Fault root cause location method and device, storage medium and electronic device

Abstract

The present disclosure provides a method and device for locating the root cause of a fault, a storage medium and an electronic device, and relates to the field of communication technology. The method includes obtaining business data information; calculating the business data information according to a preset algorithm to determine a business status measurement value; when the business status measurement value indicates that the business is abnormal, obtaining alarm log information within a preset period; classifying and linking the alarm log information according to the preset alarm level and extracting the key alarm information, and storing the key alarm information in a first list; storing the key information of the business data information in a second list, performing correlation calculation on the first list and the second list, and determining the root cause information of the business data information. The present application can quickly and accurately find the root cause of the business fault by combining business status measurement, classification and linking, and correlation calculation, and solves the problem of untimely and inaccurate fault location in the network management system.

Description

Background Art

[0002] With the rapid development of 5G communication technology, 5G messaging platforms have become an important infrastructure for information transmission and communication in modern society. However, in actual operation, 5G messaging platforms face a variety of potential failure risks, including but not limited to network element failures, link failures, and business surges, which may have a serious impact on the normal operation of the platform, leading to business anomalies or even system crashes.

[0003] In related technologies, the network management system (NMS) is a key tool for monitoring and ensuring the stable operation of the platform. However, the NMS relies heavily on the experience and manual judgment of experts to identify and handle faults. This approach is not only inefficient, but also easily affected by human factors, resulting in inaccurate or delayed fault location, and it is difficult to locate the real cause of the fault in a timely and accurate manner from a large number of alarms. This lag not only prolongs the time for fault recovery, but may also further aggravate the deterioration of the business system, and even trigger a chain reaction, leading to the collapse of the entire business system.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a method and device for locating the root cause of a fault, a storage medium and an electronic device, which at least to a certain extent overcome the problem of untimely and inaccurate fault locating of a network management system in the related art.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a method for locating the root cause of a fault is provided, comprising: obtaining business data information; calculating the business data information according to a preset algorithm to determine a business status metric value; when the business status metric value indicates a business abnormality, obtaining alarm log information within a preset period; classifying and linking the alarm log information according to a preset alarm hierarchy and extracting key alarm information, and storing the key alarm information in a first list; storing the key information of the business data information in a second list, calculating the correlation between the first list and the second list, and determining the root cause information of the business data information.

[0008] In some embodiments, the business data information is calculated according to a preset algorithm to determine the business status measurement value, including: calculating the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year according to the business data information; determining the business status measurement value according to whether the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are respectively within a set threshold range.

[0009] In some embodiments, determining the business status measurement value based on whether the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month, and the business request number year-on-year are respectively within the set threshold range includes: when the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month, and the business request number year-on-year are all within the set threshold range, the business status measurement value is a first value, indicating that the business is normal; when the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month, and the business request number year-on-year are not all within the set threshold range, the business status measurement value is a second value, indicating that the business is abnormal.

[0010] In some embodiments, the alarm hierarchy includes: resource alarms, cloud alarms and business alarms, and the classifying and chaining of the alarm log information according to a preset alarm hierarchy and extracting alarm key information, and storing the alarm key information in the first list includes: classifying the alarm log information according to the resource alarms, the cloud alarms and the business alarms and establishing corresponding resource alarm chains, cloud alarm chains and business alarm chains; extracting alarm key information from the resource alarm chain, the cloud alarm chain and the business alarm chain to determine a class information matrix; calculating the overlap of each alarm key information according to the vector value in the class information matrix, removing duplicate alarms, and storing the deduplicated alarm key information in the first list.

[0011] In some embodiments, the method further includes: establishing associations among the resource alarms, the cloud alarms, and the service alarms based on the topological relationship between the cloud host and the physical host, the connection relationship between the service and the network element, and the ownership relationship between the network element and the host.

[0012] In some embodiments, the calculation of the correlation between the first list and the second list to determine the root cause information of the fault of the business data information includes: calculating the ratio of the intersection of the first list and the second list to the first list to determine the correlation, wherein a larger value of the calculated ratio indicates a higher correlation; determining the alarm key information in the first list with the highest correlation as the root cause information of the fault of the business data information.

