A VIP drift automatic abnormal diagnosis method, system, electronic device and storage medium

Abstract

The present invention discloses a method, system, electronic device and storage medium for automatic abnormal diagnosis of VIP drift, including using ebpf to intercept connect and getsocktopt system calls, collect VIP connection failure information, and obtain the abnormality of network connection when the application accesses VIP; through keepalive probes, using ebpf to intercept sendmsg and recvmsg system calls to obtain VIP drift server information; based on VIP drift server information, a network field information acquisition task is constructed; according to TASK-agentip, the task is sent to the target application server, and the business probe receives the task and performs network diagnosis on the business service to obtain data; the data is fragmented; the fragmented data is input into the Qwen-72B large model to obtain the analysis result. The present invention can accurately capture the VIP drift behavior without modifying the keepalived component source code. Due to the use of eBPF kernel technology, any drift event can be avoided from being missed, and better real-time performance, lower delay and system overhead can also be obtained.

Description

Technical Field

[0001] The present invention relates to the technical field of software deployment, and in particular to a method, system, electronic device and storage medium for automatic abnormal diagnosis of VIP drift. Background Art

[0002] Keepalived is a lightweight high-availability solution deployed in Linux systems and is widely used in enterprise-level high-availability architectures. The system provides reliable high-availability protection by continuously monitoring server status. When a server failure is detected, Keepalived will automatically remove the server from the system and seamlessly switch to a backup server to ensure uninterrupted business. During this process, the VIP will drift to another server. After the failed server returns to normal, Keepalived will automatically re-incorporate it into the server group. The entire process does not require manual intervention, greatly simplifying system maintenance.

[0003] However, when problems occur in services proxied by Keepalived, network connectivity troubleshooting often faces challenges. Since only the virtual IP (VIP) can be seen at the application level, and the corresponding server and network card cannot be directly identified, further troubleshooting of network connectivity problems becomes difficult, ultimately resulting in a high mean time to repair (MTTR) for enterprises and low availability of application services.

[0004] There are two main traditional methods for obtaining Keepalived VIP drift:

[0005] Prometheus's keepalivedexporter component. This component can expose the status indicators of the keepalived component. In order to solve the above problem, the component exposes indicators such as keepalived_up and keepalived_become_master_total. However, keepalived_up can only indicate whether the enterprise operation and maintenance personnel keepalived component is up, and keepalived_become_master_total can only indicate whether the VIP has IP drift, but cannot specifically know which host it has drifted to. It is even more unable to support the diagnosis of abnormal application access to VIP.

[0006] Zabbix monitors whether drift occurs. This method is similar to the first one. It can only indicate whether IP drift occurs in VIP and cannot provide information for diagnosis.

[0007] The drift indicator is exposed by modifying the keepalived source code. Keepalived is an open source component. Modifying the source code will lead to high cost of subsequent keepalived upgrades and fail to obtain some excellent accumulation of the community. Summary of the invention

[0008] In view of the shortcomings existing in the above problems, the present invention provides a method, system, electronic device and storage medium for automatic abnormal diagnosis of VIP drift.

[0009] To achieve the above object, the present invention provides a method for automatic abnormal diagnosis of VIP drift, comprising:

[0010] Use ebpf to intercept connect and getsocktopt system calls, collect VIP connection failure information, and obtain network connection exceptions when applications access VIP;

[0011] Through the keepalive probe, ebpf is used to intercept the sendmsg and recvmsg system calls to obtain the VIP drift server information;

[0012] Based on the VIP drift server information, construct a network site information acquisition task;

[0013] The task is sent to the target application server according to TASK-agentip, and the business probe receives the task and performs network diagnosis on the business service to obtain data;

[0014] Slice the data;

[0015] Input the fragmented data into the Qwen-72B large model to obtain the analysis results.

