Information system fault root cause positioning method and device

Abstract

The invention discloses a fault root cause positioning method and device for an information system, relates to the technical field of computers, and mainly aims to uniformly warn hidden dangers and faults of operation of the information system in a heterogeneous environment in real time, ensure the timeliness of fault root cause positioning of the information system and improve the service full-link operation and maintenance level of the information system. According to the main technical scheme, when a target service is executed, a transaction path of the target service is obtained; judging whether the service nodes contained in the transaction path are fault nodes or not by using fault positioning logic, the fault positioning logic being used for representing processing logic for positioning the fault nodes based on alarm performance indexes of the service nodes, and the alarm performance indexes being determined according to associated transaction records of transaction services based on identity tags in a heterogeneous environment; and if yes, determining a fault cause corresponding to the fault node, and generating alarm information based on the fault node and the fault cause corresponding to the fault node. The method is used for fault root cause positioning of the information system.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for locating the root cause of an information system failure. Background Art

[0002] With the development of network informatization, information technology has penetrated into various business links of power production, and IT information systems have become the most important data carrier and information source. With the rapid development of various power generation businesses, the scale of information systems supporting the operation of power-related businesses has become increasingly large, and the transaction processes of various businesses are complex. When hidden dangers and failures occur in operation, it is difficult to quickly locate them, and it is difficult to quickly judge the impact of information system failures on the business.

[0003] At present, in the existing technology, the root cause location of information system failures for power-related business operations is generally that the operation and maintenance personnel connect the alarms, logs and other information when the failure occurs through understanding the software architecture and call relationships, and then use the operation and maintenance knowledge and experience to investigate and deduce the root cause of the failure to locate the root cause of the failure. However, manual deduction cannot provide real-time alarms for hidden dangers and failures in the operation of the information system, and is not applicable to the heterogeneous environment within the information system, resulting in poor timeliness in locating the root cause of the information system failure, which in turn affects the full-link operation and maintenance level of the information system business. Summary of the invention

[0004] In view of the above problems, the present application provides a method and device for locating the root cause of information system faults. The main purpose is to uniformly issue real-time alarms for hidden dangers and faults running in a heterogeneous environment of the information system, ensure the timeliness of locating the root cause of the information system faults, and thereby improve the full-link operation and maintenance level of the information system's business.

[0005] In order to solve the above technical problems, this application proposes the following solutions:

[0006] In a first aspect, the present application provides a method for locating the root cause of an information system failure, the method comprising:

[0007] When executing a target business, obtaining a transaction path of the target business;

[0008] Determine whether the service node included in the transaction path is a faulty node by using fault location logic, wherein the fault location logic is used to characterize the processing logic for locating the faulty node based on the alarm performance index of each of the service nodes, and the alarm performance index is determined based on the associated transaction record of the transaction business based on the identity tag in the heterogeneous environment;

[0009] If so, determine the fault cause corresponding to the faulty node, and generate alarm information based on the faulty node and the fault cause corresponding to the faulty node.

[0010] In a second aspect, the present application provides a device for locating the root cause of an information system failure, the device comprising:

[0011] An acquisition unit, used to acquire a transaction path of a target business when executing the target business;

[0012] a judgment unit, configured to judge whether the service node included in the transaction path obtained by the acquisition unit is a faulty node by using a fault location logic, wherein the fault location logic is used to characterize a processing logic for locating the faulty node based on an alarm performance indicator of each of the service nodes, wherein the alarm performance indicator is determined based on an associated transaction record of a transaction-related business based on an identity tag in a heterogeneous environment;

[0013] The processing unit is configured to determine a fault cause corresponding to the fault node if the judgment unit determines that the service node included in the transaction path is a fault node, and generate alarm information based on the fault node and the fault cause corresponding to the fault node.

[0014] In order to achieve the above-mentioned purpose, according to the third aspect of the present application, a storage medium is provided, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the information system fault root cause locating method of the first aspect mentioned above.

