A full-link tracking method and system based on APM

Abstract

The present invention discloses a full-link tracking method and system based on APM, which relates to the technical field of full-link tracking. Probes are placed in different links of the full-link system. The AI model converts natural language descriptions into codes, generates plug-ins, and integrates them into the tracking system to start tracking the matching paths in the full link. In the matching paths, corresponding link data is collected in real time by a number of probes to predict whether the matching paths of the full link will be abnormal through a big data model. When it is predicted that the matching paths of the full link will be abnormal, the urgency of the abnormality is analyzed according to the prediction results, and a corresponding management strategy is generated based on the urgency of the abnormality. The tracking system injects probe tools into the full-link system, collects information flows, reduces coupling with the business system, ensures the stability and rapid deployment of the system, and automatically selects the appropriate notification method according to the urgency of the fault to ensure timely handling of emergency faults.

Description

Technical Field

[0001] The present invention relates to the technical field of full-link tracking, and in particular to a full-link tracking method and system based on APM. Background Art

[0002] With the development of microservice architecture, containerization technology, and cloud computing, modern application systems have become highly distributed. Each user request may require a large amount of network interaction and data processing across multiple services, databases, third-party interfaces, and internal components. This complex architecture makes it more difficult to diagnose single points of failure, performance bottlenecks, and abnormal behavior.

[0003] A full-link tracing system based on APM (Application Performance Management) is a technical solution for monitoring, analyzing, and optimizing the performance of complex distributed systems. It provides visibility into the entire lifecycle, from user requests to the delivery between system components, helping developers and operations personnel quickly identify, locate, and resolve performance bottlenecks and system failures.

[0004] The existing technology has the following defects:

[0005] The monitoring solutions of existing tracking methods usually require direct modification of business code and integration of monitoring tools or plug-ins, which will bring complex development and maintenance work and increase system instability. In addition, the alarm method of the tracking method is usually based on preset rules. When an anomaly occurs, only fixed alarms can be issued. It is impossible to intelligently analyze the cause of the fault or provide optimization solutions. Alarms usually do not make flexible notification adjustments based on the urgency of the fault, which may cause important faults to be delayed or non-urgent issues to be repeatedly notified to relevant personnel, increasing the burden and pressure of response. Summary of the Invention

[0006] The purpose of the present invention is to provide an APM-based full-link tracking method and system. Without modifying the existing business code and system architecture, the probe tool can be injected into the full-link system to collect information flow, reduce the coupling with the business system, ensure the stability and rapid deployment of the system, and automatically select the appropriate notification method according to the urgency of the fault to ensure timely handling of emergency faults.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a full-link tracking method based on APM, the tracking method comprising the following steps:

[0008] The tracking system obtains information about each link in the entire system, places probes at different links, and describes tracking requirements in natural language before inputting them into the AI model. The AI model converts the natural language description into code, generates a plug-in, and integrates it into the tracking system to begin tracking matching paths in the entire system.

[0009] In the matching path, corresponding link data is collected in real time through several probes, and the link data is processed by Pin-Point middleware and stored in the h-base database;

[0010] After integrating data from several links through the big data model, it is predicted whether there will be any abnormalities in the matching path of the entire link. When it is predicted that there will be abnormalities in the matching path of the entire link, the urgency of the abnormality is analyzed based on the prediction results, and corresponding management strategies are generated based on the urgency of the abnormality.

[0011] In a preferred embodiment, the tracking requirements are described in natural language and then input into the AI model. The AI model converts the natural language description into code, generates a plug-in, and integrates it into the tracking system to start tracking the matching path in the entire link, including the following steps:

[0012] Users express their tracking requirements through natural language descriptions, including tracking business links, monitoring performance indicators, and fault warning requirements;

[0013] The AI model automatically parses the natural language descriptions entered by users and converts them into code requirements. Based on existing business knowledge and monitoring logic, these natural language descriptions are mapped to monitoring operations.

[0014] The AI model generates monitoring probe code to collect specified monitoring indicators, set up data transmission interfaces, and send the collected data to the analysis platform;

[0015] The generated plug-in is integrated into the tracking system and placed in the matching path of the entire link. After the plug-in is deployed, the tracking system begins tracking and collecting data on the specified path in the entire link.