[0016] Preferably, using ebpf to intercept connect and getsocktopt system calls, collecting VIP connection failure information, and obtaining network connection anomalies when the application accesses the VIP includes:

[0017] Intercept the connect system call to obtain function parameters, and connect to the destination IP address;

[0018] Determine whether the application access is of VIP type. If not, discard it without processing.

[0019] If yes, start the probe to obtain the return value status code of the connect system call. If the return value status code is -115, use fd as the key and value as the IP to retain the connection information. If the return value status code is a negative value other than -115, generate a connect failure event for the application to connect to the VIP.

[0020] Intercept the getsocktopt system call to the getsockopt function, obtain fd and the level and opt operation type of the fd operation. If it is SOL_SOCKET, it means an operation on the socket, and SO_ERROR indicates a returned error. Determine whether the returned error is less than 0. If it is less than 0, the connection status is abnormal. Based on fd as the key, obtain the IP reserved connection information.

[0021] Preferably, by using the keepalive probe and ebpf to intercept sendmsg and recvmsg system calls, obtaining VIP drift server information includes:

[0022] Intercept the sendmsg system to obtain the message sendmsg byte array;

[0023] Extract the first two bytes of the sendmsg byte array and convert them into numbers. If the number is 16, it represents the AF_NETLINK protocol, and perform protocol extraction to obtain IP information, using fd as the key and ip as the value, and save it to BPF_MAP. If not, give up processing.

[0024] Intercept the recvmsg system to obtain the message recvmsg byte array;

[0025] Extract the first 2 bytes of the recvmsg byte array and convert them into numbers. If the number is 16, further obtain the recvmsg return value. If the return is successful, the IP drift is successful. Get the drift target IP according to the fd information, assemble it into a drift event and send it to the background. If not, give up the processing.

[0026] Preferably, the protocol information extracts the destination IP address step:

[0027] The pointer is offset by 22 bytes to obtain the protocol start pointer start address ptr;

[0028] The prt offsets 4 bytes, reads 2 bytes, and obtains the operation type. If the operation type is RTM_NEWADDR, prt reads 4 bytes to obtain the length len of the network card operation content. ptr offsets len bytes to obtain the starting address ifprt of the network card information, otherwise skips the processing. RTM_NEWADDR is the type of the kernel identification IP address assigned or bound to a certain network interface.

[0029] The ifprt function offsets 4 bytes, reads 4 bytes to obtain the network card serial number, and calls the kernel if_nametoindex function to obtain the network card name according to the network card serial number;

[0030] The ifprt offsets 8 bytes to obtain the attribute start address, continues to offset 2 to read the attribute length alen, and obtains the decimal IP address at the offset alen.

[0031] Preferably, the task is accompanied by a traceid, which is information indicating a connection failure of the code.

[0032] Preferably, the data includes an iptables table, a routing table, an arp table, and a traceroute table with TASK-ip information as the purpose.

[0033] Preferably, the step of slicing the data includes:

[0034] Read and analyze the iptables table, select chain as the custom identifier, filter the chain without target through the tool, count the number of chain tokens T and the number of chain lines offset, and put them into the token feature document traceid_iptable_tokens in the format of chainxx T offset / n chainxx TL / n. If the tokens of the chain are greater than X, count the tokens TL of each line of the chain, and count them in the token feature document chainxx_line_tokens in the format of line TL.

[0035] Analyze the routing table, the arp table, and the traceroute table, count the tokens TL of each line with the line separator, and add the count to the token feature document traceid_XX_tokens document in the format of line TL;

[0036] Is there a feature document? If there is a feature document starting with traceid, set the parameters: read the total number of tokens sumtoken=0, that is, the document is processed at position pre=0, and the number of analyzed rows i=0;

[0037] Read the next line of the document. If there is content, determine whether the line content starts with a line. If it starts with a line, determine whether to use custom symbols for segmentation. If so, get the number of tokens in this line.

