Fault diagnosis method and device, electronic equipment and storage medium
By acquiring data streams and analyzing the communication protocols of their attribute layers during the start and end of a fault, the problem of low efficiency in fault location analysis in existing technologies is solved, achieving more efficient and accurate fault location.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- XINYANG BRANCH HENAN CO LTD OF CHINA MOBILE COMM CORP
- Filing Date
- 2022-03-09
- Publication Date
- 2026-06-02
AI Technical Summary
In existing technologies, the fault location analysis process relies on human experience, which leads to low efficiency and is prone to missed detections and false detections, making it impossible to efficiently and accurately determine the cause of the fault.
By marking the start and end times of the fault, the data stream of the target service during that time period is obtained, and the fault is determined based on the communication protocol of the data stream at each attribute layer, thereby determining the cause of the fault.
It improves the efficiency and accuracy of fault location analysis, reduces reliance on human experience, and reduces the time and cost of fault location.
Smart Images
Figure CN116781496B_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of fault diagnosis, and specifically relates to a fault diagnosis method, device, electronic device and storage medium. Background Technology
[0002] With the rapid development of internet technology and the continuous growth of the number of internet users, various mobile application services, game software services, and software services for evaluating and collecting various types of information are growing rapidly. At the same time, users have increasingly higher requirements for the service quality of internet network links and software resources, as well as the efficiency of problem-solving.
[0003] The fault location analysis process in related technologies relies heavily on human experience. First, data packet flow analysis in these technologies depends heavily on the analyst's skills and experience. Analysts determine problem points by observing data flow interactions, and there is a significant disparity in the technical capabilities of different analysts. Second, data flow analysis requires traversing the entire data packet flow for investigation, which can easily lead to missed or false positives regarding interaction relationships. In the process of internet business data interaction, data associations and calls are complex and ever-changing, and missed or false positives often result in costly fault location, time-consuming fault location, or even failure to locate the fault. Furthermore, missed or false positives force analysts to re-analyze the problematic data flow resources.
[0004] In summary, the fault location analysis process in related technologies suffers from low efficiency. Summary of the Invention
[0005] This application provides a fault diagnosis method, apparatus, electronic device, and storage medium, which can solve the problem of low efficiency in fault location analysis in related technologies.
[0006] In a first aspect, embodiments of this application provide a fault diagnosis method, the method comprising: marking the fault start time and fault end time of a target service; obtaining the data stream of the target service corresponding to the time period between the fault start time and fault end time; determining the fault occurring in the attribute layer of the data stream based on the communication protocol of the data stream in its attribute layer, wherein the number of attribute layers is at least one; and determining the cause of the fault based on the fault.
[0007] Secondly, embodiments of this application provide a fault diagnosis device, which includes: a marking module for marking the fault start time and fault end time of a target service; an acquisition module for acquiring the data stream of the target service corresponding to the time period between the fault start time and fault end time; a first determination module for determining a fault occurring in the attribute layer of the data stream based on the communication protocol of the data stream in its attribute layer, wherein the number of attribute layers is at least one; and a second determination module for determining the cause of the fault based on the fault.
[0008] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.
[0009] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.
[0010] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the method as described in the first aspect.
[0011] In this embodiment, the failure start time and failure end time of the target service are marked by dots; the data stream of the target service corresponding to the time period between the failure start time and failure end time is obtained; based on the communication protocol of the data stream at its attribute layer, the failure occurring at that attribute layer is determined, wherein the number of attribute layers is at least one; based on the failure, the cause of the failure is determined. This allows the target service to determine the specific failure by obtaining the data stream between the failure start time and failure end time and according to the communication protocol of the data stream at each attribute layer when a failure occurs. Compared with related technologies, which require traversing the entire data packet stream for investigation and using manual experience to observe data stream interactions to determine the problem point, this improves the efficiency of fault location analysis and solves the problem of low efficiency in fault location analysis in related technologies. Attached Figure Description
[0012] Figure 1 This is a schematic flowchart of a fault diagnosis method provided in an embodiment of this application;
[0013] Figure 2 This is a schematic diagram of a data stream dotting method provided in an embodiment of this application;
[0014] Figure 3 This is a flowchart illustrating another fault diagnosis method provided in an embodiment of this application;
[0015] Figure 4 This is a schematic diagram of the structure of a fault diagnosis device according to an embodiment of this application;
[0016] Figure 5 This is a schematic diagram of the structure of an electronic device according to another embodiment of this application. Detailed Implementation
[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0018] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.