[0016] In a preferred embodiment, the data of several links are processed by Pin-Point middleware and stored in the h-base database, which includes the following steps:

[0017] The collected link data is passed by the probe to the Pin-Point middleware. The Pin-Point middleware serves as the data processing layer, which is used to receive and process the link data. The Pin-Point middleware formats the link data.

[0018] Structuring the formatted link data and converting it into data that conforms to the HBase storage format, including row keys and column families;

[0019] The row key includes the link ID and timestamp information, which is used to uniquely identify each link data;

[0020] Column families contain data of different categories, such as API exceptions, database operations, network requests, and cache status;

[0021] The structured data is stored in the HBase database through the HBase-API.

[0022] In a preferred embodiment, after integrating data from several links through a big data model, predicting whether the matching path of the entire link will be abnormal includes the following steps:

[0023] The API interface anomaly index, the frequency of database unauthorized operations, the network layer HTTP request failure rate, and the cache hit rate are incorporated into the big data model. After integration, the big data model outputs a path coefficient for the matching path of the entire link. The path coefficient is compared with the preset first coefficient threshold and second coefficient threshold. The first coefficient threshold is used to predict whether the matching path will be abnormal, and the second coefficient threshold is used to predict the severity of the matching path anomaly.

[0024] If the path coefficient is less than or equal to the first coefficient threshold, the predicted matching path will not be abnormal; if the path coefficient is greater than the first coefficient threshold, the predicted matching path will be abnormal;

[0025] If the path coefficient is greater than the first coefficient threshold and the path coefficient is less than or equal to the second coefficient threshold, the predicted matching path will be slightly abnormal. If the path coefficient is greater than the second coefficient threshold, the predicted matching path will be seriously abnormal.

[0026] In a preferred embodiment, the function expression of the big data model is: Where, is the path coefficient, The API interface abnormality index. The frequency of database unauthorized operations. is the HTTP request failure rate at the network layer, is the cache hit ratio, 、 、 、 They are the API interface anomaly index, database unauthorized operation frequency, network layer HTTP request failure rate, and cache hit rate proportional coefficients, and 、 、 、 Both are greater than 0.

[0027] In a preferred embodiment, when an abnormality is predicted in the matching path of the entire link, the urgency of the abnormality is analyzed according to the prediction result, and a corresponding management strategy is generated based on the urgency of the abnormality, including the following steps:

[0028] When the matching path is predicted to have a serious anomaly, the matching path is marked as high urgency; when the matching path is predicted to have a slight anomaly, the matching path is marked as medium urgency; when the matching path is predicted to have no anomaly, the matching path is marked as low urgency;

[0029] The following management is performed on high-urgency matching paths:

[0030] Immediately interrupt operations at the abnormal link and prioritize fault repair. During the fault repair process, enter degraded mode and shut down non-core functions.

[0031] The following management is performed on matching paths of medium urgency:

[0032] All the matching paths in the full link system are used to establish a path set, and the average path coefficient and the standard deviation of the path coefficient are calculated by combining all the matching paths in the path set.

[0033] The development trend of the matching path of medium urgency was analyzed based on the average path coefficient and the standard deviation of the path coefficient;

[0034] If the average path coefficient is less than or equal to the first coefficient threshold, and the path coefficient standard deviation is less than or equal to the standard deviation threshold, the matching path of medium urgency is analyzed to develop towards low urgency. At this time, the management method of the high urgency matching path is adopted to manage medium urgency;

[0035] If the average path coefficient is greater than the first coefficient threshold, the matching path of medium urgency is analyzed to develop towards high urgency, and the management method of high urgency matching path is adopted to manage medium urgency;

[0036] If the average path coefficient is less than or equal to the first coefficient threshold, and the path coefficient standard deviation is greater than the standard deviation threshold, it is analyzed that all matching paths in the full link system still have fluctuations. The management method is to increase the monitoring frequency of medium-urgency matching paths;

[0037] The following management is performed on the matching paths with low urgency: the matching paths with low urgency are continuously monitored according to the pre-set monitoring strategy.

[0038] In a preferred embodiment, corresponding link data is collected in real time by a plurality of probes in the matching path, including the following steps:

[0039] The probe collects corresponding link data in real time, including API interface anomaly index, database unauthorized operation frequency, network layer HTTP request failure rate and cache hit rate.