[0038] If the number of tokens does not exceed the maximum value X of tokens, set i to add a row of sumtoken to increase the number of tokens in this row sumtoken=sumtoken+TL;

[0039] If the limit is exceeded, the segmentation standard is inserted at the pre position, and the document is set to process at pre+i, and sumtoken is reset to zero;

[0040] Determine whether the custom string tokens exceed the maximum limit. If not, the custom string is segmented into a separate segment, the segmentation standard is inserted at the pre position, and the document is set to process at pre+offset.

[0041] If the limit is exceeded, the sub-feature document needs to be processed, sumtoken=0, i=0 is set, and the sub-feature document is read;

[0042] After processing all feature documents, i.e. technology, the original content completes data sharding.

[0043] The present application also provides a VIP drift and automatic abnormality diagnosis system, including:

[0044] The collection module is used to use ebpf to intercept the connect and getsocktopt system calls, collect VIP connection failure information, and obtain network connection anomalies when the application accesses the VIP;

[0045] The acquisition module is used to obtain VIP drift server information through keepalive probes and ebpf to intercept sendmsg and recvmsg system calls;

[0046] A task module, used to construct a network site information acquisition task based on the VIP drift server information;

[0047] The diagnosis module is used to send the task to the target application server according to TASK-agentip. The business probe receives the task and performs network diagnosis on the business service to obtain data.

[0048] A sharding module, used for sharding the data;

[0049] The analysis module is used to input the fragmented data into the Qwen-72B large model to obtain the analysis results.

[0050] The present invention also provides an electronic device, comprising at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, the processing unit executes the above method.

[0051] The present invention also provides a storage medium storing a computer program executable by an electronic device, and when the program runs on the electronic device, the electronic device executes the above method.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] The present invention can accurately capture VIP drift behavior without modifying the keepalived component source code. Due to the use of eBPF kernel technology, it can avoid missing any drift events, and can also obtain better real-time performance, lower latency and system overhead. The method can also achieve VIP access failure, that is, when a connection abnormality occurs, further diagnostic information acquisition, and provide an intelligent analysis process based on a large model to reduce the expert experience of operation and maintenance investigation; at the same time, the method is universal, and any high-availability software based on the VRRP protocol can achieve drift perception based on this method. Finally, the method can further shorten the troubleshooting time for operation and maintenance in a high-availability scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow chart of the automatic abnormal diagnosis method of VIP drift of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] This method and system propose to obtain detailed VIP drift events and abnormal events of failure to connect to VIP based on eBPF technology, and after obtaining the abnormal failure event of connecting to VIP, construct a network detection task according to the destination IP of VIP, further obtain the network link information of the failed connection, and finally pre-process the task and network link data according to the constraints of large model reasoning and input them into the large model for intelligent analysis to give the analysis result of failure. This method can accurately capture the VIP drift behavior without modifying the keepalived component source code. Due to the use of eBPF kernel technology, it can avoid missing any drift events, and can also obtain better real-time performance, lower latency and system overhead. This method can also achieve VIP access failure, that is, when a connection abnormality occurs, further diagnostic information acquisition is carried out, and the large model is used as the base to provide an intelligent analysis process to reduce the expert experience of operation and maintenance troubleshooting; at the same time, this method is universal, and any high-availability software based on the VRRP protocol can realize drift perception based on this method. Finally, this method can further shorten the troubleshooting time for operation and maintenance in high-availability scenarios.

[0057] Reference Figure 1 The present invention provides a method for automatically diagnosing abnormal VIP drift, comprising:

[0058] Use ebpf to intercept connect and getsocktopt system calls, collect VIP connection failure information, and obtain network connection exceptions when applications access VIP;

[0059] Specifically, the collection process is as follows:

[0060] Step 1: Intercept the connect system call to obtain function parameters based on the connection destination IP address;

[0061] Step 2: Determine whether it is a VIP type. The VIP type is configured when the probe is started. If it is not a VIP, it can be discarded without processing;

[0062] Step 3: If it is VIP, get the system call return value status code. If it is -115, it means the connection is asynchronous. Then use fd as key and value as IP to save the connection information, i.e. 4-tuple information, to BPF_MAP. Then judge the connection abnormality according to the result of getsockopt in step 5. If it is other negative value other than -115, proceed to step 4.