[0019] The following description, in conjunction with the accompanying drawings, details a fault diagnosis method, apparatus, electronic device, and storage medium provided in this application through specific embodiments and application scenarios.
[0020] Specifically, with the rapid development of internet technology and the continuous growth of the number of internet users, various mobile APP services, game software services, and software services for evaluating and collecting various types of information are growing rapidly. At the same time, users have increasingly higher requirements for the service quality of internet network links and software resources, as well as the efficiency of problem-solving.
[0021] The fault location analysis process in related technologies relies heavily on human experience. First, data packet flow analysis in these technologies depends heavily on the analyst's skills and experience. Analysts determine problem points by observing data flow interactions, and there is a significant disparity in the technical capabilities of different analysts. Second, data flow analysis requires traversing the entire data packet flow for investigation, which can easily lead to missed or false positives regarding interaction relationships. In the process of internet business data interaction, data associations and calls are complex and ever-changing, and missed or false positives often result in costly fault location, time-consuming fault location, or even failure to locate the fault. Furthermore, missed or false positives force analysts to re-analyze the problematic data flow resources.
[0022] In summary, the process of business fault location analysis in related technologies is cumbersome and complex and relies heavily on human experience, resulting in low efficiency in business fault location analysis.
[0023] To address this, this application marks the start and end times of a target service's fault; obtains the data stream of the target service corresponding to the time interval between the start and end times; determines the fault occurring at the attribute layer of the data stream based on the communication protocol of the data stream at each attribute layer, wherein the number of attribute layers is at least one; and determines the cause of the fault based on the fault. This allows the target service to determine the specific fault by obtaining the data stream between the start and end times and according to the communication protocol of the data stream at each attribute layer when a fault occurs. Compared to related technologies that rely on manual experience to observe data stream interactions to identify problem points and to traverse the entire data packet stream for troubleshooting during data stream analysis, this improves the efficiency and accuracy of fault location analysis.
[0024] Figure 1 This illustration shows a fault diagnosis method provided by an embodiment of the present invention. The method can be executed by an electronic device, which may include a server and / or a terminal device, wherein the terminal device may be, for example, a mobile phone terminal. In other words, the method can be executed by software or hardware installed in the electronic device, and the method includes the following steps:
[0025] Step 101: Mark the start and end times of the fault for the target service.
[0026] Optionally, the target business here can be a mobile APP business, game software business, or software business for evaluating and collecting various types of information in the Internet business, etc., without being specifically limited here.
[0027] Optionally, the failures that occur in the target business can be data packet loss, window anomalies, inability to establish a connection, etc. The specific failures can be determined by the target business and are not specifically limited here.
[0028] Specifically, during the occurrence of a failure in the target service, the start and end times of the failure can be marked.
[0029] Step 102: Obtain the data stream of the target service corresponding to the time period between the fault start time and the fault end time.
[0030] Optionally, the data stream of the target service corresponding to the time period N times the tolerance value of the time period between the fault start time and the fault end time can be obtained, thereby obtaining the relevant data stream corresponding to the fault of the target service more accurately.
[0031] Specifically, the value of N can be determined based on the specific target business, and no specific limitation is made here.
[0032] Step 103: Based on the communication protocol of the data stream at its attribute layer, determine the fault that occurred in the data stream at the attribute layer.
[0033] The number of attribute layers is at least one.
[0034] Specifically, for example, based on the communication protocol of the data stream at its network interface layer, the specific fault that occurred in the data stream at the network interface layer corresponding to the target service fault can be determined. For example, the specific fault mentioned above could be the inability to establish a connection.
[0035] Step 104: Based on the fault, determine the cause of the fault.
[0036] Optionally, the cause of the failure can be one or more, and no specific limitation is made here.
[0037] In this embodiment, the start and end times of a fault in a target service are marked; the data stream of the target service corresponding to the time period between the start and end times is obtained; based on the communication protocol of the data stream at its attribute layer, the fault occurring at that attribute layer is determined, wherein the number of attribute layers is at least one; based on the fault, the cause of the fault is determined. This allows the target service to determine the specific fault occurring in the event of a fault by obtaining the data stream between the start and end times and according to the communication protocol of the data stream at each attribute layer. Compared to related technologies where data stream analysis requires traversing the entire data stream for investigation and relying on manual experience to observe data stream interactions to determine the problem point, this improves the efficiency of fault location analysis and solves the problem of low efficiency in fault location analysis in related technologies.