[0040] In a preferred embodiment, the calculation logic of the API interface anomaly index is as follows: obtain the number of error codes returned by the full-link system API interface and the total number of API calls, and divide the number of error codes returned by the total number of API calls to obtain the API interface anomaly index;

[0041] The calculation logic of the frequency of unauthorized database operations is as follows: when a user logs into the database, the user's permission range is obtained, and when the user operates beyond the permission range in the database, it is recorded. The frequency of unauthorized database operations is obtained by dividing the cumulative duration of the user's operations beyond the permission range in the database during the monitoring period by the monitoring duration.

[0042] In a preferred embodiment, the calculation logic of the network layer HTTP request failure rate is as follows: obtaining the number of failed HTTP requests and the total number of HTTP requests, and dividing the number of failed HTTP requests by the total number of HTTP requests to obtain the network layer HTTP request failure rate;

[0043] The calculation logic of the cache hit ratio is: obtaining the number of cache hits and the total number of cache accesses, and dividing the number of cache hits by the total number of cache accesses to obtain the cache hit ratio.

[0044] An APM-based full-link tracking system, including a probe placement module, a tracking module, a collection module, and a prediction management module;

[0045] Probe placement module: obtains information about the links in the entire link system and places probes at different links in the entire link system;

[0046] Tracking module: Input tracking requirements described in natural language into the AI model. The AI model converts the natural language description into code and generates a plug-in that is integrated into the matching path to start tracking the entire link.

[0047] Collection module: In the matching path, several probes are used to collect corresponding link data in real time, and the link data is processed by Pin-Point middleware and stored in the h-base database;

[0048] Prediction management module: After integrating data from several links through a big data model, it predicts whether there will be any abnormalities in the matching path of the entire link. When it is predicted that there will be abnormalities in the matching path of the entire link, the urgency of the abnormality is analyzed based on the prediction results, and corresponding management strategies are generated based on the urgency of the abnormality.

[0049] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0050] The present invention places probes in different links of the full-link system. The AI model converts natural language descriptions into code, generates a plug-in, and integrates it into the tracking system to start tracking the matching path in the full link. In the matching path, corresponding link data is collected in real time through a number of probes. After integrating the data of several links through the big data model, it is predicted whether the matching path of the full link will have an abnormality. When it is predicted that the matching path of the full link will have an abnormality, the urgency of the abnormality is analyzed according to the prediction result, and a corresponding management strategy is generated based on the urgency of the abnormality. The tracking system can inject the probe tool into the full-link system without modifying the existing business code and system architecture, collect information flow, reduce coupling with the business system, ensure the stability and rapid deployment of the system, and automatically select the appropriate notification method according to the urgency of the fault to ensure timely handling of emergency faults. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0052] Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0053] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0054] Example 1: Please refer to Figure 1 As shown, the full-link tracking method based on APM described in this embodiment includes the following steps:

[0055] The tracking system obtains the link information of the entire link system and places probes in different links of the entire link system. The probes will be placed in different links without modifying the actual business logic of these links, avoiding direct coupling with the system's business and technical implementation solutions, and achieving rapid docking without changing the original architecture and solutions. The tracking requirements are described in natural language and input into the AI model. The AI model converts the natural language description into code, generates a plug-in, and integrates it into the tracking system to start tracking the matching path in the entire link. In the matching path, the corresponding link data is collected in real time through several probes, and the data of several links are processed by the Pin-Point middleware and stored in the h-base database. After integrating the data of several links through the big data model, it is predicted whether there will be abnormalities in the matching path of the entire link. When it is predicted that there will be abnormalities in the matching path of the entire link, the urgency of the abnormality is analyzed according to the prediction results, and the corresponding management strategy is generated based on the urgency of the abnormality.

[0056] This application places probes in different links of the full-link system. The AI model converts natural language descriptions into code, generates a plug-in, and integrates it into the tracking system to start tracking the matching path in the full link. In the matching path, several probes collect corresponding link data in real time. After integrating several link data through the big data model, it predicts whether the matching path of the full link will have anomalies. When it is predicted that the matching path of the full link will have anomalies, the urgency of the anomaly is analyzed according to the prediction results, and a corresponding management strategy is generated based on the urgency of the anomaly. The tracking system can inject probe tools into the full-link system without modifying the existing business code and system architecture to collect information flow, reduce coupling with the business system, ensure system stability and rapid deployment, and automatically select the appropriate notification method according to the urgency of the fault to ensure timely handling of emergency faults.