[0015] In order to achieve the above-mentioned purpose, according to a fourth aspect of the present application, a processor is provided, wherein the processor is used to run a program, wherein when the program is run, the method for locating the root cause of an information system fault of the first aspect is executed.

[0016] By means of the above technical scheme, the present application provides a method and device for locating the root cause of an information system fault. When it is necessary to locate the root cause of an information system fault, first, when executing the target business, the transaction path of the target business is obtained, and then the information system fault root cause location logic is used to determine whether the service node included in the transaction path is a faulty node. The information system fault root cause location logic is used to characterize the processing logic for locating the faulty node based on the alarm performance indicators of each service node. The alarm performance indicators are determined based on the associated transaction records of transaction-type businesses based on identity tags in a heterogeneous environment. Finally, if so, the fault cause corresponding to the faulty node is determined, and alarm information is generated based on the faulty node and the fault cause corresponding to the faulty node. Through the technical solution provided by the present application, during the business execution process, the faulty node can be quickly located based on the triggering of the alarm performance indicators determined by the associated transaction records of the transaction-type business in the heterogeneous environment by each service node in the transaction path, and alarm information can be generated based on the faulty node and the fault cause corresponding to the faulty node, so as to uniformly issue real-time alarms for hidden dangers and faults running in the heterogeneous environment of the information system, that is, to achieve unified operation and maintenance of the heterogeneous environment of the information system, ensure the timeliness of locating the root cause of the fault of the information system, and thereby improve the full-link operation and maintenance level of the information system business.

[0017] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0019] Figure 1 A flow chart of a method for locating the root cause of an information system fault provided by an embodiment of the present application is shown;

[0020] Figure 2 A flow chart of another method for locating the root cause of an information system fault provided by an embodiment of the present application is shown;

[0021] Figure 3 A block diagram showing a device for locating the root cause of an information system fault provided by an embodiment of the present application is shown;

[0022] Figure 4 A block diagram showing the composition of another device for locating the root cause of an information system fault provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0023] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0024] At present, in the prior art, the root cause location of information system faults for power-related business operations is generally that the operation and maintenance personnel connect the alarms, logs and other information when the fault occurs through the understanding of the software architecture and call relationship, and then apply the operation and maintenance knowledge and experience to investigate and deduce the root cause of the fault to achieve the location of the root cause of the fault. However, manual deduction cannot provide real-time alarms for hidden dangers and faults in the operation of the information system, and is not applicable to the heterogeneous environment within the information system, resulting in poor timeliness in locating the root cause of the fault of the information system, thereby affecting the full-link operation and maintenance level of the information system. This application is based on the triggering of the alarm performance indicator determined by the associated transaction records of the transaction-related business in the heterogeneous environment by each service node in the transaction path to quickly locate the fault node, and generate alarm information based on the fault node and the fault cause corresponding to the fault node, so as to achieve unified real-time alarms for hidden dangers and faults running in the heterogeneous environment of the information system, that is, to achieve unified operation and maintenance of the heterogeneous environment of the information system, to ensure the timeliness of locating the root cause of the fault of the information system, and thus improve the full-link operation and maintenance level of the information system.

[0025] The embodiment of the present application provides a method for locating the root cause of an information system fault. The method can uniformly issue real-time alarms for hidden dangers and faults running in a heterogeneous environment of the information system, thereby ensuring the timeliness of locating the root cause of the information system fault, thereby improving the full-link operation and maintenance level of the information system. The specific execution steps are as follows: Figure 1 As shown, including:

[0026] 101. When executing the target business, obtain the transaction path of the target business.

[0027] It should be noted that, in this embodiment, the corresponding information system is the electric power information system, and the corresponding target business is specifically any one of the transaction-type businesses included in the electric power information system, such as inquiry, payment, etc. Because in actual applications, a transaction-type business requires layer-by-layer delivery and processing between service nodes of multiple levels, the transaction paths of different transaction-type businesses can be determined through this step-by-step forward service dependency relationship, thereby determining the transaction path of the target business.

