Abnormality analysis method and system, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides an exception analysis method and system, electronic equipment, a storage medium and a program product, and relates to the technical field of computers.The method comprises the steps that performance data of software to be analyzed during running on computing equipment is obtained; calling a performance exception detection program of the computing device, the performance exception detection program being an executable program which compiles a performance exception detection rule and loads the compiled performance exception detection rule in a memory of the computing device and being used for analyzing whether the to-be-analyzed software has performance exception according to the performance data and the performance exception detection rule; and obtaining an analysis result of the performance anomaly detection program on the to-be-analyzed software. In the technical scheme of the embodiment of the invention, the performance anomaly detection rule is compiled into the performance anomaly detection program which can be directly executed by the processor, so that the anomaly analysis efficiency of the to-be-analyzed software is remarkably improved, and the real-time requirement of anomaly analysis is met.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an abnormality analysis method, system, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] In order to ensure that software such as applications or operating systems can run stably and efficiently, it is essential to perform performance analysis or continuous performance analysis on the software. When performing performance analysis on software, it is usually necessary to collect key performance indicators during the software operation, such as the CPU usage, memory usage, and function call frequency. By analyzing these key performance indicators, performance bottlenecks in the software operation process can be discovered in a timely manner, and corresponding optimization measures can be taken.

[0003] In some application scenarios, such as distributed computing systems or time series computing tasks that require real-time processing, the real-time requirements for performance analysis are high. In these scenarios, it is necessary to be able to perform performance analysis quickly and efficiently in order to quickly respond to and solve performance problems. Therefore, a technical solution is urgently needed to quickly and efficiently identify performance anomalies during software operation. Summary of the invention

[0004] Embodiments of the present application provide an anomaly analysis method, system, electronic device, computer-readable storage medium, and computer program product to alleviate or solve one or more technical problems existing in the prior art.

[0005] In a first aspect, an embodiment of the present application provides an anomaly analysis method, the method comprising: obtaining performance data of the software to be analyzed when it is running on a computing device; calling a performance anomaly detection program of the computing device, wherein the performance anomaly detection program is an executable program that compiles performance anomaly detection rules and loads them into the memory of the computing device, and is used to analyze whether the software to be analyzed has performance anomalies based on the performance data and the performance anomaly detection rules; and obtaining the analysis results of the software to be analyzed by the performance anomaly detection program.

[0006] In a second aspect, an embodiment of the present application provides an exception analysis system, the system comprising an exception handling device and at least one computing device; the exception handling device is used to send performance anomaly detection rules to each of the computing devices; the computing device is used to compile the received performance anomaly detection rules and load the compiled performance anomaly detection program into a memory; and is also used to obtain performance data of the software to be analyzed during runtime, call the performance anomaly detection program, the performance anomaly detection program is used to analyze whether the software to be analyzed has performance anomalies based on the performance data and the performance anomaly detection rules; the computing device is also used to obtain the analysis results of the performance anomaly detection program on the software to be analyzed.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory, and the processor implements any method of the embodiment of the present application when executing the computer program.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method of any one of the embodiments of the present application is implemented.

[0009] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements any method of the embodiments of the present application when executed by a processor.

[0010] The technical solution provided by the embodiment of the present application is that a performance anomaly detection program is loaded in the memory of the computing device. The performance anomaly detection program is an executable program obtained by compiling the performance detection rules. When the performance data of the software to be analyzed when it is running on the computing device is obtained, by calling and running the performance anomaly detection program of the computing device, it is possible to analyze whether the software to be analyzed has performance anomalies according to the above performance data and the performance anomaly detection rules. In the embodiment of the present application, since the performance anomaly detection program is a local machine code obtained after compilation, the performance anomaly detection program can be directly executed by the processor, which significantly improves the execution efficiency of the program, thereby improving the efficiency of abnormal analysis of the software to be analyzed, and meeting the requirements for real-time abnormal analysis in some scenarios.

[0011] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments according to the present application and should not be regarded as limiting the scope of the present application.

[0013] Figure 1 A schematic diagram of an application scenario of the abnormality analysis method provided in an embodiment of the present application is shown; Figure 2 One of the flow charts of the abnormality analysis method provided in the embodiment of the present application is shown; Figure 3 The second flowchart of the abnormality analysis method provided in the embodiment of the present application is shown; Figure 4 A schematic diagram of the system structure of an abnormality analysis system provided in an embodiment of the present application is shown; Figure 5 A block diagram of an electronic device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0014] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the concept or scope of the present application. Therefore, the drawings and descriptions are considered to be exemplary in nature and not restrictive.

[0015] To facilitate understanding of the technical solutions of the embodiments of the present application, the following describes the related technologies of the embodiments of the present application. The following related technologies can be combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0016] The following terms will be used in the following text: Just-In-Time (JIT) technology: It is a program optimization method. The core idea is to dynamically compile intermediate code (such as bytecode) into local machine code when the program is running.

[0017] Performance analysis: is a method of evaluating and optimizing software performance, the purpose of which is to identify bottlenecks and inefficient parts in the program so that they can be optimized to improve the overall performance of the system.

[0018] Operating system: It is the core software in the computer system responsible for managing and controlling computer hardware and software resources. It provides an interface between users and computer hardware, and rationally organizes and schedules the computer's workflow so that all hardware and software resources of the computer system can be used efficiently and in a coordinated manner.

[0019] Continuous performance analysis: is the process of continuously collecting performance data from applications running in a live production environment, with the goal of optimizing the performance of these applications and improving resource utilization efficiency. Unlike traditional performance analysis methods, continuous performance analysis can capture various indicators in real time, providing a more accurate and timely view of application performance and behavior.

[0020] Generally, in order to ensure the stable operation of software such as operating systems or applications installed on computing devices, it is necessary to perform performance analysis or continuous performance analysis on the software. When performing performance analysis on software on computing devices, it is usually necessary to collect key performance indicators during the software operation, such as CPU usage, memory usage, and function call frequency. By analyzing these key performance indicators, performance bottlenecks in the software operation process can be discovered in a timely manner, and corresponding optimization measures can be taken. In some application scenarios, such as distributed computing systems or time series computing tasks that require real-time processing, the real-time requirements for performance analysis are high. In these scenarios, it is necessary to be able to perform performance analysis quickly and efficiently in order to quickly respond to and solve performance problems. Therefore, there is an urgent need for a technical solution that can quickly and efficiently identify performance anomalies during software operation.