[0057] Example 2: The tracking system obtains link information of the entire link system and places probes in different links of the entire link system. The probes are placed in different links without modifying the actual business logic of these links, avoiding direct coupling with the system's business and technical implementation solutions. Without changing the original architecture and solution, rapid docking is achieved, including the following steps:

[0058] Place probes at the API call entrance of the system to capture detailed information of all external requests, such as request time, parameters, response, etc. Place probes at the read and write operation locations of the database to monitor data query, update, insert and other operations. Place probes in the network communication layer to monitor network operations such as HTTP requests and TCP connections. Place probes in the read and write operations of the cache to track the cache hit rate and read and write efficiency.

[0059] Once the probes are deployed, they will collect relevant performance and business data in real time at each stage. The collected data may include:

[0060] Request processing time;

[0061] Error codes and exception conditions;

[0062] System response time;

[0063] Resource consumption (such as CPU and memory usage) The probe transmits the collected data to the centralized data processing platform through the network.

[0064] After data collection, it will be preprocessed, formatted into a parsable data structure (such as JSON, XML, etc.), and stored in the back-end database or log system.

[0065] The tracking requirements are described in natural language and then fed into the AI model. The AI model converts the natural language description into code, generates a plug-in, and integrates it into the tracking system to begin tracking matching paths throughout the entire link. This includes the following steps:

[0066] Users clearly express their tracking requirements through natural language descriptions. This may include the specific business links to be tracked, performance indicators to be monitored, fault warning requirements, etc. Description example:

[0067] “Track API request response times during the user payment process.”

[0068] “Monitor database queries for latency and errors.”

[0069] Using a well-trained AI model (such as a large-scale language model based on Prompt Engineering technology), the model automatically parses natural language input from users and converts it into standard code requirements. Based on existing business knowledge and monitoring logic, the model maps these descriptions to specific monitoring operations, including:

[0070] Type of monitoring metric (response time, error rate, etc.);

[0071] Where the probe needs to be placed (API entry, database operation, etc.);

[0072] The type of data to be collected and processed;

[0073] The AI model generates code that matches the tracking requirements and automatically packages it into system-usable plug-ins. These plug-ins are typically lightweight and non-invasive, allowing for rapid integration into existing systems. The specific process includes:

[0074] Generate monitoring probe code to collect specified monitoring indicators;

[0075] Set up a data transmission interface to send the collected data to the analysis platform;

[0076] Define the plug-in interface and configuration items for subsequent expansion and maintenance;

[0077] The generated plug-in will be integrated into the tracking system and placed in the matching path of the entire link. The plug-in will not affect the business logic and can be smoothly embedded in various links of the system, such as:

[0078] API entry, database layer, cache system, etc.

[0079] Network communication layer or user interaction interface;

[0080] Once the plug-in is deployed, the tracing system begins tracking and collecting data along the specified path throughout the entire process. Based on the initial natural language description, the plug-in collects matching performance data or error information and transmits it to the analysis engine in real time.

[0081] In the matching path, corresponding link data is collected in real time through several probes, including the following steps:

[0082] In this application, the full-link system is an information system;

[0083] First, analyze the business processes and technical architecture of the information system to determine the key paths that need to be monitored. These paths include:

[0084] API request processing flow;

[0085] Database query operations;

[0086] User operation behavior;

[0087] The calling process of third-party services matches the path that needs to be tracked according to business needs and marks each key link.

[0088] The probe collects corresponding link data in real time, including API interface anomaly index, database unauthorized operation frequency, network layer HTTP request failure rate and cache hit rate.

[0089] The calculation logic of the API interface anomaly index is as follows: obtain the number of error codes returned by the API interface of the entire link system and the total number of API calls, and then divide the number of error codes returned by the total number of API calls to obtain the API interface anomaly index.

[0090] The calculation logic for the frequency of unauthorized database operations is as follows: when a user logs into the database, the user's permission range is obtained. When the user operates in the database beyond the permission range, it is recorded. The frequency of unauthorized database operations is calculated by dividing the cumulative duration of the user's operations in the database beyond the permission range during the monitoring period by the monitoring duration.