[0028] 102. Use the fault location logic to determine whether the service node included in the transaction path is a faulty node.

[0029] Among them, the fault location logic is used to characterize the processing logic of locating the faulty node based on the alarm performance indicators of each service node. The alarm performance indicators are determined based on the associated transaction records of the transaction-type services in the heterogeneous environment based on the identity tags. It should be noted that in this embodiment, since the same service node may contain heterogeneous environments such as containers, cloud environments, and physical environments in the power information system, it is difficult for the same service node to associate its corresponding transaction data when executing different transaction-type services. Therefore, in order to realize transaction association in a heterogeneous environment, open up various links of the transaction-type services to facilitate subsequent unified operation and maintenance, specifically, the relevant data packets of the transaction-type services corresponding to each service node can be obtained first, and then the relevant data packets can be decoded using the preset business transmission protocol in the heterogeneous environment to obtain the original transaction records, and then the original transaction records corresponding to each service node can be decoded according to the identity tags. The transaction records are associated and processed to obtain the associated transaction records corresponding to each service node, wherein the preset business transmission protocol is deployed based on different operating environments, and the identity tag can be configured based on the five-tuple ID corresponding to different data packets, or can be configured according to the serial number of the transaction. This embodiment does not limit this. After obtaining the associated transaction records of transaction-related services under heterogeneous environments based on identity tags, the performance of each service node when executing transaction-related services can be determined, that is, alarm performance indicators are set, including but not limited to response rate, success rate, response time, transaction volume, etc. Specifically, the associated transactions within a specified period can be selected. The records are used to calculate the mean, and the superimposed threshold is customized based on the mean according to the operation and maintenance knowledge and experience. After the setting is completed, the service node can be monitored in real time to see whether it triggers the alarm performance indicator during the execution of the target business. The corresponding fault location logic is essentially the processing logic of locating the faulty node that actually causes the fault in the service nodes included in the transaction path through the alarm situation generated by the aforementioned triggering alarm performance indicator. It includes multiple specified category sub-logics, which are determined by the transaction characteristics between each service node in the actual situation. For example, the transaction volume corresponding to the service nodes included in the same transaction path is consistent, and the service nodes included in the same transaction path are different. The response time corresponding to the point is usually that the previous node is greater than the next node and other characteristics. Therefore, multiple types of specified category sub-logics can be configured based on the transaction characteristics, including points but not limited to pre-post type, post-previous type and single type, and then positioned according to the corresponding alarm situation. Specifically, after obtaining the alarm performance indicators corresponding to each service node, it can be determined based on the request and response of the service node during the transaction process whether the service node triggers at least one alarm performance indicator, and the service node that triggers at least one alarm performance indicator is regarded as a suspicious node, and the faulty node is determined according to the specified category sub-logic that the alarm situation corresponding to the suspicious node contained in the transaction path meets.Due to the access calls of various service nodes in the transaction path, not only may the failure of the previous service node cause the failure of the next service node or the failure of the next service node cause the failure of the previous service node, but there may also be a situation where only a service node fails. Therefore, the faulty node can be accurately located by determining the alarm situation generated by the alarm performance indicators of the suspicious nodes included in the transaction path.

[0030] Exemplarily, assume that the transaction path of the target transaction includes three service nodes A / B / C, and the execution order is from left to right. Taking the transaction volume as an example, usually, the transaction volumes of the three service nodes are consistent. If the transaction volume of node A is 1000, the transaction volume of node B is 800, and the transaction volume of node C is 800, it means that the decrease in the transaction volume of node C is caused by the decrease in the transaction volume of node B, then it can be determined that node B is a faulty node. If the transaction volume of node A is 1000, the transaction volume of node B is 1000, and the transaction volume of node C is 1000, then it means that node C is the faulty node.