[0021] There are also some technologies for software performance analysis in related technologies. For example, some performance analysis platforms have the functions of collecting, storing and querying performance data, as well as providing performance monitoring and analysis. These platforms can support multiple programming languages, such as Python or Java, etc. They integrate lightweight probes to collect performance data during program runtime and upload it to the server for display, providing developers with intuitive flame graphs, performance overviews and other visualization graphics to facilitate rapid identification of software performance bottlenecks. Although these performance analysis platforms provide a one-stop performance data visualization platform, they do not have the ability to process the acquired performance data in real time to quickly identify performance anomalies, that is, they cannot meet the real-time requirements for performance analysis in scenarios such as distributed computing systems or time series computing tasks.

[0022] In view of this, an embodiment of the present application provides an anomaly analysis method for performing performance analysis on software running on a computing device. In the embodiment of the present application, the performance anomaly detection rules are compiled into executable codes that can be directly executed by a processor and loaded into the memory of the computing device, which significantly improves the execution efficiency of the program, thereby improving the efficiency of anomaly analysis of the software to be analyzed, and meeting the requirements for real-time anomaly analysis in some scenarios.

[0023] In order to facilitate the understanding of the embodiments of the present application, the application scenario of the abnormality analysis method provided in the embodiments of the present application is first briefly described. Figure 1The following is a schematic diagram showing an application scenario of the abnormality analysis method provided in the embodiment of the present application. Figure 1 As shown, the application scenario includes an exception handling device 110 and at least one computing device 120, and data communication is performed between the exception handling device 110 and the at least one computing device 120. Among them, at least one computing device 120 is a computing node for performing service processing in a distributed computing system, and the exception handling device 110 can be an exception handling node for performing abnormal transaction processing in a distributed computing system. The specific manifestations of the exception handling device 110 and the computing device 120 can be a server, etc.

[0024] In one embodiment, the performance anomaly detection rule is generated by the exception handling device 110, and the performance anomaly detection rule is used to perform an anomaly analysis on the software running on the computing device 120. The exception handling device 110 sends the generated performance anomaly detection rule to each computing device 120 in the distributed computing system. After receiving the performance anomaly detection rule sent by the exception handling device 110, each computing device 120 compiles the performance anomaly detection rule to obtain a performance anomaly detection program and loads it into the memory of the computing device 120, wherein the compiled performance anomaly detection program is an executable program. For any computing device 120, when it runs the software to be analyzed, it obtains the performance data of the software to be analyzed during operation, and calls the performance anomaly detection program stored in the memory, and detects the above performance data through the performance anomaly detection program to analyze whether the software to be analyzed has performance anomalies.

[0025] It should be noted that the above application scenarios or application examples provided in the embodiments of the present application are for ease of understanding, and the embodiments of the present application do not specifically limit the application of the technical solution. In addition, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0026] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0027] Figure 2 A flowchart of an abnormality analysis method provided in an embodiment of the present application is shown. Figure 2 The method shown can be applied to Figure 1 The computing device 120 in the application scenario shown, i.e. Figure 2 The execution subject of the method shown may be the computing device 120. Figure 2 As shown, the method may include step S201, step S202 and step S203.

[0028] Step S201: Obtain performance data of the software to be analyzed when it is running on a computing device.

[0029] Step S202: calling a performance anomaly detection program of a computing device, wherein the performance anomaly detection program is an executable program that compiles performance anomaly detection rules and loads them into the memory of the computing device, and is used to analyze whether the software to be analyzed has performance anomalies based on the above performance data and performance anomaly detection rules.

[0030] Step S203: Obtain the analysis result of the performance anomaly detection program on the software to be analyzed.

[0031] The software to be analyzed may be an application program running on a computing device, or an operating system running on a computing device, or the software to be analyzed may include both an application program running on a computing device and an operating system running on a computing device.

[0032] Exemplarily, the above performance data may include CPU utilization, memory usage, input / output (I / O) times, function call frequency, etc., which can be used to perform performance analysis on the software to be analyzed. When implementing this solution, corresponding performance data can be obtained according to actual needs. Here, several possible performance data are only listed as examples, and it is not a limitation of this application solution.

[0033] In addition, it should be noted that in the above step S201, the trigger condition for obtaining the performance data of the software to be analyzed may be the startup of the software to be analyzed. For example, after detecting that the software to be analyzed is started, the operation of obtaining its performance data during runtime is performed. Among them, in the above step S201, the performance data of the software to be analyzed during runtime may be obtained in real time, or the performance data of the software to be analyzed during runtime may be obtained periodically, or the performance data of the software to be analyzed during runtime may be obtained in response to a data acquisition instruction. During implementation, the trigger condition for obtaining the performance data of the software to be analyzed and the method for obtaining the performance data may be set according to actual needs. Here, only several possible implementation methods are listed as examples, which is not a limitation to the present application scheme.

[0034] In one implementation, the performance data of the software to be analyzed may be obtained from the performance log of the software to be analyzed.

[0035] In an embodiment of the present application, after the performance data of the software to be analyzed when running on a computing device is obtained, a performance anomaly detection program is called from the memory of the computing device to perform performance detection on the software to be analyzed based on the obtained performance data through the performance anomaly detection program, and to analyze whether there is performance anomaly in the software to be analyzed.

[0036] The above-mentioned performance anomaly detection program is an executable program obtained by compiling the performance anomaly detection rules. Exemplarily, the above-mentioned performance anomaly detection program is obtained by JIT compiling the performance anomaly detection rules.

[0037] It should be noted that, in the embodiment of the present application, the memory used to store the performance anomaly detection program can be a random access memory (RAM) or a read-only memory (ROM). Of course, it can also be other types, which will not be described one by one here.