[0091] The calculation logic of the network layer HTTP request failure rate is as follows: obtain the number of failed HTTP requests and the total number of HTTP requests, and divide the number of failed HTTP requests by the total number of HTTP requests to obtain the network layer HTTP request failure rate.

[0092] The calculation logic of the cache hit ratio is as follows: obtain the number of cache hits and the total number of cache accesses, and divide the number of cache hits by the total number of cache accesses to obtain the cache hit ratio.

[0093] The abnormal relationship between the API interface anomaly index and the full link matching path

[0094] An increase in the API interface anomaly index (i.e., an increase in the number of API call anomalies) usually means that the interface operation is unstable, which may cause the API call link in the full-link system to fail to execute smoothly.

[0095] If the API is a key node for multiple service interactions in the entire link, then the exception will interrupt or block the call of subsequent services, directly leading to exceptions in the entire link matching path.

[0096] A high anomaly index can cause partial or complete path matching failures in the entire link, thereby affecting the normal operation of the system and causing user requests to fail to be completed correctly.

[0097] Conclusion: The larger the API interface anomaly index, the higher the probability of anomalies in the full-link matching path.

[0098] The abnormal relationship between the frequency of database unauthorized operations and the full-link matching path

[0099] An increase in the frequency of database operations without permission indicates that more database operations are denied due to insufficient permissions. This usually indicates that there may be errors in the access control policy or improper permission configuration.

[0100] In a fully connected system, database operations are often a critical intermediate link. If unauthorized operations occur frequently, it will inevitably affect the normal execution of business logic, leading to path interruption or erroneous data transmission.

[0101] The higher the frequency of unauthorized operations, the more likely problems will occur in the database interaction link on the full-link matching path, resulting in the inability to complete the full link.

[0102] Conclusion: The higher the frequency of unauthorized database operations, the greater the risk of abnormalities in the full-link matching path.

[0103] The abnormal relationship between the network layer HTTP request failure rate and the full link matching path

[0104] An increase in the HTTP request failure rate indicates that the request in the network communication was unsuccessful (such as timeout, network connection problem, etc.). In a fully connected system, network layer requests are the basis for communication between services.

[0105] If the HTTP request failure rate at the network layer is too high, services in the system may not be able to interact correctly, data transmission may be blocked, and the entire link path may be interrupted or incomplete, which will directly affect the continuity of the service.

[0106] When the request failure rate is high, some nodes in the entire link may not be able to obtain the request results normally, further causing abnormal matching paths in the entire link.

[0107] Conclusion: The higher the failure rate of HTTP requests at the network layer, the higher the probability of abnormalities in the full-link matching path.

[0108] The abnormal relationship between cache hit rate and full-link matching path

[0109] A decrease in cache hit rate means that the system fails to obtain data from the cache in more cases and needs to re-obtain it from the database or other servers, resulting in slower system response speed.

[0110] In a full-link system, if the cache hit rate is low, nodes with high cache dependence will be affected, resulting in overall path response delays or even timeouts. This problem will be more obvious, especially when the system load is high.

[0111] A low cache hit rate may not directly lead to path exceptions, but it will increase the execution time of the entire link, affect the efficiency of the system, and indirectly increase the probability of exceptions.

[0112] Increases in the API interface anomaly index, the frequency of unauthorized database operations, and the failure rate of HTTP requests at the network layer will directly lead to interruptions or anomalies in the full-link matching path, affecting system stability.

[0113] The cache hit rate is closely related to the overall efficiency of the system. A decrease in the hit rate will increase the system response time and may cause exceptions.

[0114] The data from several links are processed by Pin-Point middleware and stored in the h-base database, including the following steps:

[0115] The collected data is passed by the probe to the Pin-Point middleware. Pin-Point middleware, as a data processing layer, is responsible for receiving and processing these log information. Pin-Point middleware formats the link data and unifies the data of different links into a standard format for subsequent storage and analysis.

[0116] Pin-Point is an open-source application performance management (APM) tool widely used in distributed systems. It's primarily used to monitor and diagnose performance issues in microservice architectures or distributed systems. It provides real-time performance analysis and in-depth call chain tracing by tracking the entire request lifecycle.