[0031] 103. Determine a fault cause corresponding to the faulty node, and generate alarm information based on the faulty node and the fault cause corresponding to the faulty node.

[0032] It should be noted that in this embodiment, since the faulty node has been determined, in order to facilitate the analysis of the factors causing the fault of the faulty node, the fault cause corresponding to the faulty node can be determined. Specifically, the basic performance index and alarm performance index of the faulty node can be obtained, and the two can be used as influencing factors. The contribution of each influencing factor to the cause of the faulty node is iteratively calculated through an influence algorithm, and the cause of the fault is determined by ranking the cause contribution. For example, the top 5 or top 3 can be selected. This embodiment does not limit this. After determining the cause of the fault, an alarm message can be generated based on the faulty node and the fault cause corresponding to the faulty node. The alarm message can be notified to the operation and maintenance personnel through text messages, emails, etc., so as to provide real-time warnings for hidden dangers and faults in system operation, thereby improving the full-link operation and maintenance level of the information system.

[0033] Based on the above Figure 1It can be seen from the implementation method that the present application provides a method for locating the root cause of an information system fault. When it is necessary to locate the root cause of an information system fault, first, when executing the target business, the transaction path of the target business is obtained, and then the information system root cause location logic is used to determine whether the service node included in the transaction path is a faulty node. The information system root cause location logic is used to characterize the processing logic of locating the faulty node based on the alarm performance indicators of each service node. The alarm performance indicators are determined based on the associated transaction records of transaction-type businesses based on identity tags in a heterogeneous environment. Finally, if yes, the fault cause corresponding to the faulty node is determined, and alarm information is generated based on the faulty node and the fault cause corresponding to the faulty node. Through the technical solution provided by the present application, during the business execution process, the faulty node can be quickly located based on the triggering of the alarm performance indicators determined by the associated transaction records of the transaction-type business in the heterogeneous environment by each service node in the transaction path, and alarm information can be generated based on the faulty node and the fault cause corresponding to the faulty node, so as to uniformly issue real-time alarms for hidden dangers and faults running in the heterogeneous environment of the information system, that is, to achieve unified operation and maintenance of the heterogeneous environment of the information system, ensure the timeliness of locating the root cause of the fault of the information system, and thereby improve the full-link operation and maintenance level of the information system business.

[0034] Further, the preferred embodiment of the present application is in the above Figure 1 Based on this, a detailed description of the process of locating the root cause of information system failures is given. The specific steps are as follows: Figure 2 As shown, including:

[0035] 201. When executing a target business, obtain a transaction path of the target business.

[0036] This step is combined with the description of step 101 in the above method, and the same contents are not repeated here.

[0037] 202. Calculate the alarm performance indicator corresponding to each service node in the transaction path.

[0038] This step is combined with the description of step 102 in the above method, and the same content is not repeated here. It should be noted that the specific execution process for calculating the alarm performance index corresponding to each service node is: obtaining the associated transaction records of the transaction-type business corresponding to each service node in a heterogeneous environment; calculating the alarm performance index corresponding to each service node based on the associated transaction records within the specified period. Among them, the associated transaction record is the account data associated through the identity tag, and the account data includes complete account flow data and account change data. The integrity of the associated transaction record is guaranteed by the account flow data and account change data. The specified period can be 1 month, three months, etc. This embodiment does not limit this, and can be customized according to the actual situation. Through the automatic update of the specified period, it is ensured that the alarm performance index is more in line with the actual situation within the current period, thereby improving the accuracy of the alarm performance index triggered by the subsequent service node.