[0013] According to another aspect of the present disclosure, a fault root cause locating device is also provided, including: a business data acquisition module, used to acquire business data information; a business status metric value determination module, used to calculate the business data information according to a preset algorithm to determine the business status metric value; an alarm log information acquisition module, used to acquire alarm log information within a preset period when the business status metric value indicates a business abnormality; a first list determination module, used to classify and link the alarm log information according to a preset alarm level and extract key alarm information, and store the key alarm information in a first list; a fault root cause determination module, used to store the key information of the business data information in a second list, calculate the correlation between the first list and the second list, and determine the fault root cause information of the business data information.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned root cause locating methods by executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for locating the root cause of a fault described above is implemented.

[0016] According to another aspect of the present disclosure, a computer program product is provided, including: a computer program or instructions, wherein when the computer program or instructions are executed by a processor, any one of the above-mentioned root cause location methods is implemented.

[0017] The method for locating the root cause of a fault provided in the embodiments of the present disclosure obtains business data information; calculates the business data information according to a preset algorithm to determine a business status measurement value; when the business status measurement value indicates a business abnormality, obtains alarm log information within a preset period; classifies and links the alarm log information according to a preset alarm hierarchy and extracts key alarm information, and stores the key alarm information in a first list; stores the key information of the business data information in a second list, calculates the correlation between the first list and the second list, and determines the root cause information of the business data information. The present application can quickly and accurately find the root cause of a business fault by combining business status measurement, classification and link building, and correlation calculation, thereby solving the problem of untimely and inaccurate fault location in the network management system.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0020] Figure 1 A schematic diagram showing a structure of a fault root cause location system in an embodiment of the present disclosure;

[0021] Figure 2 A flow chart of a method for locating the root cause of a fault in an embodiment of the present disclosure is shown;

[0022] Figure 3 A flowchart showing a specific example of a method for locating a root cause of a fault according to an embodiment of the present disclosure;

[0023] Figure 4 A flowchart showing another specific example of a method for locating a root cause of a fault according to an embodiment of the present disclosure;

[0024] Figure 5 A flowchart showing another specific example of a fault root cause location method flow in an embodiment of the present disclosure;

[0025] Figure 6 A schematic diagram of a fault root cause location device in an embodiment of the present disclosure is shown;

[0026] Figure 7 A structural block diagram of a computer device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0028] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0029] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0030] Figure 1 The following is a schematic diagram of an exemplary application system architecture to which the method in the embodiment of the present disclosure can be applied. Figure 1 As shown, the system architecture may include a terminal device 101 , a network 102 and a server 103 .

[0031] The network 102 is a medium for providing a communication link between the terminal device 101 and the server 103, and can be a wired network or a wireless network.

[0032] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocols. The network is typically the Internet, but may also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a private network or any combination of a virtual private network). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged over the network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec), etc. may be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies may also be used to replace or supplement the above data communication technologies.

[0033] The terminal device 101 can be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, smart speakers, smart watches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0034] Optionally, the client of the application installed in different terminal devices 101 is the same, or the client of the same type of application based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile client, a PC client, etc.

[0035] The server 103 may be a server that provides various services, such as a background management server that provides support for the device operated by the user using the terminal device 101. The background management server may analyze and process the received request and other data, and feed back the processing results to the terminal device.

[0036] Optionally, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0037] In one example of the present disclosure, a server is used to obtain business data information; calculate the business data information according to a preset algorithm to determine a business status measurement value; when the business status measurement value indicates a business abnormality, obtain alarm log information within a preset period; classify and link the alarm log information according to a preset alarm hierarchy and extract key alarm information, and store the key alarm information in a first list; store the key information of the business data information in a second list, calculate the correlation between the first list and the second list, and determine the root cause information of the business data information.

[0038] Those skilled in the art will know that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration, and any number of terminal devices, networks and servers may be provided according to actual needs, and the embodiments of the present disclosure do not limit this.