[0038] In one embodiment, the above-mentioned performance anomaly detection rules can be generated by a computing device based on historical performance data of the software to be analyzed, or can be generated by other devices, such as an anomaly handling device, based on historical performance data of the software to be analyzed and sent to the computing device.

[0039] In the embodiment of the present application, after the performance anomaly detection rule is called, whether the software to be analyzed has performance anomalies is analyzed by using the performance anomaly detection rule and the acquired performance data of the software to be analyzed.

[0040] The analysis result of the software to be analyzed may be that the software to be analyzed has performance anomalies or that the software to be analyzed does not have performance anomalies; or, in one embodiment, if the software to be analyzed has performance anomalies, the above analysis result may also include the performance anomaly problem of the software to be analyzed. Exemplarily, the above analysis result may be that the software to be analyzed has a performance problem of abnormal resource allocation, or the above analysis result may also be that the software to be analyzed has a performance problem of memory fragmentation. Of course, the content included in the above analysis result is only explained here by way of example, and it is not a limitation on the performance problem of the software to be analyzed.

[0041] The method provided in the embodiment of the present application is that a performance anomaly detection program is loaded in the memory of the computing device, and the performance anomaly detection program is an executable program obtained by compiling the performance detection rules. When the performance data of the software to be analyzed when running on the computing device is obtained, the performance anomaly detection program of the computing device is called. By running the performance anomaly detection program, it is possible to analyze whether the software to be analyzed has performance anomalies based on the above performance data and the performance anomaly detection rules. In the embodiment of the present application, since the performance anomaly detection program is a local machine code obtained after compilation, the performance anomaly detection program can be directly executed by the processor, which significantly improves the execution efficiency of the program, thereby improving the efficiency of abnormal analysis of the software to be analyzed, and meeting the requirements for real-time abnormal analysis in some scenarios.

[0042] Generally, different performance issues are determined by testing different performance indicators. For a performance issue, it can be detected by testing one performance indicator or multiple performance indicators. Therefore, for different performance issues, there are different performance indicator detection sub-rules, and the performance indicator detection sub-rules can be generated based on one performance indicator or multiple performance indicators.

[0043] Therefore, in one embodiment, the above-mentioned performance anomaly detection rules may include performance indicator detection sub-rules corresponding to multiple performance problems. For this situation, the above-mentioned performance anomaly detection program is specifically used to: calculate the performance indicator value corresponding to the above-mentioned performance data; detect the above-mentioned performance indicator value based on the above-mentioned performance indicator detection sub-rules to determine whether the software to be analyzed has performance problems corresponding to the above-mentioned performance indicators.

[0044] The above performance issues refer to problems that may affect the efficiency, speed and stability of the software to be analyzed during its operation. For example, the performance issues may be uneven resource allocation or memory fragmentation.

[0045] In one embodiment, the above-mentioned performance anomaly detection rule may include multiple detection sub-rules, and one performance problem corresponds to one detection sub-rule. For example, the above-mentioned performance anomaly detection rule may include performance problem 1 and its corresponding performance indicator detection sub-rule 1, performance problem 2 and its corresponding performance indicator detection sub-rule 2, and performance problem 3 and its corresponding performance indicator detection sub-rule 3.

[0046] Furthermore, it is considered that a performance problem may be detected by only one performance indicator, or may require detection of multiple performance indicators. Therefore, in one embodiment, for any performance problem, the corresponding performance indicator detection sub-rule may be generated by one performance indicator, or may be composed of multiple performance indicators. For example, continuing with the above example, performance indicator detection sub-rule 1 may be generated by performance indicator 1, or may be composed of performance indicator 1 and performance indicator 2.

[0047] In an embodiment of the present application, after obtaining the performance data of the software to be analyzed when it is running on the computing device, the corresponding performance index value is calculated based on the specific data content of the performance data. Among them, different calculation methods may correspond to different performance data. For example, the average value of each data in the performance data may be used as the performance index value, or the data distribution of each data in the performance data may be used as the performance index value, or the deviation value of each data in the performance data from the baseline value may be used as the performance index value. Here, several possible calculation methods of the performance index value are only listed by way of example, and are not a limitation to the embodiments of the present application.

[0048] In one embodiment, the performance data of the software to be analyzed obtained in the above step S201 may be one type of performance data or multiple types of performance data. If multiple types of performance data of the software to be analyzed are obtained, then for each type of performance data, the performance indicator value corresponding to the performance data is calculated. That is, one type of performance data corresponds to one performance indicator value. In this case, when the software to be analyzed is subjected to performance anomaly detection, each performance indicator value is detected separately to determine whether the software to be analyzed has corresponding performance problems.

[0049] For example, in one embodiment, the performance data of the software to be analyzed acquired in the above step S201 includes performance data 1, performance data 2, and performance data 3, wherein performance data 1, performance data 2, and performance data 3 are respectively performance data of different categories. Then, when calculating the performance index values ​​corresponding to the performance data, the performance index value 1 corresponding to the performance data 1, the performance index value 2 corresponding to the performance data 2, and the performance index value 3 corresponding to the performance data 3 are calculated respectively, and the calculation methods corresponding to the performance index values ​​1, 2, and 3 can be determined by the categories of the performance data to which they correspond.

[0050] In an embodiment of the present application, after calculating the performance indicator value corresponding to the performance data of the software to be analyzed, the above performance indicator value is detected based on the performance indicator detection sub-rule in the performance anomaly detection rule to determine whether the software to be analyzed has a performance problem corresponding to the performance indicator.

[0051] There may be multiple implementations for detecting the above performance indicator value based on the performance indicator detection sub-rule. For example, in one implementation, after obtaining the performance indicator value corresponding to the performance data, it may be first determined in the performance anomaly detection rule that there is a target performance indicator detection sub-rule for the performance indicator corresponding to the above performance indicator value, and then the above performance indicator value may be detected based on the target performance indicator detection sub-rule. If the performance indicator value meets the target performance indicator detection sub-rule, it is determined that the software to be analyzed has a performance problem corresponding to the performance indicator detection sub-rule.