[0038] In one optional implementation, the communication protocol of the attribute layer includes at least one of the following: network interface layer protocol, network layer protocol, transport layer protocol, and application layer protocol.
[0039] In this way, the data stream can be identified through the communication protocols of its various attribute layers, thereby making the identified specific faults more accurate and the fault identification more efficient.
[0040] In one optional implementation, determining the cause of the fault based on the fault includes:
[0041] Perform network connectivity tests on the address where the fault occurred, both for local and external network resources. If the network connectivity test results for local and external network resources differ, determine that the cause of the fault is a network resource allocation problem.
[0042] Optionally, commands such as ping, tcping, and tlent can be used to test network connectivity at the address where the fault occurred.
[0043] As a concrete example, commands such as ping, tcping, and tlent can be used to test the network connectivity of China Mobile's network at the address where the fault occurred, and the same commands can be used to test the network connectivity of China Unicom's network at the same address. If the test results of the network connectivity tests of China Mobile's network and China Unicom's network are different, it can be determined that the cause of the fault in the target service is the difference in network resource allocation.
[0044] In this way, by testing the network connectivity of local and external network resources at the address where the fault occurred, the specific cause of the fault can be determined, and more targeted countermeasures can be taken to address the fault.
[0045] In one optional implementation, determining the cause of the fault based on the fault includes: performing routing path tests on the target task within the local network and on other networks; if the routing path returned by the routing path test within the local network differs from the routing path returned by the routing path test on the other network, the cause of the fault is determined to be a network resource allocation problem.
[0046] Optionally, the tracert command can be used to test network connectivity at the address where the fault occurred.
[0047] As a concrete example, the tracert command can be used to test the routing path of the target task on the China Mobile network, and the tracert command can also be used to test the routing path of the target task on the China Unicom network. If the routing path test results returned by the China Mobile network and the China Unicom network are different, it can be determined that the cause of the failure of the target service is the difference in network resource allocation.
[0048] In this way, by testing the network routing paths of local and external network resources at the address where the fault occurred, the specific cause of the fault can be determined, and more targeted countermeasures can be taken to address the fault.
[0049] In one optional implementation, before marking the start and end times of the target service's fault, the method further includes: inputting the occurrence time, location, and status of the target service's fault into the fault diagnosis system, and outputting a simulated fault test; during the simulated fault test, collecting data stream interaction packets of the target service; and reproducing the fault occurrence process of the target service based on the data stream interaction packets.
[0050] In this way, the failure process of the target service can be reproduced, and the data stream corresponding to the failure can be captured to determine the specific failure and its cause.
[0051] In one optional implementation, obtaining the data stream of the target service corresponding to the time period between the fault start time and the fault end time includes: marking the original code timestamp of the original data encoded binary number corresponding to the data stream of the target service based on the fault start time and the fault end time; and extracting the data stream of the target service corresponding to the marking result based on the marking result on the original code timestamp.
[0052] Optionally, the location of the data stream corresponding to the fault can be determined by inserting a sub-protocol of the Transmission Control Protocol / Internet Protocol (TCP / IP) protocol suite. For example, based on the fault start and end times, the aforementioned sub-protocol can be used to mark the original timestamp of the original data encoded binary number corresponding to the target service's data stream.
[0053] As a concrete example, such as Figure 2 As shown, the fault start time and fault end time can be used to mark points, and the sub-protocol marking method can be used to associate the mark points with the original code timestamp of the original data encoded binary number corresponding to the data stream of the target service. Based on the mark points on the original code timestamp, the data stream of the target service corresponding to the mark points can be obtained.
[0054] In this way, the data stream corresponding to the target service failure can be located more accurately, and the specific failure of the target service can be determined based on this data stream.
[0055] In one alternative implementation, after determining that a fault has occurred in the data stream at the attribute layer, the method further includes: displaying the fault in the form of a color, wherein the displayed color is a color corresponding to a preset weight of the fault.
[0056] As a concrete example, faults can be displayed in three colors: red, yellow, and green, with their corresponding fault weights decreasing in that order. Thus, the most severe fault can be displayed in red; the next most severe fault in yellow; and the minor fault in green.
[0057] Optional, see below Figure 3 An embodiment of this application will be described, which includes the following steps:
[0058] Step 301: Input the occurrence time, location and status of the target service fault into the fault diagnosis system, and output a simulated fault test of the fault.
[0059] Optionally, the target business here can be a mobile APP business, game software business, or software business for evaluating and collecting various types of information in the Internet business, etc., without being specifically limited here.