[0117] The formatted link data is structured and converted into data that conforms to the HBase storage format, including row keys and column families.

[0118] The row key may include information such as the link ID and timestamp, which is used to uniquely identify each link data.

[0119] Column families can contain different types of data, such as API exceptions, database operations, network requests, cache status, etc.

[0120] Storing data in HBase: The structured data is stored in the HBase database through the HBase API for subsequent query and analysis.

[0121] Data can be classified and stored by time series or links, making it easier to query data for a certain time period or link.

[0122] After integrating data from several links through a big data model, we predict whether there will be any anomalies in the matching path of the entire link, including the following steps:

[0123] The API interface anomaly index, the frequency of database unauthorized operations, the network layer HTTP request failure rate, and the cache hit rate are incorporated into the big data model. After integration, the big data model outputs a path coefficient for the matching path of the entire link. The path coefficient is compared with the preset first coefficient threshold and second coefficient threshold. The first coefficient threshold is used to predict whether the matching path will be abnormal, and the second coefficient threshold is used to predict the severity of the matching path anomaly.

[0124] If the path coefficient is less than or equal to the first coefficient threshold, the predicted matching path will not be abnormal; if the path coefficient is greater than the first coefficient threshold, the predicted matching path will be abnormal;

[0125] If the path coefficient is greater than the first coefficient threshold and the path coefficient is less than or equal to the second coefficient threshold, the predicted matching path will be slightly abnormal. If the path coefficient is greater than the second coefficient threshold, the predicted matching path will be seriously abnormal.

[0126] The function expression of the big data model is: ;

[0127] Where, is the path coefficient, The API interface abnormality index. The frequency of database unauthorized operations. is the HTTP request failure rate at the network layer, is the cache hit ratio, 、 、 、 They are the API interface anomaly index, database unauthorized operation frequency, network layer HTTP request failure rate, and cache hit rate proportional coefficients, and 、 、 、 Both are greater than 0.

[0128] When an anomaly is predicted for the matching path of the entire link, the urgency of the anomaly is analyzed based on the prediction result, and a corresponding management strategy is generated based on the urgency of the anomaly, including the following steps:

[0129] When the matching path is predicted to have a serious anomaly, the matching path is marked as high urgency; when the matching path is predicted to have a slight anomaly, the matching path is marked as medium urgency; when the matching path is predicted to have no anomaly, the matching path is marked as low urgency;

[0130] The following management is performed on high-urgency matching paths:

[0131] Immediate handling strategy: Immediately interrupt operations at the abnormal link and prioritize fault repair. This may involve triggering automated repair procedures or invoking backup systems to ensure continuous service operation.

[0132] Global notification: The operation and maintenance team is informed in real time through various notification methods (such as DingTalk, WeChat, and phone calls), and a global impact assessment is conducted.

[0133] System degradation strategy: During the fault repair process, the system may enter a degraded mode, shutting down non-core functions to ensure the normal operation of key businesses.

[0134] The following management is performed on matching paths of medium urgency:

[0135] Since a matching path with medium urgency may develop towards high urgency or low urgency during operation, this application needs to analyze the development trend of the matching path with medium urgency by combining the status of all matching paths in the entire link, as follows:

[0136] All the matching paths in the full link system are used to establish a path set, and the average path coefficient and the standard deviation of the path coefficient are calculated by combining all the matching paths in the path set.

[0137] The average path coefficient and the standard deviation of the path coefficient are calculated using the common mean and standard deviation calculation formulas, which will not be described in detail in this application.

[0138] The development trend of the matching path of medium urgency was analyzed based on the average path coefficient and the standard deviation of the path coefficient;

[0139] If the average path coefficient is less than or equal to the first coefficient threshold, and the path coefficient standard deviation is less than or equal to the standard deviation threshold, the matching path of medium urgency is analyzed to develop towards low urgency. At this time, the management method of the high urgency matching path is adopted to manage medium urgency;

[0140] If the average path coefficient is greater than the first coefficient threshold, the matching path of medium urgency is analyzed to develop towards high urgency, and the management method of high urgency matching path is adopted to manage medium urgency;

[0141] If the average path coefficient is less than or equal to the first coefficient threshold, and the path coefficient standard deviation is greater than the standard deviation threshold, it is analyzed that all matching paths in the full link system still have fluctuations. The management method is to increase the monitoring frequency of medium-urgency matching paths;

[0142] The following management is performed on low-urgency matching paths:

[0143] Continue to monitor low-urgency matching paths according to the pre-set monitoring strategy.