[0052] Alternatively, in another embodiment, after obtaining the performance indicator value corresponding to the performance data, the above performance indicator value is detected based on each performance indicator detection sub-rule respectively. If the performance indicator value is consistent with any one of the performance indicator detection sub-rules, it is determined that the software to be analyzed has the performance problem corresponding to the performance indicator detection sub-rule.

[0053] In an embodiment of the present application, by setting performance indicator detection sub-rules corresponding to multiple performance problems in the above-mentioned performance anomaly detection rules, the above-mentioned performance anomaly detection program can perform anomaly analysis of various performance problems, thereby improving the comprehensiveness of the anomaly analysis of the software to be analyzed, and being able to adapt to the needs of various different performance analyses, with higher flexibility.

[0054] In one embodiment, the above-mentioned performance problem may be a resource allocation abnormality problem. For this type of performance abnormality, the above-mentioned performance anomaly detection program is specifically used to: calculate the deviation between the CPU utilization of each CPU core and a benchmark value based on the above-mentioned performance data, and in response to a CPU core having a deviation greater than or equal to a first threshold, determine that the software to be analyzed has a resource allocation abnormality problem; wherein the above-mentioned benchmark value is the average value of the CPU utilization of multiple CPU cores.

[0055] Among them, when performing anomaly detection on the resource allocation of the software to be analyzed, the performance data of the software to be analyzed during operation obtained in the above step S201 is the CPU utilization of each CPU core. Correspondingly, for this performance problem, the corresponding performance indicator detection sub-rule can be that the deviation value between the CPU utilization and the benchmark value is greater than or equal to the first threshold. CPU core (Core) refers to an independent processing unit inside the CPU. In a multi-core processor, each core can independently perform computing tasks, similar to a separate CPU.

[0056] In addition, it should be noted that the CPU utilization of each CPU core refers to the percentage of each CPU core used to execute computing tasks within a certain period of time. It is an important indicator to measure the busyness of the CPU core and reflects the workload of the CPU core. Therefore, when it is necessary to perform abnormal analysis on the resource allocation of the software to be analyzed, the CPU utilization of each CPU core when the software to be analyzed is running can be obtained.

[0057] In one embodiment, after obtaining the CPU utilization of each CPU core when the software to be analyzed is running, the average value of the CPU utilization of all CPU cores is calculated as the above-mentioned reference value. Then, for each CPU core, the deviation between the CPU utilization of the CPU core and the reference value is calculated, and it is determined whether the deviation between the CPU utilization of the CPU core and the reference value is greater than or equal to a first threshold value. If there is a CPU core with a deviation greater than or equal to the first threshold value, it indicates that the resource allocation is unbalanced, that is, the software to be analyzed has a performance problem of abnormal resource allocation.

[0058] Among them, the specific value of the above-mentioned first threshold can be set according to the actual application scenario, and the embodiment of the present application does not limit the specific value of the above-mentioned first threshold.

[0059] In an embodiment of the present application, during the operation of the software to be analyzed, the CPU utilization of each CPU core of the software to be analyzed is obtained during its operation, and by determining whether there is a CPU core among the CPU cores whose CPU utilization is greater than or equal to a first threshold, it is possible to accurately determine which CPU cores are overused, so that the resource allocation of the software to be analyzed can be adjusted in time to balance the load and improve overall efficiency.

[0060] In one embodiment, the above-mentioned performance problem may include a memory fragmentation problem. For this type of performance problem, the above-mentioned performance anomaly detection program is specifically used to: calculate the ratio between the number of target memory blocks and the total number of memory blocks based on performance data, and in response to the above-mentioned ratio being greater than or equal to a third threshold, determine that the software to be analyzed has a memory fragmentation problem; wherein the above-mentioned target memory block is a memory block whose memory occupation space is less than or equal to a second threshold.

[0061] Memory fragmentation refers to the phenomenon that the memory space in the computing device is discontinuous due to discontinuous memory allocation and release, thus forming many small, discontinuous memory blocks. These memory blocks are too small to be effectively used, but cannot be merged, resulting in reduced memory utilization. A memory block refers to a continuous storage space allocated in the memory, and the memory footprint of a memory block refers to the actual memory size occupied by the memory block.

[0062] Therefore, when analyzing whether there is a performance problem of memory fragmentation when the software to be analyzed is running, the performance data obtained in the above step S201 can be the memory occupied space of each memory block in the memory; accordingly, for this performance problem, the corresponding performance indicator detection sub-rule can be whether the ratio of the number of memory blocks whose memory occupied space is less than the second threshold to the total number of all memory blocks exceeds the third threshold. Generally, the larger the ratio of small memory blocks in the memory, the more serious the memory fragmentation is. Therefore, by detecting whether the ratio of the number of small memory blocks (that is, the target memory blocks) to the total number of all memory blocks exceeds the third threshold, it can be judged whether there is a performance problem of memory fragmentation during the operation of the software to be analyzed.

[0063] In one implementation, after obtaining the memory occupied space of each memory block during the operation of the software to be analyzed, the memory occupied space of each memory block is compared with the second threshold, and the target memory blocks whose memory occupied space is less than or equal to the second threshold are screened out from the memory blocks, that is, the small memory blocks in the memory blocks are screened out. The ratio of the number of target memory blocks to the number of all memory blocks is calculated, and it is determined whether the ratio is greater than or equal to the third threshold. If the ratio is greater than or equal to the third threshold, it means that the proportion of small memory blocks in the memory is too high, that is, the software to be analyzed has a performance problem of memory fragmentation during operation.

[0064] It should be noted that the specific values ​​of the second threshold and the third threshold can be set according to the actual application scenario, and the embodiment of the present application does not limit the specific values ​​of the second threshold and the third threshold.

[0065] In an embodiment of the present application, by obtaining the memory occupied space of each memory block during the operation of the software to be analyzed, and by detecting whether the proportion of the number of target memory blocks smaller than the second threshold exceeds the third threshold, it is possible to accurately determine whether the software to be analyzed has performance problems due to memory fragmentation, thereby enabling corresponding optimization measures to be taken in a timely manner, such as adjusting the memory allocation strategy, to reduce the occurrence of memory fragmentation, thereby improving system performance.