[0063] Step 4: Generate a connection failure event for the application to connect to the VIP and send it to the backend;

[0064] Step 5: Intercept the system call to the getsockopt function, obtain fd and the level and opt operation type of the fd operation. If it is SOL_SOCKET, it means an operation on the socket, and SO_ERROR means an error is returned. Determine whether the return value is less than 0. If it is less than 0, it is an exception in the reverse connection state. Use fd as the key to search for the IP data reserved in the third step map. If found, return to step 4 to build an exception event.

[0065] Through the keepalive probe, ebpf is used to intercept the sendmsg and recvmsg system calls to obtain the VIP drift server information;

[0066] Specifically, the steps of obtaining VIP drift server information include:

[0067] Step 1: intercept sendmsg to obtain the message byte array;

[0068] Step 2: Extract the first 2 bytes of byte, convert them into numbers, and check whether they are = 16. 16 is the kernel protocol group number. If it is 16, it means AF_NETLINK protocol, then extract the protocol to get IP information, use fd as key and ip as value, and save it to BPF_MAP. If it is not this protocol, give up processing;

[0069] Step 3: intercept recvmsg to obtain the message byte array;

[0070] Step 4: Extract the first 2 bytes of byte, convert them into numbers, and check whether they are = 16. If not, give up the process.

[0071] Step 5: If yes, further obtain the return value of recvmsg. If the return is successful, the IP drift is successful. Get the drift target IP according to the fd information, assemble it into a drift event and send it to the background.

[0072] Furthermore, the protocol information extracts the destination IP address step:

[0073] The pointer is offset by 22 bytes to obtain the protocol start pointer start address ptr;

[0074] prt offsets 4 bytes, reads 2 bytes, and obtains the operation type. If the operation type is RTM_NEWADDR, prt reads 4 bytes to obtain the length len of the network card operation content. ptr offsets len bytes to obtain the starting address ifprt of the network card information, otherwise skips the processing. RTM_NEWADDR is the type of IP address that the kernel identifies to be assigned or bound to a certain network interface.

[0075] ifprt offsets 4 bytes, reads 4 bytes to get the network card serial number, and calls the kernel if_nametoindex function to get the network card name according to the network card serial number;

[0076] ifprt offsets 8 bytes to obtain the attribute start address, continues to offset 2 to read the attribute length alen, and obtains the decimal IP address at offset alen.

[0077] Based on the VIP drift server information, build a network site information acquisition task;

[0078] Specifically, the collected access failure information automatically generates a traceid, and the (traceid, connectevent) information is stored. The drift IP corresponding to the VIP at the time of the failure is obtained, and a network site information acquisition task is constructed. The task is accompanied by a traceid to facilitate subsequent association of further task diagnostic data. The task information is as follows, Task: (traceid, ip, agent ip). The traceid is the information of a failed connection in the code, the IP is the target IP of the VIP drift, and the agentIP is the probe IP, which also represents the machine on which the VIP cannot be accessed.

[0079] The task is sent to the target application server according to TASK-agentip. The business probe receives the task and performs network diagnosis on the business service to obtain data.

[0080] Specifically, the data includes iptables tables, routing tables, arp tables, and traceroute tables for TASK-ip information. All data is named traceid. The diagnostic content files are stored in OSS unified distributed storage and used as the basic corpus for large model analysis.