[0039] Under the above system architecture, a method for locating the root cause of a fault is provided in an embodiment of the present disclosure. The method can be executed by any electronic device with computing and processing capabilities.

[0040] In some embodiments, the method for locating the root cause of a fault provided in the embodiments of the present disclosure may be executed by a terminal device of the above-mentioned system architecture; in other embodiments, the method for locating the root cause of a fault provided in the embodiments of the present disclosure may be executed by a server in the above-mentioned system architecture; in other embodiments, the method for locating the root cause of a fault provided in the embodiments of the present disclosure may be implemented by a terminal device and a server in the above-mentioned system architecture through interaction.

[0041] Figure 2 A flow chart of a method for locating the root cause of a fault in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the fault root cause location method provided in the embodiment of the present disclosure includes the following steps:

[0042] S202, obtaining business data information.

[0043] It should be noted that the above-mentioned business data information may be data information related to a specific business, for example, the number of user requests and the number of successful registrations for each business.

[0044] In one example, the terminal initiates a service request to the 5G messaging platform. The service request mainly includes business scenarios such as user registration, message sending and receiving, account opening, configuration acquisition, file upload and download, SMS forwarding, mobile applications and platforms. The terminal monitors business indicators (equivalent to the above-mentioned business data information), including the number of user requests and the number of successful registrations for each business, which are collected every T period, where T can be a positive integer.

[0045] S204: Calculate the service data information according to a preset algorithm to determine a service status measurement value.

[0046] It should be noted that the above-mentioned preset algorithm can be a multi-factor analysis algorithm, such as principal component analysis, factor analysis, cluster analysis, discriminant analysis and structural equation model. The above-mentioned business status measurement value can be an indicator that can clearly and accurately reflect the business status, such as a Boolean value: true or false, where true is mapped to 1 (indicating normal business) and false is mapped to 0 (indicating abnormal business); the status code of the calculation result: when the calculation result exceeds a certain threshold, it is set to 1, otherwise it is 0.

[0047] S206: When the service status metric value indicates that the service is abnormal, alarm log information within a preset period is obtained.

[0048] It should be noted that the above alarm log information can be detailed information of the alarm occurrence. For example, the alarm log information may include any one or more of the following: the timestamp of the log time, the region to which it belongs, the node to which it belongs, the host IP, the network element name, the alarm cause, and the location information. By calculating the business data information through a preset algorithm, the business status metric value can be accurately determined, so as to timely discover business anomalies. When the business status metric value indicates a business anomaly, obtaining the alarm log information within a preset period can narrow the scope of troubleshooting and improve the accuracy of fault location.

[0049] S208, classify and link the alarm log information according to the preset alarm level, extract the alarm key information, and store the alarm key information in the first list.

[0050] It should be noted that the above classification may be to merge objects, data, information, etc. with common characteristics or attributes together to form a category or set. The above chaining may be to establish connections or chains between different categories or sets based on the classification. The above first list may be a data structure for storing the critical alarm information after screening and processing.

[0051] S210, storing key information of the business data information into a second list, calculating the correlation between the first list and the second list, and determining the fault root cause information of the business data information.

[0052] It should be noted that the above key information may be information that can directly reflect the characteristics and operating status of the service. For example, the key information may include any one or more of the following: network element, module, IP, etc. The above second list may be a data structure for storing key information of service data information. The above correlation calculation may be the degree of correlation or similarity between the two lists, which may be implemented by vector-based correlation calculation, set-based correlation calculation, statistics-based correlation calculation, and machine learning-based correlation calculation.

[0053] For example, when the calculated value of the correlation degree meets the preset condition, the critical alarm information in the first list calculated this time is determined as the fault root cause information of the service data information.

[0054] The present application can quickly and accurately find the root cause of a service failure by combining service status measurement, classification and chain building, and correlation calculation, thereby solving the problem of untimely and inaccurate fault location in the network management system.