[0039] Furthermore, the specific execution process for obtaining the associated transaction records of the transaction-type business corresponding to each service node in a heterogeneous environment is: obtaining the relevant data packets of the transaction-type business corresponding to each service node; decoding the relevant data packets using the preset business transmission protocol in the heterogeneous environment to obtain the original transaction records; and associating the original transaction records corresponding to each service node according to the identity tags to obtain the associated transaction records corresponding to each service node. Among them, the relevant data packets are specifically data packets corresponding to transaction-type services, and their sources may be various heterogeneous environments such as containers, cloud environments, and physical environments. After being obtained, they may be stripped and screened to remove invalid data, and then decoded through a preset business transmission protocol corresponding to the heterogeneous environment to obtain the original transaction record, that is, to generate an unassociated readable original record, and then assign a distribution ID number to each record according to the five-tuple (source IP address, source port, destination IP address, destination port, and transport layer protocol) of the data packet, or directly use the serial number as the ID, that is, the identity tag, so as to perform association processing on the original transaction records corresponding to each service node, and obtain the associated transaction records corresponding to each service node. In the association processing process, the original transaction records may be filtered according to the actual transaction requirements, and the required transaction fields may be retained. Each original transaction record may be associated with one-to-one or one-to-many transactions according to information such as the ID number or the serial number, and the associated transaction record may be generated in combination with the filtered fields and the association results.

[0040] 203. Determine whether the service node triggers at least one alarm performance indicator based on the request and response of the service node during the transaction process.

[0041] It should be noted that, in the present embodiment, the alarm performance indicators include at least response rate, success rate, response time and transaction volume, which are all indicators for measuring the execution performance of each service node during the execution of the target business, and are all determined by the request and response between two adjacent service nodes during the transaction process. Therefore, it is possible to judge whether the service node triggers at least one alarm performance indicator through the request and response of the service node during the transaction process to determine the triggering status of the alarm performance indicator by the service node. If so, execute the subsequent step 204; if not, wait for the execution of the next target business.

[0042] 204. The service node that triggers at least one alarm performance indicator is regarded as a suspicious node, and the fault node is determined according to the specified category sub-logic that the alarm conditions corresponding to the suspicious nodes included in the transaction path meet.

[0043] It should be noted that, in actual situations, in a transaction path, due to the requests and responses of the service nodes during the transaction process, the front and rear service nodes may affect each other. That is to say, there may be two service nodes in a transaction path that are both suspicious nodes, or there may be a service node that is a suspicious node alone. Therefore, the service nodes that trigger at least one alarm performance indicator can all be regarded as suspicious nodes. Then, from the perspective of the entire transaction path, the alarm situation generated by the alarm performance indicator triggered by the suspicious node is considered to meet which specified category sub-logic. Since the specified category sub-logic is determined by the transaction characteristics between the various service nodes in actual situations, for example, the transaction corresponding to the service nodes included in the same transaction path The response time of the service nodes included in the same transaction path is usually greater than that of the previous node. Therefore, multiple types of designated category sub-logics can be configured based on the transaction characteristics, including but not limited to the pre-post type, post-pre type, and single type, and then located according to the corresponding alarm situation. Specifically, the logical type of the designated category sub-logic that meets the alarm situation corresponding to the suspicious node included in the transaction path can be determined; when the logical type is the post-pre type, the next suspicious node in the transaction path is determined to be a faulty node; when the logical type is the pre-post type, the previous suspicious node in the transaction path is determined to be a faulty node; when the logical type is the single type, the suspicious node is determined to be a faulty node. Among them, the front and back in this step are determined according to the execution order of each service node in the transaction path. By determining the designated category sub-logic that meets the requirements, when locating the faulty node, the snapshot fault scenario can be realized and the fault occurrence logic can be reproduced, so that the operation and maintenance personnel can provide corresponding solutions.

[0044] 205. The basic performance index and the alarm performance index corresponding to the faulty node are used as influencing factors.