[0066] In one embodiment, if it is determined that the software to be analyzed has performance anomalies, in order to facilitate timely resolution of the performance anomaly problem, an alarm operation to the target personnel can also be triggered. Therefore, the method provided in the embodiment of the present application also includes the following process: in response to the result of the analysis being that the software to be analyzed has performance anomalies, performance anomaly alarm information for the software to be analyzed is generated, and the above-mentioned performance anomaly alarm information is sent to the target device; wherein the above-mentioned performance anomaly alarm information carries the performance data of the software to be analyzed and the call stack information of the software to be analyzed when it is running, and the above-mentioned target device is used to determine the reason why the software to be analyzed has performance anomalies based on the above-mentioned performance data and call stack information.

[0067] Exemplarily, in one implementation, the alarm information may be sent to the target device via any method such as short message, email, voice message, etc.; alternatively, the alarm information may be sent to a designated address, and the user may be notified to access the designated address through the target device to obtain the alarm information.

[0068] The call stack information is a sequence record of function calls during the running of the software to be analyzed. It records all function or process calls executed by the software to be analyzed up to a specific moment, including the order and level of the calls. When the software to be analyzed has performance anomalies, the call stack information of the software to be analyzed during the running period can be used to understand which functions or processes are called most frequently or consume the most resources, thereby assisting in analyzing the causes of the performance anomalies in the software to be analyzed.

[0069] In an embodiment of the present application, the above-mentioned alarm information is used to prompt that there is a performance anomaly in the software to be analyzed, and on the other hand, the relevant information used to analyze the cause of the performance anomaly is sent to the target device for use in analyzing the cause of the performance anomaly.

[0070] In one embodiment, if the analysis result of the software to be analyzed by the performance anomaly detection program indicates that the software to be analyzed has a performance anomaly, the call stack information of the software to be analyzed during operation is obtained, and performance anomaly alarm information is generated based on the obtained call stack information and the corresponding performance data of the software to be analyzed, and the generated performance anomaly alarm information is sent to the target device.

[0071] Among them, after receiving the performance abnormality alarm information sent by the computing device, the target device responds to the graphics generation instruction and generates a corresponding analysis graph based on the performance data and call stack information in the performance abnormality alarm information to assist in analyzing the cause of the performance abnormality of the software to be analyzed.

[0072] Exemplarily, in one embodiment, a flame graph can be generated based on performance data and call stack information, and the flame graph can be used to assist in analyzing the reasons for the performance anomaly in the software to be analyzed. Specifically, the flame graph includes multiple call stacks, and any call stack includes multiple grids, and the multiple grids correspond one-to-one to multiple functions (or multiple processes). The arrangement order of the multiple grids represents the call relationship between multiple functions (or processes), and the width of any grid is related to the performance data corresponding to the corresponding function (or process), and is used to represent the probability that the corresponding function (or process) causes an abnormal state. The larger the width of the grid, the greater the probability that the corresponding function (or process) causes an abnormal state, or the greater the possibility that the corresponding function (or process) causes the performance anomaly of the software to be analyzed.

[0073] Therefore, in the embodiment of the present application, relevant personnel can analyze the abnormal cause information that causes the performance abnormality of the software to be analyzed by combining the flame graph generated based on the performance data and the call stack information, and handle the performance problem of the software to be analyzed based on the abnormal cause information obtained by the analysis.

[0074] In an embodiment of the present application, when the analysis result of the software to be analyzed indicates that the software to be analyzed has performance anomalies, the performance data of the software to be analyzed and the call stack information of the software to be analyzed at runtime are carried in the performance anomaly alarm information and sent to the target device, so that the target device can analyze the cause of the performance anomaly of the software to be analyzed based on the performance data and the call stack information. Since the call stack information provides detailed call information of the software to be analyzed, it is helpful to deeply analyze the cause of the performance anomaly of the software to be analyzed; in addition, the call stack information and performance data are directly carried in the performance anomaly alarm information and sent to the target device, which reduces the time waiting for manual collection of data for anomaly analysis, so that the cause of the performance anomaly can be quickly located, thereby improving the system response efficiency.

[0075] In one embodiment, the above-mentioned performance anomaly detection rules are generated by an exception handling device. Therefore, in an embodiment of the present application, before executing the above-mentioned step S202 and calling the performance anomaly detection program of the computing device, the method provided in the embodiment of the present application also includes the following steps: receiving the performance anomaly detection rules sent by the exception handling device, compiling the performance anomaly detection rules, and loading the compiled performance anomaly detection program into the memory of the computing device; wherein the above-mentioned performance anomaly detection rules are generated by the exception handling device based on historical performance data, or are obtained by updating the original performance anomaly detection rules based on user feedback information.

[0076] The above-mentioned exception handling device is a computing device independent of the computing device, which is used to generate performance anomaly detection rules, or optimize existing performance anomaly detection rules based on user feedback information, and send them to the computing device.

[0077] It should be noted that, in the embodiment of the present application, the performance anomaly detection rule sent by the anomaly handling device to the computing device may be an initially generated performance anomaly detection rule, or a performance anomaly detection rule after the original performance anomaly detection rule is adjusted based on user feedback, or a performance anomaly detection rule in which a new detection rule is added to the original performance anomaly detection rule.

[0078] Exemplarily, after receiving the performance anomaly detection rule sent by the anomaly handling device, the computing device compiles the performance anomaly detection rule, for example, performs JIT compilation on the performance anomaly detection rule to obtain an executable program corresponding to the performance anomaly detection rule.

[0079] In one embodiment, the exception handling device can generate performance anomaly detection rules through the following process: collect historical performance data of the software to be analyzed from the historical performance monitoring database, wherein the historical performance data can be key performance indicators such as historical CPU utilization, historical memory usage, historical function call frequency, and historical I / O times. Then, the collected historical performance data is cleaned to improve data quality. The above data cleaning may include processing processes such as missing value processing, deduplication, and data format standardization.