[0055] In a specific example, Figure 3 As shown, in a method for locating the root cause of a fault in an embodiment of the present disclosure, the service data information is calculated according to a preset algorithm, and the service status metric value is determined, which includes the following steps, and the service status can be accurately evaluated:

[0056] S302, calculating the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month, and the business request number year-on-year respectively according to the business data information;

[0057] S304, determining a business status metric value according to whether the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month, and the business request number year-on-year are within a set threshold range.

[0058] In a specific example, the above-mentioned determination of the business status measurement value based on whether the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month, and the business request number year-on-year are respectively within the set threshold range includes: when the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month, and the business request number year-on-year are all within the set threshold range, the business status measurement value is the first value, indicating that the business is normal; when the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month, and the business request number year-on-year are not all within the set threshold range, the business status measurement value is the second value, indicating that the business is abnormal. By continuously monitoring the business status measurement value, problems in business operations can be discovered dynamically and in real time.

[0059] For example, each business is judged separately according to the multi-factor fault identification algorithm. Any business fault will trigger the root cause location analysis to achieve the association between faults and alarms. First, the success rate RSr is calculated, then the success rate SQoq and the success rate SYoy are calculated, and then the request number RQoq and the request number RYoy are calculated. Finally, the values ​​calculated above are substituted into the judgment formula for Z value judgment. If the Z value is 1, the output is: business is normal; if the Z value is 0, the alarm log of the corresponding period (which can be set to lock 4 time periods forward) is obtained. Among them, success rate RSr = number of successful services in the time period / total number of service requests in the time period; success rate month-on-month = service success rate of the current time period / service success rate of the previous time period; success rate year-on-year = service success rate of the current time period / service success rate of the same period of the previous day; number of requests month-on-month = total number of service requests in the current time period / total number of service requests in the previous time period; number of requests year-on-year = total number of service requests in the current time period / total number of service requests in the same period of the previous day; service status measurement value Z = (RSr>=down)&&(down<=SQoq<=up)&&(down<=SYoy<=up)&&(down<=RQoq<=up)&&(down<=RYoy<=up). Among them, the values ​​of down and up can be set according to actual needs, and && represents a logical AND operation.

[0060] In a specific example, Figure 4 As shown, in a method for locating the root cause of a fault in an embodiment of the present disclosure, the alarm levels include: resource alarms, cloud alarms, and business alarms. The alarm log information is classified and linked according to the preset alarm levels, and the key alarm information is extracted. The key alarm information is stored in the first list, which includes the following steps, which can not only improve the efficiency and quality of alarm processing, but also improve the timeliness and accuracy of alarm response:

[0061] S402, classifying the alarm log information according to resource alarms, cloud alarms and business alarms, and establishing corresponding resource alarm chains, cloud alarm chains and business alarm chains;

[0062] S404, extracting key alarm information from the resource alarm chain, the cloud alarm chain, and the business alarm chain to determine a class information matrix;

[0063] S406, calculating the overlap of each piece of key alarm information according to the vector value in the class information matrix, removing duplicate alarms, and storing the removed key alarm information in the first list.

[0064] In one example of the present disclosure, associations among resource alarms, cloud alarms, and service alarms are established based on the topological relationship between cloud hosts and physical hosts, the connection relationship between services and network elements, and the ownership relationship between network elements and hosts.

[0065] For example, alarms are divided into resource alarms, cloud alarms, and business alarms in terms of hierarchy. An inter-layer association model is established based on the topological relationship between cloud hosts and physical hosts, the connection relationship between services and network elements, and the belonging relationship between network elements and hosts; an intra-layer association model is established based on the network topology of each layer. Based on the alarm identification strategy, the alarms associated with the same resource alarm are classified into one category with resource alarms as labels to achieve chain building; if they cannot be associated with resource alarms, the alarms associated with the same cloud alarm are classified into the same category with cloud alarms as labels to achieve chain building; if they cannot be associated with cloud alarms, the business alarms are used as labels to build chains and identify the associated alarms as a cluster; for each cluster of alarms, key information (network element, IP, module, process name, cause, etc.) is extracted and stored in the class information matrix, and the overlap of each alarm key information is calculated based on the vector value in the class information matrix, duplicate alarms are removed, and the filtered alarm key information is stored in the first list. By classifying and linking alarms, we can find the relationship between different alarms and form an alarm matrix (alarm-alarm association), thereby achieving key information filtering and redundant alarm removal for alarms of the same category.