[0045] It should be noted that in this step, the influencing factor is used to characterize the factors that can affect the failure of the faulty node. Therefore, the basic performance indicators and alarm performance indicators can be used as influencing factors. The performance indicators include but are not limited to success rate, response rate, network retransmission rate to the server, network retransmission rate to the client, connection success rate, response time, server ACK delay, client ACK delay, network delay to the server, network delay to the client, client zero window, server zero window, disconnection time, number of concurrent connections, transaction volume, etc. Among them, the success rate, response rate, response time, and transaction volume are alarm performance indicators, and the rest are basic performance indicators.

[0046] 206. Based on the influence algorithm, the influence factors are iteratively converged to obtain the causal contribution of each influence factor.

[0047] It should be noted that in this step, the influence algorithm is an iterative convergence algorithm used to characterize the correlation of influencing factors. The causal contribution between the influencing factors is determined by iteratively calculating the correlation coefficients of the influencing factors. For example, when the alarm performance indicator corresponding to the trigger response time is triggered, the performance indicator with a high correlation with the response time within a period of time can be calculated. These highly correlated performance indicators are likely to be the root cause of the failure. Specifically, a deep neural network for determining the correlation of influencing factors can be trained in advance based on the influence algorithm. Based on the task system classification structure of the deep neural network, the influencing factors of the faulty node are used as the input of the deep neural network model. The fault features are extracted through deep mining of multiple hidden layers of the network, thereby obtaining the causal contribution of each influencing factor, that is, the degree of contribution to the failure of the faulty node under a specific dimension.

[0048] 207. Determine the target impact factor based on the ranking results of the causal contribution of each impact factor.

[0049] It should be noted that in this step, the target influencing factor is one or more influencing factors that rank high after each influencing factor is sorted based on the causal contribution, and the selected number can be determined according to the specified number, or a contribution threshold can be set and determined by comparing the result with the contribution threshold. This embodiment does not limit this.

[0050] 208. Use the target impact factor as the fault cause corresponding to the fault node, and generate alarm information based on the fault node and the fault cause corresponding to the fault node.

[0051] This step is combined with the description of step 103 in the above method, and only the target influencing factor determined in step 207 is used as the cause of the fault, and the same contents are not repeated here.

[0052] Furthermore, as a response to the above Figure 1-2The implementation of the method embodiment shown in the figure, the embodiment of the present application provides a device for locating the root cause of information system faults, which is used to uniformly issue real-time alarms for hidden dangers and faults running in a heterogeneous environment of the information system, to ensure the timeliness of locating the root cause of the information system faults, and thus improve the full-link operation and maintenance level of the information system business. The embodiment of the device corresponds to the aforementioned method embodiment. For ease of reading, this embodiment will no longer repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Specifically, Figure 3 As shown, the device comprises:

[0053] The acquisition unit 31 is used to acquire the transaction path of the target business when executing the target business;

[0054] A judgment unit 32 is used to judge whether the service node included in the transaction path obtained by the acquisition unit 31 is a faulty node by using a fault location logic, wherein the fault location logic is used to characterize a processing logic for locating the faulty node based on an alarm performance indicator of each of the service nodes, wherein the alarm performance indicator is determined based on an associated transaction record of a transaction-related business based on an identity tag in a heterogeneous environment;

[0055] The processing unit 33 is configured to determine the fault cause corresponding to the fault node if the judging unit 32 judges whether the service node included in the transaction path is a fault node, and generate alarm information based on the fault node and the fault cause corresponding to the fault node.

[0056] Further, such as Figure 4 As shown, the fault location logic includes a plurality of designated category sub-logics; the judgment unit 32 includes:

[0057] A calculation module 321, configured to calculate the alarm performance indicator corresponding to each of the service nodes in the transaction path;

[0058] A judgment module 322, configured to judge whether the service node triggers at least one of the alarm performance indicators obtained by the calculation module 321 based on the request and response of the service node during the transaction process;

[0059] The processing module 323 is used to determine the service node that triggers at least one of the alarm performance indicators as a suspicious node if the judgment module 322 determines whether the service node triggers at least one of the alarm performance indicators, and determine the faulty node according to the specified category sub-logic that the alarm situation corresponding to the suspicious node contained in the transaction path complies with.