[0081] Shard the data;

[0082] Specifically, a hybrid algorithm of custom identifier and line break switching is adopted, and the token restriction is assumed to be X. The specific fragmentation steps are as follows:

[0083] The step of slicing the data includes:

[0084] Step 1: Read and analyze the iptables table, select chain as the custom identifier, and use the tool to filter the chain without target first. It is necessary to prioritize to ensure that one chain is not divided for easy analysis; then count the number of tokens T and the number of lines offset of the chain, and put them into the token feature document traceid_iptable_tokens in the format of chainxx T offset / n chainxx TL / n. If the tokens of the chain are greater than X, count the tokens TL of each line of the chain, and count them in the token feature document chainxx_line_tokens in the format of line TL;

[0085] Step 2: Analyze the routing table, the arp table and the traceroute table, count the tokens TL of each line with the line separator, and count them in the token feature document traceid_XX_tokens document in the format of line TL;

[0086] Step 3: Is there a feature document? If there is a feature document starting with traceid, set the parameters: read the total token number sumtoken=0, that is, the document is processed at position pre=0, and the number of analyzed rows i=0. If there is no feature document, jump to step 9;

[0087] Step 4: Read the next line of the document. If there is no content, go back to step 3. If there is content, determine whether the line content starts with a line. If it does, determine whether to use custom symbols for segmentation. If so, get the number of tokens in this line and determine whether it exceeds the maximum token value X. If not, jump to step 7.

[0088] Step 5: If the number of tokens does not exceed the maximum value X of tokens, set i to add a row of sumtoken and increase the number of tokens in this row sumtoken=sumtoken+TL;

[0089] Step 6: If the limit is exceeded, insert the segmentation standard at the pre position, set the document to process at pre+i, reset sumtoken, and repeat step 4;

[0090] Step 7: Determine whether the custom string tokens exceed the maximum limit. If not, the custom string is segmented into a separate segment. Insert the segmentation standard at the pre position and set the document processing position to pre+offset.

[0091] Step 8: If the limit is exceeded, the sub-feature document needs to be processed, sumtoken=0, i=0, read the sub-feature document, and return to step 4;

[0092] Step 9: After processing all feature documents, i.e. technology, the original content completes data sharding.

[0093] Input the fragmented data into the Qwen-72B large model to obtain the analysis results.

[0094] Specifically, the Qwen-72B large model needs to optimize the prompt. The prompt generation steps are as follows:

[0095] Set the prompt template for the failure as follows, which is a template with filled content.

[0096] Role: You are a network troubleshooter;

[0097] Objective: You have received a network troubleshooting task {{traceid}}, {{traceid}} is the task ID of the abnormal access from {{agentip}} to {{IP}}. You need to analyze why this task is abnormal;

[0098] Analysis conditions: Get all the content prefixed with {{traceid}} that was recently input to you, and associate them for comprehensive analysis (to solve the problem of fragmented knowledge of the large model after sharding in step 5);

[0099] Analysis process: Is this {{IP}} discarded on {{agentip}}? If it is discarded, find out the rules that {{agentip}} passes through to {{IP}}, and convert them into human-understandable demands (abnormal iptables analysis). If it is not discarded, further analyze whether the IP and agentip are in the same network segment. If so, you need to list the specific related arp rules. If not, further check whether there are abnormal links in the traceroute and give the abnormal nodes. If there is no abnormality in the traceroute, check whether the address of the first hop of the traceroute is in the arp rules, and finally draw conclusions based on the results;

[0100] Answer format 1 example: After analysis, this {{IP}} has packet loss rules on {{agentip}}, and the specific rules are listed.

[0101] Answer format 2 example: After analyzing this {{IP}}, the IPtables rule on {{agentip}} sends packets normally, and arp does not find arp records in the same network segment. It is suspected that the arp table or arp discovery is abnormal.

[0102] Answer format 3 example: After analyzing this {{IP}} on {{agentip}}, the IPtables rules are sending packets normally, arp finds the record, the routing table is normal, and the traceroute xx link is abnormal. Please check the network equipment.

[0103] Answer format 4 example: After analyzing this {{IP}} on {{agentip}}, the IPtables rule sends packets normally, arp does not find any records, traceroute is normal, and the routing table configuration for IP as the destination is as follows. Check its correctness.

