent the events in the event set of the other services that are closest to the target event. The target event is any event in the event set of the i-th service.

[0092] Based on the event result set associated with each event in the event set of each service, the sequential relationship between events in different services is determined.

[0093] In some embodiments of this application, the time distance between the neighboring events of the other services and the target event is within a set time range.

[0094] In practical applications, the acquisition module 300, the first processing module 301, and the second processing module 302 can all be implemented using a processor of an electronic device. The processor can be at least one of an ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, or microprocessor. It is understood that other electronic devices can also implement the above processor functions, and this application embodiment does not impose any limitations.

[0095] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0096] It should be noted that, in the embodiments of this application, if the above methods are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a terminal, server, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0097] Correspondingly, this application embodiment further provides a computer program product, the computer program product including computer executable instructions, which are used to implement any of the fault reconstruction methods provided in this application embodiment.

[0098] Accordingly, this application embodiment further provides a computer storage medium storing computer-executable instructions, which are used to implement any of the fault reconstruction methods provided in the above embodiments.

[0099] This application also provides an electronic device. Figure 4 A schematic diagram of an optional component structure of the electronic device provided in an embodiment of this application, such as... Figure 4 As shown, the electronic device 40 includes:

[0100] Memory 401 is used to store executable instructions;

[0101] The processor 402 is used to implement any of the above-mentioned fault reconstruction methods when executing the executable instructions stored in the memory 401.

[0102] The processor 402 mentioned above can be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor.

[0103] The aforementioned computer-readable storage medium / memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM), etc.; it can also be various terminals that include one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0104] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0105] It should be understood that the phrase "some embodiments" mentioned throughout the specification means that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, "some embodiments" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0106] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0107] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0108] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0109] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0110] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause the device automatic test line to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0111] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0112] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0113] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A fault reconstruction method, characterized in that, The method includes: Obtain a raw log set including logs from each server; the logs of each server are used to represent the event logs of each service in the corresponding server; the event logs are used to represent logs of fault occurrence events; From the logs of each server in the original log set, determine the event set of each service in each service; Based on the time information of each event in the event set of each service, determine the chronological relationship between events in different services; and reconstruct the fault information corresponding to the original log set according to the chronological relationship between events in different services. The step of determining the sequence of events between different services based on the time information of each event in the event set of each service includes: When i is an integer greater than or equal to 1, for a target event in the event set of the i-th service, determine the event result set associated with the target event. The event result set associated with the target event includes an event set consisting of neighboring events of each other service except the i-th service. The neighboring events of the other services represent the events in the event set of the other services that are closest to the target event. The target event is any event in the event set of the i-th service. Based on the event result set associated with each event in the event set of each service, the sequential relationship between events in different services is determined.

2. The method according to claim 1, characterized in that, The step of determining the event set for each service from the logs of each server in the original log set includes: In the logs of each of the servers, determine the set of event logs for each service; The physical location information of the server is removed from the event log set of each service to obtain the event set of each service.

3. The method according to claim 2, characterized in that, The events in the event set of each service are represented by messages of a custom protocol; the messages of the custom protocol include at least a message header and a message body, the message header includes a timestamp of the event and the identifier of the service to which the event occurred, and the message body represents the retrieved fault information.

4. The method according to claim 3, characterized in that, The custom protocol message also includes at least one of the following: the health of the operating system on which the event occurs, the resource utilization rate corresponding to the event, the status information of the device on which the event occurred, and the status information of the network on which the device on which the event occurred.

5. The method according to any one of claims 1 to 3, characterized in that, Before determining the chronological relationship between events in different services based on the time information of each event in the event set of each service, the method further includes: Based on the offset between the device time of each event in the event set of each service and the standard time, the time of each event in the event set of each service is aligned along the dimension of the standard time to obtain the time information of each event in the event set of each service.

6. The method according to claim 1, characterized in that, The time distance between the neighboring events of the other services and the target event is within a set time range.

7. A fault reconstruction device, characterized in that, The device includes: The acquisition module is used to acquire a raw log set including logs from various servers; the logs of each server are used to represent the event logs of each service in the corresponding server; the event logs are used to represent logs of fault occurrence events. The first processing module is used to determine the event set of each service in the original log set from the logs of each server. The second processing module is used to determine the chronological relationship between events in different services based on the time information of each event in the event set of each service; and to reconstruct the fault information corresponding to the original log set according to the chronological relationship between events in different services. The second processing module is used to determine the sequential relationship between events in different services based on the time information of each event in the event set of each service, including: When i is an integer greater than or equal to 1, for a target event in the event set of the i-th service, determine the event result set associated with the target event. The event result set associated with the target event includes an event set consisting of neighboring events of each other service except the i-th service. The neighboring events of the other services represent the events in the event set of the other services that are closest to the target event. The target event is any event in the event set of the i-th service. Based on the event result set associated with each event in the event set of each service, the sequential relationship between events in different services is determined.

8. An electronic device, characterized in that, Includes a processor and memory for storing computer programs that can run on the processor; wherein, The processor is used to run the computer program to perform the fault reconstruction method according to any one of claims 1 to 6.

9. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the fault reconstruction method according to any one of claims 1 to 6.

Images