[0060] Further, such as Figure 4 As shown, the processing module 323 includes:

[0061] The first determination submodule 3231 is used to determine the logic type of the specified category sub-logic that meets the requirements according to the alarm situation corresponding to the suspicious node included in the transaction path;

[0062] A first processing submodule 3232 is configured to determine that the next suspicious node in the transaction path is the faulty node when the logic type obtained by the first determining submodule 3231 is a post-previous type;

[0063] A second processing submodule 3233 is configured to determine that the previous suspicious node in the transaction path is the faulty node when the logic type obtained by the first determining submodule 3231 is a pre-post type;

[0064] The third processing submodule 3234 is used to determine that the suspicious node is the faulty node when the logic type obtained by the first determining submodule 3231 is a single-location type.

[0065] Further, such as Figure 4 As shown, the calculation module 321 includes:

[0066] The acquisition submodule 3211 is used to acquire the associated transaction records of the transaction-related businesses in the heterogeneous environment corresponding to each of the service nodes;

[0067] The first calculation submodule 3212 is used to calculate the alarm performance indicator corresponding to each of the service nodes based on the associated transaction records obtained by the acquisition submodule 3211 within a specified period.

[0068] Further, such as Figure 4 As shown, the acquisition submodule 3211 is specifically used for:

[0069] Obtaining data packets related to transaction services corresponding to each of the service nodes;

[0070] Decoding the relevant data packets using a business transmission protocol preset in the heterogeneous environment to obtain original transaction records;

[0071] The original transaction records corresponding to each of the service nodes are associated with each other according to the identity tag to obtain the associated transaction records corresponding to each of the service nodes.

[0072] Further, such as Figure 4 As shown, the processing unit 33 includes:

[0073] A second determination submodule 331 is configured to use the basic performance indicator corresponding to the faulty node and the alarm performance indicator as influencing factors;

[0074] A second calculation submodule 332 is used to perform iterative convergence calculation on the impact factors obtained by the second determination submodule 331 based on an impact degree algorithm to obtain a causal contribution degree of each of the impact factors;

[0075] A third determination submodule 333 is used to determine a target impact factor according to the ranking result of the causal contribution of each of the impact factors obtained by the second calculation submodule 332;

[0076] The fourth processing submodule 334 is configured to use the target impact factor obtained by the third determining submodule 333 as the fault cause corresponding to the fault node, and generate alarm information based on the fault node and the fault cause corresponding to the fault node.

[0077] Further, such as Figure 4 As shown,

[0078] The alarm performance indicators include at least response rate, success rate, response time and transaction volume.

[0079] Furthermore, an embodiment of the present application further provides a storage medium, wherein the storage medium is used to store a computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the above Figure 1-2 The method for locating the root cause of information system failure described in .

[0080] Furthermore, the embodiment of the present application also provides a processor, the processor is used to run a program, wherein the program executes the above Figure 1-2 The method for locating the root cause of information system failure described in .

[0081] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0082] It is understandable that the related features in the above methods and devices can be referenced to each other. In addition, the "first", "second" and the like in the above embodiments are used to distinguish the embodiments, but do not represent the advantages and disadvantages of the embodiments.

[0083] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0084] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the application is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the application described herein, and the description of the specific language above is for the purpose of disclosing the best mode of implementation of the application.

[0085] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0086] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0087] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0088] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0089] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0090] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0091] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0092] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0093] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0094] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0095] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for locating the root cause of an information system failure, characterized in that: The method comprises: When executing a target business, obtaining a transaction path of the target business; Determine whether the service node included in the transaction path is a faulty node by using fault location logic, wherein the fault location logic is used to characterize the processing logic for locating the faulty node based on the alarm performance index of each of the service nodes, and the alarm performance index is determined based on the associated transaction record of the transaction business based on the identity tag in the heterogeneous environment; If so, determine the fault cause corresponding to the faulty node, and generate alarm information based on the faulty node and the fault cause corresponding to the faulty node.