[0066] In a specific example, Figure 5 As shown, in a method for locating the root cause of a fault in an embodiment of the present disclosure, calculating the correlation between the first list and the second list, and determining the root cause information of the fault of the service data information includes the following steps, which can directly skip the alarm information that is not related to the fault, thereby improving the efficiency of locating the root cause of the fault:

[0067] S502, performing ratio calculation on the intersection of the first list and the second list and the first list to determine the degree of association, wherein a larger value of the ratio calculation indicates a higher degree of association;

[0068] S504: Determine the key alarm information in the first list with the highest correlation as the fault root cause information of the service data information.

[0069] For example, the key alarm information is stored in the first list L i Based on the network element transmission model of each business scenario, the key information (network element, module, IP, etc.) involved in each business is stored in the corresponding business information list S j (equivalent to the second list above), calculate the correlation value V of the compressed alarm according to the business. For example, if the abnormal indicator is a registration business, the alarm correlation calculation is performed based on the registration transmission model; the registration transmission model involves 12 modules, and the module information and the corresponding network element and IP of the module are stored in the business information list S j , take the proportion of data in each category of information list in the business information list to calculate the correlation, and realize the association between alarm and business. According to the above chain building calculation, the alarm information of the category with the highest V value is cut out and output, which is the root cause location information. Among them, the V value is calculated by the following formula (1):

[0070] (1)

[0071] Among them, the larger the V value, the higher the relevance to the business.

[0072] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations, and various types of data such as personal identity data, operation data, behavioral data, etc. related to individuals, customers, and groups obtained in the embodiments of this disclosure have all been authorized.

[0073] Based on the same inventive concept, the present disclosure also provides a fault root cause location device, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0074] Figure 6 A schematic diagram of a fault root cause location device in an embodiment of the present disclosure is shown. Figure 6 As shown, the device includes: a service data acquisition module 61, a service status metric value determination module 62, an alarm log information acquisition module 63, a first list determination module 64, and a fault root cause determination module 65.

[0075] The business data acquisition module 61 is used to acquire business data information.

[0076] The service status metric value determination module 62 is used to calculate the service data information according to a preset algorithm to determine the service status metric value.

[0077] The alarm log information acquisition module 63 is used to acquire the alarm log information within a preset period when the service status metric value indicates that the service is abnormal.

[0078] The first list determination module 64 is used to classify and link the alarm log information according to the preset alarm level and extract the alarm key information, and store the alarm key information in the first list.

[0079] The fault root cause determination module 65 is used to store key information of the service data information into the second list, calculate the correlation between the first list and the second list, and determine the fault root cause information of the service data information.

[0080] In one example of the present disclosure, the above-mentioned business status measurement value determination module 62 is also used to: calculate the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year according to the business data information; determine the business status measurement value according to whether the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are respectively within the set threshold range.

[0081] In one example of the present disclosure, the above-mentioned business status measurement value determination module 62 is also used for: when the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are all within the set threshold range, the business status measurement value is true, indicating that the business is normal; when the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are not all within the set threshold range, the business status measurement value is false, indicating that the business is abnormal.

[0082] In one example of the present disclosure, the alarm hierarchy in the above-mentioned fault root cause locating device includes: resource alarms, cloud alarms and business alarms, and the first list determination module 64 is also used to: classify the alarm log information according to resource alarms, cloud alarms and business alarms, and then establish corresponding resource alarm chains, cloud alarm chains and business alarm chains; extract alarm key information from the resource alarm chain, cloud alarm chain and business alarm chain, and determine the class information matrix; calculate the overlap of each alarm key information according to the vector value in the class information matrix, remove duplicate alarms, and store the deduplicated alarm key information into the first list.

[0083] In one example of the present disclosure, the first list determination module 64 is also used to establish associations between resource alarms, cloud alarms, and service alarms based on the topological relationship between the cloud host and the physical host, the connection relationship between the service and the network element, and the ownership relationship between the network element and the host.