[0060] Optionally, the failure of the target service can be data packet loss, window abnormality, inability to establish a connection, etc. The failure can be determined by the specific target service and is not specifically limited here.
[0061] Step 302: During the simulated fault test, collect the data stream interaction data packets of the target service; based on the data stream interaction data packets, reproduce the fault occurrence process of the target service.
[0062] Step 303: Mark the start and end times of the fault for the target service.
[0063] Specifically, during the occurrence of a failure in the target service, the start and end times of the failure can be marked.
[0064] Step 304: Obtain the data stream of the target service corresponding to the time period between the fault start time and the fault end time.
[0065] Specifically, based on the fault start time and fault end time, a sub-protocol of the TCP / IP protocol suite can be used to mark the original timestamp of the original data encoded binary number corresponding to the data stream of the target service; based on the marking results on the original timestamp, the data stream of the target service corresponding to the marking results can be obtained.
[0066] Step 305: Based on the communication protocol of the data stream at its attribute layer, determine the fault that occurred in the data stream at the attribute layer.
[0067] The number of attribute layers is at least one.
[0068] Optionally, the communication protocol of the attribute layer includes at least one of the following: network interface layer protocol, network layer protocol, transport layer protocol, and application layer protocol.
[0069] As a concrete example, based on the communication protocol of the data stream at its network interface layer, the specific fault occurring at the network interface layer corresponding to the target service fault can be determined. For example, the specific fault could be the inability to establish a connection or an abnormal connection loss. Similarly, based on the communication protocol of the data stream at its network layer, the specific fault occurring at the network layer corresponding to the target service fault can be determined to be abnormal data retransmission; based on the communication protocol of the data stream at its transport layer, the specific fault occurring at the transport layer can be determined to be data packet loss; and based on the communication protocol of the data stream at its application layer, the specific fault occurring at the application layer can be determined to be interactive window anomalies, out-of-order data, etc.
[0070] Step 306: Display the fault in the form of color, wherein the displayed color is the color corresponding to the preset weight of the fault.
[0071] For example, faults can be displayed in three colors: red, yellow, and green, with the corresponding fault weight decreasing in that order. Thus, the most severe fault can be displayed in red; the next most severe fault in yellow; and the minor fault in green.
[0072] Step 307: Based on the fault, determine the cause of the fault.
[0073] Optionally, network connectivity tests can be performed on the address where the fault occurred, using both local and inter-network resources. If the network connectivity test results for local and inter-network resources differ, the cause of the fault can be determined to be a network resource allocation problem.
[0074] Optionally, routing path tests can be performed on the target task both within the local network and on other networks. If the routing path returned by the routing path test within the local network differs from the routing path returned by the routing path test on other networks, the cause of the failure can be determined to be a network resource allocation problem.
[0075] It should be noted that the fault diagnosis method provided in this application embodiment can be executed by a fault diagnosis device, or a control module in the fault diagnosis device for executing a fault diagnosis method. This application embodiment uses a fault diagnosis device executing a fault diagnosis method as an example to illustrate the fault diagnosis device provided in this application embodiment.
[0076] Figure 4 This is a schematic diagram of the structure of a fault diagnosis device according to an embodiment of the present invention. Figure 4 As shown, a fault diagnosis device 400 includes: a dot module 410, an acquisition module 420, a first determination module 430, and a second determination module 440.
[0077] The marking module 410 is used to mark the fault start time and fault end time of the target service; the acquisition module 420 is used to acquire the data stream of the target service corresponding to the time period between the fault start time and fault end time; the first determination module 430 is used to determine the fault that occurred in the attribute layer of the data stream based on the communication protocol of the data stream in its attribute layer, wherein the number of attribute layers is at least one; the second determination module 440 is used to determine the cause of the fault based on the fault.
[0078] In one implementation, the second determining module 440 is specifically used to: perform network connectivity tests on the local network resources and external network resources at the address where the fault occurred; if the network connectivity test results of the local network resources are different from the network connectivity test results of the external network resources, determine that the cause of the fault is a network resource allocation problem.
[0079] In one implementation, the second determining module 440 is specifically used to: perform routing path tests on the target task within the local network and on other networks; if the routing path returned by the routing path test within the local network is different from the routing path returned by the routing path test on other networks, determine that the cause of the fault is a network resource allocation problem.
[0080] In one implementation, the tracking module 410 is further configured to: input the occurrence time, location, and status of the fault of the target service into the fault diagnosis system, and output a simulated fault test of the fault; during the simulated fault test, collect data stream interaction data packets of the target service; and reproduce the fault occurrence process of the target service based on the data stream interaction data packets.