[0080] After the collected historical performance data is cleaned, cluster analysis and other abnormal analysis algorithms are used to analyze the cleaned historical performance data, identify the performance indicators corresponding to each performance problem, and determine the normal fluctuation range of these performance indicators. Based on the results of the above cluster analysis, for each performance indicator, its indicator threshold when there is a performance problem can be determined, that is, the performance indicator detection threshold corresponding to each performance problem is determined, and the corresponding performance indicator detection sub-rule is generated according to the set template. For example, a possible form of the performance indicator detection sub-rule corresponding to each performance problem can be: when it is detected that the indicator value of performance indicator A exceeds the target threshold, it is considered that there is a performance problem corresponding to performance indicator A; or, when it is detected that the proportion of a certain call stack in the total hotspots in process B exceeds the preset threshold, it is considered that there is a performance problem related to the call stack.

[0081] After obtaining the performance indicator detection sub-rules corresponding to each performance problem, the performance indicator detection sub-rules corresponding to all performance problems are combined into a performance anomaly detection rule and sent to each computing device, so that each computing device performs performance analysis on the software to be analyzed based on the performance anomaly detection rule.

[0082] Typically, when a computing device is performing performance analysis on software to be analyzed, a certain performance indicator detection sub-rule may not accurately detect performance issues. Alternatively, some new performance issues may arise, and the existing performance anomaly detection rules do not contain performance indicator detection sub-rules corresponding to these new performance issues. In this case, the existing performance detection rules need to be optimized according to actual needs.

[0083] Therefore, in one embodiment, if relevant personnel identify that the performance indicator detection sub-rule corresponding to a certain performance problem has an accuracy problem, the exception handling device can be triggered to optimize these rules. In response to the optimization instruction triggered by the relevant personnel, the exception handling device can re-collect historical performance data and re-analyze the collected historical performance data to adjust the detection threshold of the performance indicator and update the corresponding performance indicator detection sub-rule. Alternatively, in another embodiment, the above-mentioned optimization instruction can also carry an adjustment suggestion for adjusting the performance anomaly detection sub-rule, and the exception handling device responds to the optimization instruction and adjusts the anomaly indicator detection sub-rule according to the adjustment suggestion carried in the optimization instruction.

[0084] Exemplarily, after completing the optimization of the above-mentioned performance anomaly detection sub-rule, the anomaly processing device replaces the corresponding sub-rule in the performance anomaly detection rule with the optimized performance anomaly detection sub-rule, and sends the entire replaced performance anomaly detection rule to each computing device.

[0085] In one embodiment, if a new performance problem occurs, the exception handling device can be triggered to generate a performance indicator detection sub-rule corresponding to the new performance problem, and the performance indicator detection sub-rule corresponding to the new performance problem is added to the original performance anomaly detection rule and sent to each computing device together.

[0086] In an embodiment of the present application, performance anomaly detection rules are generated by an exception handling device and distributed to each computing device, thereby realizing centralized management of performance anomaly detection rules and ensuring that each computing device uses the same abnormal performance detection rules, thereby reducing false detections caused by inconsistent performance anomaly detection rules and improving the reliability of the entire system and the accuracy of performance detection; in addition, in an embodiment of the present application, the performance anomaly detection rules are optimized by the exception handling device based on user feedback, so that the performance detection rules are continuously iterated and optimized, thereby continuously improving the accuracy of performance anomaly detection, and further ensuring the stable operation of the system.

[0087] In the embodiment of the present application, since the exception handling device can continuously optimize the performance detection rules based on user feedback and send the optimized performance anomaly detection rules to each computing device. Therefore, for each computing device, it may receive multiple performance anomaly detection rules, and each time a new performance anomaly detection rule is received, it needs to be compiled. Therefore, the method provided in the embodiment of the present application also includes: recompiling the updated performance anomaly detection rules; updating the performance anomaly detection program in the computing device to the recompiled performance anomaly detection program.

[0088] Among them, in one embodiment, the updated performance anomaly detection rules are compiled using JIT compilation technology. After the new performance anomaly detection rules are recompiled, they are loaded into the memory of the computing device and replace the performance anomaly detection program originally loaded in the memory. That is, in the embodiment of the present application, only the latest compiled performance anomaly detection program is saved in the memory.

[0089] In an embodiment of the present application, each time a new performance anomaly detection rule is recompiled, the performance anomaly detection program stored in the memory of the computing device is updated to the recompiled performance anomaly detection program, that is, the original performance anomaly detection program in the memory of the computing device is replaced with the latest compiled version, ensuring that the computing device can use the latest performance anomaly detection program for anomaly analysis, thereby improving the accuracy and efficiency of the analysis. By replacing the old program, we can also reduce the occupancy of the memory space of the computing device and optimize resource utilization.

[0090] To facilitate understanding of the method provided in the embodiment of the present application, a flow chart of the method provided in the embodiment of the present application is introduced below. Figure 3 A schematic diagram of a process of an abnormality analysis method provided in an embodiment of the present application is shown. Figure 3 As shown, the exception handling device collects historical performance indicator data from the historical database, determines the performance anomaly detection sub-rule corresponding to each performance problem through anomaly analysis algorithms such as cluster analysis, generates codes for each performance problem and its corresponding performance anomaly detection sub-rule, obtains the performance anomaly detection rule, and sends it to each computing device. After receiving the performance anomaly detection rule sent by the exception handling device, the computing device compiles the performance anomaly detection rule using JIT compilation technology to obtain the corresponding performance anomaly detection program, and loads it into the memory of the computing device.

[0091] When the software to be analyzed is running on a computing device, the performance data of the software to be analyzed is obtained, and a performance anomaly detection program is called from the memory of the computing device for analysis. For example, the performance indicator value corresponding to the above performance data can be calculated, and the above performance indicator value can be detected based on the performance indicator detection sub-rule to determine whether the software to be analyzed has a performance problem corresponding to the performance indicator; the analysis result of the performance anomaly detection program on the software to be analyzed is obtained. If the analysis result indicates that the software to be analyzed has a performance anomaly, performance anomaly alarm information of the software to be analyzed is generated, and the performance anomaly alarm information is sent to the target device.