[0084] In one example of the present disclosure, the above-mentioned fault root cause determination module 65 is also used to: perform a proportional calculation on the intersection of the first list and the second list with the first list to determine the correlation, wherein a larger value of the proportional calculation indicates a higher correlation; and determine the alarm key information in the first list with the highest correlation as the fault root cause information of the business data information.

[0085] It should be noted that the examples and application scenarios implemented by the modules in the above-mentioned device embodiment are the same as those of the corresponding steps in the method embodiment, but are not limited to the contents disclosed in the above-mentioned method embodiment. It should be noted that the above-mentioned modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0086] Those skilled in the art will appreciate that various aspects of the present disclosure may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0087] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present disclosure, the electronic device comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned root cause location methods of the fault by executing the executable instructions. Since the principle of solving the problem in the electronic device embodiment is similar to that in the above-mentioned method embodiment, the implementation of the electronic device embodiment can refer to the implementation of the above-mentioned method embodiment, and the repeated parts will not be repeated.

[0088] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present disclosure is described. Figure 7 The electronic device 700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0089] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0090] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 executes the steps described in the above “exemplary method” section of this specification according to various exemplary embodiments of the present disclosure.

[0091] For example, the processing unit 710 can execute the following steps of the above-mentioned method embodiment: obtaining business data information; calculating the business data information according to a preset algorithm to determine the business status measurement value; when the business status measurement value indicates a business abnormality, obtaining the alarm log information within a preset period; classifying and linking the alarm log information according to the preset alarm level and extracting the key alarm information, and storing the key alarm information in a first list; storing the key information of the business data information in a second list, calculating the correlation between the first list and the second list, and determining the root cause information of the fault of the business data information.

[0092] For example, the processing unit 710 can execute the following steps of the above-mentioned method embodiment: calculate the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year according to the business data information; determine the business status measurement value according to whether the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are within the set threshold range.

[0093] For example, the processing unit 710 can execute the following steps of the above-mentioned method embodiment: when the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are all within the set threshold range, the business status measurement value is a first value, indicating that the business is normal; when the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are not all within the set threshold range, the business status measurement value is a second value, indicating that the business is abnormal.

[0094] For example, the processing unit 710 can execute the following steps of the above-mentioned method embodiment: classify the alarm log information according to resource alarms, cloud alarms and business alarms, and then establish corresponding resource alarm chains, cloud alarm chains and business alarm chains; extract alarm key information from the resource alarm chain, cloud alarm chain and business alarm chain, and determine the class information matrix; calculate the overlap of each alarm key information according to the vector value in the class information matrix, remove duplicate alarms, and store the deduplicated alarm key information into the first list.

[0095] For example, the processing unit 710 can execute the following steps of the above method embodiment: establish associations between resource alarms, cloud alarms and service alarms based on the topological relationship between the cloud host and the physical host, the connection relationship between the service and the network element, and the relationship between the network element and the host.

[0096] For example, the processing unit 710 can execute the following steps of the above-mentioned method embodiment: perform a proportional calculation on the intersection of the first list and the second list and the first list to determine the correlation, wherein a larger value of the proportional calculation indicates a higher correlation; and determine the alarm key information in the first list with the highest correlation as the root cause information of the fault of the business data information.

[0097] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 7201 and / or a cache memory unit 7202 , and may further include a read-only memory unit (ROM) 7203 .

[0098] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0099] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0100] The electronic device 700 may also communicate with one or more external devices 740 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication may be performed through an input / output (I / O) interface 750. In addition, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 through a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0101] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0102] Based on the same inventive concept, a computer-readable storage medium is also provided in the embodiment of the present disclosure, on which a computer program is stored, and when the computer program is executed by a processor, any of the above-mentioned root cause location methods of the fault is implemented. Since the principle of solving the problem in the embodiment of the computer-readable storage medium is similar to that in the above-mentioned method embodiment, the implementation of the embodiment of the computer-readable storage medium can refer to the implementation of the above-mentioned method embodiment, and the repeated parts will not be repeated.