[0104] When the operation and maintenance personnel click on the intelligent analysis of a specific fault, they obtain the task-related information of the fault, including the task information mentioned in step 3), including traceid, which represents a fault information acquisition task and also marks a fault; agentip represents the business node IP, and IP is the target IP behind the VIP. These information are replaced in the general prompt template to generate a prompt for each fault, giving the big model its own input for each fault background and clarifying the input context.

[0105] Store the fault's own prompt.

[0106] The present application also provides a VIP drift and automatic abnormality diagnosis system, including:

[0107] The collection module is used to use ebpf to intercept the connect and getsocktopt system calls, collect VIP connection failure information, and obtain network connection anomalies when the application accesses the VIP;

[0108] The acquisition module is used to obtain VIP drift server information through keepalive probes and ebpf to intercept sendmsg and recvmsg system calls;

[0109] Task module, used to build network site information acquisition tasks based on VIP drift server information;

[0110] The diagnostic module is used to send tasks to the target application server according to TASK-agentip. The business probe receives the task and performs network diagnosis on the business service to obtain data.

[0111] Sharding module, used to shard data;

[0112] The analysis module is used to input the fragmented data into the Qwen-72B large model to obtain the analysis results.

[0113] The present invention also provides an electronic device, comprising at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, the processing unit executes the above method.

[0114] The present invention also provides a storage medium storing a computer program executable by an electronic device. When the program runs on the electronic device, the electronic device executes the above method.

[0115] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for automatic abnormal diagnosis of VIP drift, characterized in that: include: Use ebpf to intercept connect and getsocktopt system calls, collect VIP connection failure information, and obtain network connection exceptions when applications access VIP; Through the keepalive probe, ebpf is used to intercept the sendmsg and recvmsg system calls to obtain the VIP drift server information; Based on the VIP drift server information, construct a network site information acquisition task; The task is sent to the target application server according to TASK-agentip, and the business probe receives the task and performs network diagnosis on the business service to obtain data; Slice the data; Input the fragmented data into the Qwen-72B large model to obtain the analysis results.

2. The VIP drift automatic abnormality diagnosis method according to claim 1, characterized in that: Use ebpf to intercept connect and getsocktopt system calls, collect VIP connection failure information, and obtain network connection exceptions when applications access VIP, including: Intercept the connect system call to obtain function parameters, and connect to the destination IP address; Determine whether the application access is of VIP type. If not, discard it without processing. If yes, start the probe to obtain the return value status code of the connect system call. If the return value status code is -115, use fd as the key and value as the IP to retain the connection information. If the return value status code is a negative value other than -115, generate a connect failure event for the application to connect to the VIP. Intercept the getsocktopt system call to the getsockopt function, obtain fd and the level and opt operation type of the fd operation. If it is SOL_SOCKET, it means an operation on the socket, and SO_ERROR indicates a returned error. Determine whether the returned error is less than 0. If it is less than 0, the connection status is abnormal. Based on fd as the key, obtain the IP reserved connection information.

3. The VIP drift automatic abnormality diagnosis method according to claim 2 is characterized in that: Through the keepalive probe, ebpf is used to intercept the sendmsg and recvmsg system calls to obtain the VIP drift server information including: Intercept the sendmsg system to obtain the message sendmsg byte array; Extract the first two bytes of the sendmsg byte array and convert them into numbers. If the number is 16, it represents the AF_NETLINK protocol, and perform protocol extraction to obtain IP information, using fd as the key and ip as the value, and save it to BPF_MAP. If not, give up processing. Intercept the recvmsg system to obtain the message recvmsg byte array; Extract the first 2 bytes of the recvmsg byte array and convert them into numbers. If the number is 16, further obtain the recvmsg return value. If the return is successful, the IP drift is successful. Get the drift target IP according to the fd information, assemble it into a drift event and send it to the background. If not, give up the processing.