[0092] Corresponding to the application scenario and method of the method provided in the embodiment of the present application, the embodiment of the present application also provides an abnormality analysis system, Figure 4 The structure diagram of the abnormality analysis system provided in the embodiment of the present application is shown as follows: Figure 4 As shown, the exception analysis system includes an exception processing device 110 and at least one computing device 120 .

[0093] Among them, the above-mentioned exception handling device 110 is used to send performance anomaly detection rules to each computing device 120; the computing device 120 is used to compile the received performance anomaly detection rules and load the compiled performance anomaly detection program into the memory; and, it is also used to obtain the performance data of the software to be analyzed during operation, and call the above-mentioned performance anomaly detection program, which is used to analyze whether the software to be analyzed has performance anomalies based on the performance data and the performance anomaly detection rules; the above-mentioned computing device 120 is also used to obtain the analysis results of the performance anomaly detection program on the software to be analyzed.

[0094] In one implementation, the above-mentioned exception handling device 110 is also used to generate performance anomaly detection rules based on historical performance data.

[0095] Optionally, in one embodiment, the above-mentioned exception handling device 110 is also used to: update the original performance anomaly detection rules based on the received user feedback information, and send the new performance anomaly detection rules to the computing device 120; the computing device 120 is also used to recompile the updated performance anomaly detection rules, and update the performance anomaly detection program in the computing device 120 to the recompiled performance anomaly detection program.

[0096] Optionally, in one embodiment, the above-mentioned performance anomaly detection rules include performance indicator detection sub-rules corresponding to multiple performance problems; the above-mentioned performance anomaly detection program is specifically used to: calculate the performance indicator value corresponding to the above-mentioned performance data; detect the above-mentioned performance indicator value based on the performance indicator detection sub-rule to determine whether the software to be analyzed has a performance problem corresponding to the performance indicator.

[0097] Optionally, in one embodiment, the above-mentioned performance problem includes a resource allocation anomaly problem, and the performance anomaly detection program is specifically used to: calculate the deviation between the CPU utilization of each CPU core and a benchmark value based on the above-mentioned performance data, and the above-mentioned benchmark value is the average value of the CPU utilization of each CPU core; in response to the existence of a CPU core with a deviation greater than or equal to a first threshold, determine that the software to be analyzed has a resource allocation anomaly problem.

[0098] Optionally, in one embodiment, the above-mentioned performance problem includes a memory fragmentation problem, and the performance anomaly detection program is specifically used to: calculate the ratio between the number of target memory blocks and the total number of memory blocks based on the above-mentioned performance data, the target memory block is a memory block whose memory occupation space is less than or equal to a second threshold; in response to the above-mentioned ratio being greater than or equal to a third threshold, determine that the software to be analyzed has a memory fragmentation problem.

[0099] Optionally, in one embodiment, the computing device 120 is further used to: in response to the analysis result indicating that the software to be analyzed has a performance anomaly, generate performance anomaly alarm information for the software to be analyzed, the performance anomaly alarm information carrying performance data of the software to be analyzed and call stack information of the software to be analyzed during its runtime; and send the performance anomaly alarm information to a target device, wherein the target device is used to determine the cause of the performance anomaly in the software to be analyzed based on the performance data and the call stack information.

[0100] The functions of the computing device and the exception handling device in the embodiment of the present application can be referred to the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0101] Corresponding to the application scenario and method of the method provided in the embodiment of the present application, the embodiment of the present application also provides an anomaly analysis device, which includes a first acquisition module for acquiring performance data of the software to be analyzed when it is running on a computing device; a calling module for calling a performance anomaly detection program of the computing device, wherein the performance anomaly detection program is an executable program that compiles performance anomaly detection rules and loads them into the memory of the computing device, and is used to analyze whether the software to be analyzed has performance anomalies based on the above-mentioned performance data and performance anomaly detection rules; and a second acquisition module for acquiring the analysis results of the performance anomaly detection program on the software to be analyzed.

[0102] Optionally, in one embodiment, the above-mentioned performance anomaly detection rules include performance indicator detection sub-rules corresponding to multiple performance problems; the above-mentioned performance anomaly detection program is specifically used to: calculate the performance indicator value corresponding to the above-mentioned performance data; detect the above-mentioned performance indicator value based on the performance indicator detection sub-rules to determine whether the software to be analyzed has a performance problem corresponding to the performance indicator.

[0103] Optionally, in one embodiment, the above-mentioned performance problem includes a resource allocation anomaly problem, and the performance anomaly detection program is specifically used to: calculate the deviation between the CPU utilization of each CPU core and a benchmark value based on the above-mentioned performance data, and the benchmark value is the average value of the CPU utilization of each CPU core; in response to the existence of a CPU core with a deviation greater than or equal to a first threshold, determine that the software to be analyzed has a resource allocation anomaly problem.

[0104] Optionally, in one embodiment, the above-mentioned performance problem includes a memory fragmentation problem, and the performance anomaly detection program is specifically used to: calculate the ratio between the number of target memory blocks and the total number of memory blocks based on the above-mentioned performance data, the target memory block is a memory block whose memory occupation space is less than or equal to a second threshold; in response to the above-mentioned ratio being greater than or equal to a third threshold, determine that the software to be analyzed has a memory fragmentation problem.

[0105] Optionally, in one embodiment, the device provided by the embodiment of the present application also includes: a receiving module, used to receive a performance anomaly detection rule sent by an exception handling device, where the performance anomaly detection rule is generated by the exception handling device based on historical performance data, or is obtained by updating the original performance anomaly detection rule based on user feedback information; a first compilation module, used to compile the above-mentioned performance anomaly detection rule; and a loading module, used to load the compiled performance anomaly detection program into the memory of the computing device.

[0106] Optionally, in one embodiment, the apparatus provided in the embodiment of the present application further includes: a second compilation module, used to recompile the updated performance anomaly detection rules; and an update module, used to update the performance anomaly detection program in the computing device to the recompiled performance anomaly detection program.