[0144] Example 3: The APM-based full-link tracking system described in this embodiment includes a probe placement module, a tracking module, a collection module, and a prediction management module;

[0145] Probe placement module: This module obtains information about the entire system and places probes at different points in the system. The probes are placed at different points without modifying the actual business logic of these points, thus avoiding direct coupling with the system's business and technical implementation solutions. This module enables rapid integration without changing the original architecture and solutions. The probe placement information is then sent to the acquisition module.

[0146] Tracking module: Inputs tracking requirements described in natural language into the AI model. The AI model converts the natural language description into code and generates a plug-in that is integrated into the matching path in the entire tracking link. The matching path is then sent to the collection module.

[0147] Collection module: In the matching path, several probes are used to collect corresponding link data in real time. After processing the link data through the Pin-Point middleware, the link data is stored in the h-base database and sent to the prediction management module.

[0148] Prediction management module: After integrating data from several links through a big data model, it predicts whether there will be any abnormalities in the matching path of the entire link. When it is predicted that there will be abnormalities in the matching path of the entire link, the urgency of the abnormality is analyzed based on the prediction results, and corresponding management strategies are generated based on the urgency of the abnormality.

[0149] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0150] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0151] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to specific embodiments. Obviously, many modifications and variations are possible based on the contents of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A full-link tracking method based on APM, characterized by: The tracking method comprises the following steps: The tracking system obtains information about each link in the entire system, places probes at different links, and describes tracking requirements in natural language before inputting them into the AI model. The AI model converts the natural language description into code, generates a plug-in, and integrates it into the tracking system to begin tracking matching paths in the entire system. In the matching path, corresponding link data is collected in real time through several probes, and the link data is processed by Pin-Point middleware and stored in the h-base database; By integrating data from several links through the big data model, the function expression of the big data model is: Where, is the path coefficient, The API interface abnormality index. The frequency of database unauthorized operations. is the HTTP request failure rate at the network layer, is the cache hit ratio, 、 、 、 is the proportionality coefficient, and 、 、 、 If both are greater than 0, it is predicted whether the matching path of the entire link will be abnormal. If the path coefficient is less than or equal to the first coefficient threshold, it is predicted that the matching path will not be abnormal. If the path coefficient is greater than the first coefficient threshold, it is predicted that the matching path will be abnormal. Obtain the number of error codes returned by the full-link system API interface and the total number of API calls. Divide the number of error codes returned by the total number of API calls to obtain the API interface exception index. If the path coefficient is greater than the first coefficient threshold and the path coefficient is less than or equal to the second coefficient threshold, it is predicted that the matching path will have a slight anomaly. If the path coefficient is greater than the second coefficient threshold, it is predicted that the matching path will have a serious anomaly. When the matching path of the entire link is predicted to have an anomaly, the urgency of the anomaly is analyzed based on the prediction result, and a corresponding management strategy is generated based on the urgency of the anomaly. The following management is performed on matching paths of medium urgency: The development trend of the matching path of medium urgency was analyzed based on the average path coefficient and the standard deviation of the path coefficient; If the average path coefficient is less than or equal to the first coefficient threshold, and the path coefficient standard deviation is less than or equal to the standard deviation threshold, the matching path of medium urgency is analyzed to develop towards low urgency. At this time, the management method of the low urgency matching path is adopted to manage medium urgency; If the average path coefficient is greater than the first coefficient threshold, the matching path of medium urgency is analyzed to develop towards high urgency, and the management method of high urgency matching path is adopted to manage medium urgency; If the average path coefficient is less than or equal to the first coefficient threshold and the path coefficient standard deviation is greater than the standard deviation threshold, analysis shows that all matching paths in the full link system still have fluctuations. The management method is to increase the monitoring frequency of medium-urgency matching paths.