2. The method according to claim 1, characterized in that The fault location logic includes a plurality of designated category sub-logics; The using fault location logic to determine whether the service node included in the transaction path is a fault node includes: Calculating the alarm performance indicator corresponding to each of the service nodes in the transaction path; Determining whether the service node triggers at least one of the alarm performance indicators based on the request and response of the service node during the transaction process; If so, the service node that triggers at least one of the alarm performance indicators is regarded as a suspicious node, and the faulty node is determined according to the specified category sub-logic that the alarm situation corresponding to the suspicious node contained in the transaction path meets.

3. The method according to claim 2, characterized in that The determining the faulty node according to the specified category sub-logic that the alarm situation corresponding to the suspicious node included in the transaction path meets includes: Determine the logic type of the specified category sub-logic that matches the alarm situation corresponding to the suspicious node included in the transaction path; When the logic type is a post-first type, determining the next suspicious node in the transaction path as the faulty node; When the logic type is a pre-post type, determining the previous suspicious node in the transaction path as the fault node; When the logic type is a single-location type, the suspicious node is determined to be the faulty node.

4. The method according to claim 2, characterized in that: The calculating the alarm performance indicator corresponding to each of the service nodes in the transaction path includes: Obtaining associated transaction records of transaction-related businesses in a heterogeneous environment corresponding to each of the service nodes; The alarm performance indicator corresponding to each of the service nodes is calculated based on the associated transaction records within a specified period.

5. The method according to claim 4, characterized in that The obtaining of associated transaction records of transaction services corresponding to each of the service nodes in a heterogeneous environment includes: Obtaining data packets related to transaction services corresponding to each of the service nodes; Decoding the relevant data packets using a business transmission protocol preset in the heterogeneous environment to obtain original transaction records; The original transaction records corresponding to each of the service nodes are associated with each other according to the identity tag to obtain the associated transaction records corresponding to each of the service nodes.

6. The method according to claim 1, characterized in that The determining the fault cause corresponding to the fault node, and generating alarm information based on the fault node and the fault cause corresponding to the fault node, includes: Taking the basic performance index corresponding to the faulty node and the alarm performance index as influencing factors; Performing iterative convergence calculation on the impact factors based on the impact algorithm to obtain the causal contribution of each of the impact factors; Determine the target impact factor according to the ranking result of the causal contribution of each of the impact factors; The target impact factor is used as the fault cause corresponding to the fault node, and alarm information is generated based on the fault node and the fault cause corresponding to the fault node.

7. The method according to any one of claims 1 to 6, characterized in that: The alarm performance indicators include at least response rate, success rate, response time and transaction volume.

8. A device for locating the root cause of an information system failure, characterized in that: The device comprises: An acquisition unit, used to acquire a transaction path of a target business when executing the target business; a judgment unit, configured to judge whether the service node included in the transaction path obtained by the acquisition unit is a faulty node by using a fault location logic, wherein the fault location logic is used to characterize a processing logic for locating the faulty node based on an alarm performance indicator of each of the service nodes, wherein the alarm performance indicator is determined based on an associated transaction record of a transaction-related business based on an identity tag in a heterogeneous environment; The processing unit is configured to determine a fault cause corresponding to the fault node if the judgment unit determines that the service node included in the transaction path is a fault node, and generate alarm information based on the fault node and the fault cause corresponding to the fault node.

9. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the method for locating the root cause of an information system fault according to any one of claims 1 to 7.

10. A processor, characterized in that: The processor is used to run a program, wherein the program, when running, executes the information system fault root cause locating method according to any one of claims 1 to 7.

Images