[0081] In one implementation, the acquisition module 420 is specifically used to: mark the original code timestamp of the original data encoded binary number corresponding to the data stream of the target service based on the fault start time and fault end time; and acquire the data stream of the target service corresponding to the marking result based on the marking result on the original code timestamp.
[0082] In one implementation, the communication protocol of the attribute layer includes at least one of the following: network interface layer protocol, network layer protocol, transport layer protocol, and application layer protocol.
[0083] In one implementation, the second determining module 440 is further configured to: display the fault in the form of color, wherein the displayed color is the color corresponding to a preset weight of the fault.
[0084] The fault diagnosis device in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.
[0085] One of the fault diagnosis devices in this application embodiment can be a device with an operating system. The operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit the specific operating system.
[0086] The fault diagnosis device provided in this application embodiment can achieve... Figure 1 and Figure 3 The various processes implemented in the method embodiments are not described in detail here to avoid repetition.
[0087] Optional, such as Figure 5 As shown, this application embodiment also provides an electronic device 500, including a processor 501, a memory 502, and a program or instructions stored in the memory 502 and executable on the processor 501. When the program or instructions are executed by the processor 501, they implement the various processes of the above method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.
[0088] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.
[0089] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described fault diagnosis method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.
[0090] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.
[0091] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described fault diagnosis method embodiment and achieve the same technical effect. To avoid repetition, it will not be described again here.
[0092] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.
[0093] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.
[0094] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.
[0095] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.
Claims
1. A fault diagnosis method, characterized in that, include: Mark the start and end times of the fault for the target service; Obtain the data stream of the target service corresponding to the time period between the fault start time and the fault end time; Based on the communication protocol of the data stream at its attribute layer, determine the fault that occurred in the data stream at the attribute layer, wherein the number of attribute layers is at least one; Based on the aforementioned fault, determine the cause of the fault. Determining the cause of the fault based on the fault includes: Perform network connectivity tests on local and inter-network resources at the address where the fault occurred; If the network connectivity test results of the local network resources differ from the network connectivity test results of the external network resources, the cause of the fault is determined to be a network resource allocation problem.
2. The fault diagnosis method according to claim 1, characterized in that, Determining the cause of the fault based on the fault includes: Perform routing path testing on the target task both within the local network and from other networks; If the routing path returned by the routing path test of the local network is different from the routing path returned by the routing path test of the other network, the cause of the failure is determined to be a network resource allocation problem.
3. The fault diagnosis method according to claim 1, further comprising, before marking the fault start time and fault end time of the target service, the method as described above: Input the occurrence time, location, and status of the target service failure into the fault diagnosis system, and output a simulated fault test of the failure. During the simulated fault test, data stream interaction data packets of the target service are collected; Based on the data stream interaction data packets, the fault occurrence process of the target service is reproduced.
4. The fault diagnosis method according to claim 1, characterized in that, The step of obtaining the data stream of the target service corresponding to the time period between the fault start time and the fault end time includes: Based on the fault start time and fault end time, a dot is made on the original code timestamp of the original data encoded binary number corresponding to the data stream of the target service; Based on the timestamps on the source code, the data stream of the target service corresponding to the timestamps is obtained.
5. The fault diagnosis method according to claim 1, characterized in that, The communication protocol of the attribute layer includes at least one of the following: network interface layer protocol, network layer protocol, transport layer protocol, and application layer protocol.
6. The fault diagnosis method according to claim 1, characterized in that, After determining that a fault occurred in the data stream at the attribute layer, the method further includes: The fault is displayed in color, where the displayed color corresponds to a preset weight of the fault.
7. A fault diagnosis device, characterized in that, include: The marking module is used to mark the start and end times of faults in the target service. The acquisition module is used to acquire the data stream of the target service corresponding to the time period between the fault start time and the fault end time; A first determining module is configured to determine, based on the communication protocol of the data stream at its attribute layer, a fault occurring in the attribute layer of the data stream, wherein the number of attribute layers is at least one. The second determining module is used to determine the cause of the fault based on the fault. The second determining module is specifically used to perform network connectivity tests on local and external network resources at the address where the fault occurred; If the network connectivity test results of the local network resources differ from the network connectivity test results of the external network resources, the cause of the fault is determined to be a network resource allocation problem.
8. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the fault diagnosis method as described in any one of claims 1-6.
9. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the fault diagnosis method as described in any one of claims 1-6.