4. The VIP drift automatic abnormality diagnosis method according to claim 3 is characterized in that: Steps to extract the destination IP address from protocol information: The pointer is offset by 22 bytes to obtain the protocol start pointer start address ptr; The ptr offsets 4 bytes, reads 2 bytes, and obtains the operation type. If the operation type is RTM_NEWADDR, ptr reads 4 bytes to obtain the length len of the network card operation content. ptr offsets len bytes to obtain the starting address ifptr of the network card information, otherwise skip processing. RTM_NEWADDR is the type of the kernel identification IP address assigned or bound to a certain network interface; The ifptr is offset by 4 bytes, 4 bytes are read to obtain the network card serial number, and the kernel if_nametoindex function is called to obtain the network card name according to the network card serial number; The ifptr offsets 8 bytes to obtain the attribute start address, continues to offset 2 to read the attribute length alen, and obtains the decimal IP address at the offset alen.

5. The VIP drift automatic abnormality diagnosis method according to claim 4 is characterized in that: The task is accompanied by a traceid, which is information about a connection failure of the code.

6. The VIP drift automatic abnormality diagnosis method according to claim 5, characterized in that: The data includes iptables table, routing table, arp table, and traceroute table with task-ip information as the purpose.

7. The VIP drift automatic abnormality diagnosis method according to claim 6, characterized in that: The step of slicing the data includes: Read and analyze the iptables table, select chain as the custom identifier, filter the chain without target through the tool, count the number of chain tokens T and the number of chain lines offset, and put them into the token feature document traceid_iptable_tokens in the format of chainxx T offset / n chainxx TL / n. If the tokens of the chain are greater than X, count the tokens TL of each line of the chain, and count them in the token feature document chainxx_line_tokens in the format of line TL. Analyze the routing table, the arp table, and the traceroute table, count the tokens TL of each line with the line separator, and add the count to the token feature document traceid_XX_tokens document in the format of line TL; Is there a feature document? If there is a feature document starting with traceid, set the parameters: read the total number of tokens sumtoken=0, that is, the document is processed at position pre=0, and the number of analyzed rows i=0; Read the next line of the document. If there is content, determine whether the line content starts with a line. If it starts with a line, determine whether to use custom symbols for segmentation. If so, get the number of tokens in this line. If the number of tokens does not exceed the maximum value X of tokens, set i to add a row of sumtoken to increase the number of tokens in this row sumtoken=sumtoken+TL; If the limit is exceeded, the segmentation standard is inserted at the pre position, and the document is set to process at pre+i, and sumtoken is reset to zero; Determine whether the custom string tokens exceed the maximum limit. If not, the custom string is segmented into a separate segment, the segmentation standard is inserted at the pre position, and the document is set to process at pre+offset. If the limit is exceeded, the sub-feature document needs to be processed, sumtoken=0, i=0 is set, and the sub-feature document is read; After processing all feature documents, the original content completes data sharding.

8. A VIP drift and automatic abnormality diagnosis system, characterized in that: include: The collection module is used to use ebpf to intercept the connect and getsocktopt system calls, collect VIP connection failure information, and obtain network connection anomalies when the application accesses the VIP; The acquisition module is used to obtain VIP drift server information through keepalive probes and ebpf to intercept sendmsg and recvmsg system calls; A task module, used to construct a network site information acquisition task based on the VIP drift server information; The diagnosis module is used to send the task to the target application server according to TASK-agentip. The business probe receives the task and performs network diagnosis on the business service to obtain data. A sharding module, used for sharding the data; The analysis module is used to input the fragmented data into the Qwen-72B large model to obtain the analysis results.

9. An electronic device, characterized in that: The method comprises at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, the processing unit executes the method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: It stores a computer program executable by an electronic device, and when the program runs on the electronic device, the electronic device executes the method described in any one of claims 1 to 7.

Images