[0103] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0104] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0105] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0106] In specific implementation, the program code for performing the operation of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0107] Based on the same inventive concept, a computer program product is also provided in an embodiment of the present disclosure, including a computer program product, including: a computer program or an instruction, wherein when the computer program or the instruction is executed by a processor, the fault root cause location method of any one of the above method embodiments is implemented. Since the principle of solving the problem in the computer program product embodiment is similar to that in the above method embodiment, the implementation of the computer program product embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0108] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0109] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0110] Through the description of the above implementation modes, it is easy for those skilled in the art to understand that the example implementation modes described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation mode of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation mode of the present disclosure.

[0111] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for locating the root cause of a fault, characterized in that: include: Obtain business data information; Calculating the service data information according to a preset algorithm to determine a service status measurement value; When the service status metric value indicates that the service is abnormal, obtaining alarm log information within a preset period; Classifying and linking the alarm log information according to a preset alarm level and extracting key alarm information, and storing the key alarm information in a first list; The key information of the business data information is stored in a second list, and a correlation degree is calculated between the first list and the second list to determine the fault root cause information of the business data information.

2. The method for locating the root cause of a fault according to claim 1, characterized in that: The calculating the service data information according to a preset algorithm to determine the service status metric value includes: According to the business data information, respectively calculate the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year; The business status metric value is determined according to whether the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are respectively within a set threshold range.

3. The method for locating the root cause of a fault according to claim 2, characterized in that: The determining of the service status metric value according to whether the service success rate, the service success rate month-on-month, the service success rate year-on-year, the service request number month-on-month, and the service request number year-on-year are respectively within a set threshold range includes: When the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are all within the set threshold range, the business status measurement value is the first value, indicating that the business is normal; When the business success rate, the business success rate month-on-month, the business success rate year-on-year, the business request number month-on-month and the business request number year-on-year are not all within the set threshold range, the business status measurement value is the second value, indicating that the business is abnormal.

4. The fault root cause location method according to claim 1, characterized in that: The alarm levels include: resource alarms, cloud alarms and business alarms, and the step of classifying and linking the alarm log information according to the preset alarm levels and extracting key alarm information, and storing the key alarm information in the first list includes: Classify the alarm log information according to the resource alarm, the cloud alarm and the business alarm, and establish corresponding resource alarm chains, cloud alarm chains and business alarm chains; Extracting key alarm information from the resource alarm chain, the cloud alarm chain, and the business alarm chain to determine a class information matrix; The overlap degree of each alarm key information is calculated according to the vector value in the class information matrix, duplicate alarms are removed, and the removed duplicate alarm key information is stored in the first list.

5. The method for locating the root cause of a fault according to claim 4, characterized in that: The method further comprises: According to the topological relationship between the cloud host and the physical host, the connection relationship between the service and the network element, and the ownership relationship between the network element and the host, an association is established between the resource alarm, the cloud alarm and the service alarm.

6. The fault root cause location method according to any one of claims 1 to 5, characterized in that: The calculating the correlation between the first list and the second list to determine the fault root cause information of the service data information includes: Performing a ratio calculation on the intersection of the first list and the second list and the first list to determine the degree of association, wherein a larger value of the ratio calculation indicates a higher degree of association; The key alarm information in the first list with the highest correlation is determined as the fault root cause information of the service data information.

7. A fault root cause location device, characterized in that: include: Business data acquisition module, used to acquire business data information; A service status measurement value determination module, used to calculate the service data information according to a preset algorithm to determine the service status measurement value; An alarm log information acquisition module is used to acquire alarm log information within a preset period when the business status metric value indicates a business abnormality; A first list determination module is used to classify and link the alarm log information according to a preset alarm level and extract key alarm information, and store the key alarm information in a first list; The fault root cause determination module is used to store the key information of the business data information into a second list, calculate the correlation between the first list and the second list, and determine the fault root cause information of the business data information.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the fault root cause locating method according to any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the fault root cause locating method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, the fault root cause locating method described in any one of claims 1 to 6 is implemented.

Images