2. The APM-based full-link tracking method according to claim 1, characterized in that: The tracking requirements are described in natural language and then fed into the AI model. The AI model converts the natural language description into code, generates a plug-in, and integrates it into the tracking system to begin tracking matching paths throughout the entire link. This includes the following steps: Users express their tracking requirements through natural language descriptions, including tracking business links, monitoring performance indicators, and fault warning requirements; The AI model automatically parses the natural language descriptions entered by users and converts them into code requirements. Based on existing business knowledge and monitoring logic, these natural language descriptions are mapped to monitoring operations. The AI model generates monitoring probe code to collect specified monitoring indicators, set up data transmission interfaces, and send the collected data to the analysis platform; The generated plug-in is integrated into the tracking system and placed in the matching path of the entire link. After the plug-in is deployed, the tracking system begins tracking and collecting data on the specified path in the entire link.

3. The APM-based full-link tracking method according to claim 2, characterized in that: The data from several links are processed by Pin-Point middleware and stored in the h-base database, including the following steps: The collected link data is passed by the probe to the Pin-Point middleware. The Pin-Point middleware serves as the data processing layer, which is used to receive and process the link data. The Pin-Point middleware formats the link data. Structuring the formatted link data and converting it into data that conforms to the HBase storage format, including row keys and column families; The row key includes the link ID and timestamp information, which is used to uniquely identify each link data; Column families contain data of different categories, such as API exceptions, database operations, network requests, and cache status; The structured data is stored in the HBase database through the HBase-API.

4. The APM-based full-link tracking method according to claim 3, characterized in that: When an anomaly is predicted in the matching path of the entire link, the urgency of the anomaly is analyzed based on the prediction result, and a corresponding management strategy is generated based on the urgency of the anomaly. The following steps are also included: When the matching path is predicted to have a serious anomaly, the matching path is marked as high urgency; when the matching path is predicted to have a slight anomaly, the matching path is marked as medium urgency; when the matching path is predicted to have no anomaly, the matching path is marked as low urgency; For high-urgency matching paths, the following management is performed: immediately interrupt the operation of the abnormal link and prioritize fault repair. During the fault repair process, enter degraded mode and shut down non-core functions; The following management is performed on the matching paths with low urgency: the matching paths with low urgency are continuously monitored according to the pre-set monitoring strategy.

5. The APM-based full-link tracking method according to claim 4, characterized in that: In the matching path, corresponding link data is collected in real time through several probes, including the following steps: The probe collects corresponding link data in real time, including API interface anomaly index, database unauthorized operation frequency, network layer HTTP request failure rate and cache hit rate.

6. The APM-based full-link tracking method according to claim 5, characterized in that: The calculation logic of the API interface abnormality index is as follows: obtain the number of error codes returned by the full-link system API interface and the total number of API calls, and divide the number of error codes returned by the total number of API calls to obtain the API interface abnormality index; The calculation logic of the frequency of unauthorized database operations is as follows: when a user logs into the database, the user's permission range is obtained, and when the user operates beyond the permission range in the database, it is recorded. The frequency of unauthorized database operations is obtained by dividing the cumulative duration of the user's operations beyond the permission range in the database during the monitoring period by the monitoring duration.

7. The APM-based full-link tracking method according to claim 6, characterized in that: The calculation logic of the network layer HTTP request failure rate is as follows: obtain the number of failed HTTP requests and the total number of HTTP requests, and divide the number of failed HTTP requests by the total number of HTTP requests to obtain the network layer HTTP request failure rate; The calculation logic of the cache hit ratio is: obtaining the number of cache hits and the total number of cache accesses, and dividing the number of cache hits by the total number of cache accesses to obtain the cache hit ratio.

8. An APM-based full-link tracking system, used to implement the tracking method according to any one of claims 1 to 7, characterized in that: It includes probe placement module, tracking module, acquisition module and prediction management module; Probe placement module: obtains information about the links in the entire link system and places probes at different links in the entire link system; Tracking module: Input tracking requirements described in natural language into the AI model. The AI model converts the natural language description into code and generates a plug-in that is integrated into the matching path to start tracking the entire link. Collection module: In the matching path, several probes are used to collect corresponding link data in real time, and the link data is processed by Pin-Point middleware and stored in the h-base database; Prediction management module: After integrating data from several links through a big data model, it predicts whether there will be any abnormalities in the matching path of the entire link. When it is predicted that there will be abnormalities in the matching path of the entire link, the urgency of the abnormality is analyzed based on the prediction results, and corresponding management strategies are generated based on the urgency of the abnormality.

Images