[0107] Optionally, in one embodiment, the device provided by the embodiment of the present application also includes: a generation module, which is used to generate performance anomaly alarm information for the software to be analyzed in response to the above analysis result that the software to be analyzed has performance anomalies, and the performance anomaly alarm information carries performance data of the software to be analyzed and call stack information of the software to be analyzed during runtime; a sending module, which is used to send the above performance anomaly alarm information to a target device, wherein the target device is used to determine the cause of the performance anomaly in the software to be analyzed based on the above performance data and call stack information.

[0108] The functions of each module in the device provided in the embodiment of the present application can be referred to the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0109] Figure 5 FIG. 1 is a block diagram of an electronic device used to implement an embodiment of the present application. Figure 5 As shown, the electronic device includes: a memory 501 and a processor 502, and the memory 501 stores a computer program that can be run on the processor 502. When the processor 502 executes the computer program, the method in the above embodiment is implemented. The number of the memory 501 and the processor 502 can be one or more. In a specific implementation, the electronic device may also include a communication interface 503 for communicating with external devices and performing data exchange transmission.

[0110] In specific implementation, if the memory 501, the processor 502 and the communication interface 503 are implemented independently, the memory 501, the processor 502 and the communication interface 503 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0111] Optionally, in a specific implementation, if the memory 501, the processor 502 and the communication interface 503 are integrated on a chip, the memory 501, the processor 502 and the communication interface 503 can communicate with each other through an internal interface.

[0112] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present application when the program is executed by a processor.

[0113] An embodiment of the present application provides a computer program product, including a computer program, which implements the method provided in the embodiment of the present application when executed by a processor.

[0114] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present application.

[0115] An embodiment of the present application also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided in the embodiment of the application.

[0116] It should be understood that the processor may be a CPU, or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the Advanced RISC Machines (ARM) architecture.

[0117] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of exemplary but not limiting description, many forms of RAM are available. For example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DR RAM).

[0118] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0119] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0120] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0121] Any process or method described in the flow chart or otherwise described herein can be understood as a module, fragment or portion of a code representing one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0122] The logic and / or steps described in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with these instruction execution systems, apparatuses or devices.

[0123] It should be understood that the various parts of the present application can be implemented with hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented with software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium, and when the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0124] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0125] The above is only an exemplary embodiment of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope recorded in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for abnormality analysis, comprising: Obtain performance data of the software to be analyzed when it is running on a computing device; Calling a performance anomaly detection program of the computing device, wherein the performance anomaly detection program is an executable program that compiles performance anomaly detection rules and loads them into the memory of the computing device, and is used to analyze whether the software to be analyzed has performance anomalies based on the performance data and the performance anomaly detection rules; Obtain analysis results of the performance anomaly detection program on the software to be analyzed.

2. The method according to claim 1, wherein: The performance anomaly detection rule includes a plurality of performance indicator detection sub-rules corresponding to performance problems; the performance anomaly detection program is specifically used for: Calculating the performance index value corresponding to the performance data; The performance indicator value is detected based on the performance indicator detection sub-rule to determine whether the software to be analyzed has a performance problem corresponding to the performance indicator.

3. The method according to claim 2, wherein: The performance problem includes a resource allocation anomaly problem, and the performance anomaly detection program is specifically used to: Calculate the deviation between the CPU utilization of each CPU core and a benchmark value according to the performance data, where the benchmark value is an average value of the CPU utilization of each CPU core; In response to the existence of a CPU core whose deviation is greater than or equal to the first threshold, it is determined that the software to be analyzed has the resource allocation abnormality problem.

4. The method according to claim 2, wherein: The performance problem includes a memory fragmentation problem, and the performance anomaly detection program is specifically used to: Calculate the ratio between the number of target memory blocks and the total number of memory blocks according to the performance data, the target memory block being a memory block whose memory occupation space is less than or equal to a second threshold; In response to the ratio being greater than or equal to a third threshold, it is determined that the software to be analyzed has the memory fragmentation problem.

5. The method according to any one of claims 1 to 4, wherein: Before calling the performance anomaly detection program of the computing device, the method further includes: Receiving the performance anomaly detection rule sent by the anomaly processing device, where the performance anomaly detection rule is generated by the anomaly processing device based on historical performance data, or is obtained by updating the original performance anomaly detection rule based on user feedback information; Compiling the performance anomaly detection rules; The compiled performance anomaly detection program is loaded into the memory of the computing device.

6. The method according to claim 5, further comprising: Recompile the updated performance anomaly detection rules; The performance anomaly detection program in the computing device is updated to the recompiled performance anomaly detection program.

7. The method according to any one of claims 1 to 4, further comprising: In response to the analysis result indicating that the software to be analyzed has performance anomalies, generating performance anomaly warning information for the software to be analyzed, wherein the performance anomaly warning information carries performance data of the software to be analyzed and call stack information when the software to be analyzed is running; The performance abnormality alarm information is sent to a target device, wherein the target device is used to determine the reason why the performance abnormality of the software to be analyzed exists according to the performance data and the call stack information.

8. An abnormality analysis system, wherein: The system includes an exception handling device and at least one computing device; The anomaly processing device is used to send the performance anomaly detection rules to each of the computing devices; The computing device is used to compile the received performance anomaly detection rule and load the compiled performance anomaly detection program into the memory; and is also used to obtain the performance data of the software to be analyzed when it is running, and call the performance anomaly detection program, wherein the performance anomaly detection program is used to analyze whether the software to be analyzed has performance anomalies according to the performance data and the performance anomaly detection rule; The computing device is also used to obtain the analysis result of the performance anomaly detection program on the software to be analyzed.

9. The system according to claim 8, wherein the anomaly processing device is further used to: generate the performance anomaly detection rule based on historical performance data.

10. The system according to claim 8 or 9, wherein the exception handling device is further used for: updating the original performance anomaly detection rule based on the received user feedback information, and sending the obtained new performance anomaly detection rule to the computing device; The computing device is further used to recompile the updated performance anomaly detection rule, and update the performance anomaly detection program in the computing device to the recompiled performance anomaly detection program.

11. An electronic device comprising a memory, a processor and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

12. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

13. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images