Process fault analysis method and system

Abstract

The invention discloses a process fault analysis method and system, and the method comprises the following steps: dynamically adjusting the monitoring frequency according to the fluctuation of a resource occupancy rate, selecting a process of which the resource occupancy rate is greater than a basic index at a first moment as an abnormal process, obtaining the log information of the abnormal process at the first moment and the previous moment, the first moment and the previous moment are adjacent moments in the monitoring frequency; and preprocessing the log information, performing normal form analysis, and matching a case library to obtain a process fault analysis result. According to the method and the system, the process problem of high accidental and recurrence difficulty is solved, the intelligent and automatic analysis of the process problem is realized by acquiring and analyzing the key log information before and during the fault, and the efficiency of positioning the problem is greatly improved.

Description

Technical Field

[0001] The present invention relates to operating system fault analysis technology, and in particular to a process fault analysis method and system. Background Art

[0002] With the development of the information age, the demand for data processing is increasing, and the application of server operating systems is becoming more and more extensive. Higher requirements are also put forward for the stability of server operating systems and the stability of business applications running on the system. Improving the stability of server operating systems lies in discovering and solving problems.

[0003] Currently, system-level monitoring generally monitors the system load, memory usage, and CPU usage, while process-level fault analysis generally involves memory dumps when the process is abnormal, that is, core analysis when the program crashes. However, it is impossible to perform monitoring and analysis on process problems that do not cause abnormal termination of the program or application to generate cores. As a result, when many problems occur, the fault site no longer exists and necessary log information is not obtained in a timely manner, making it very difficult to locate the problem and requiring R&D manpower to conduct location analysis. Summary of the invention

[0004] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a process fault analysis method and system, which regularly checks the system status and the status of the processes running on the system, identifies problems in a timely manner, obtains key log information before and during the fault, and realizes intelligent and automatic analysis of process problems, greatly improving the efficiency of locating problems.

[0005] In order to solve the above technical problems, the technical solution proposed by the present invention is:

[0006] A process fault analysis method comprises the following steps:

[0007] Obtain system load information and process information according to the monitoring frequency, select processes whose resource usage is greater than the basic index as abnormal processes, and obtain log information before and during the abnormal process failure;

[0008] Preprocess the log information to obtain a process analysis report, and dynamically adjust the monitoring frequency according to the fluctuation of system load;

[0009] Perform paradigm analysis on the process analysis report and match it with the case library to obtain the process fault analysis results.

[0010] Furthermore, when selecting a process whose load is greater than the basic indicator as an abnormal process, it includes:

[0011] Compare system load information at adjacent times;

[0012] If the fluctuation of the system load at the first moment compared with the system load at the previous moment is greater than a preset threshold, the resource usage of all processes at the first moment is sorted to obtain a process list, and the process list is traversed to find the process whose resource usage is greater than the basic indicator as an abnormal process.

[0013] Furthermore, when obtaining log information before and during the abnormal process failure, it includes:

[0014] Taking the first moment as the moment of the fault, obtaining the log information of the abnormal process at the first moment as the log information of the fault;

[0015] The second moment is taken as the moment before the failure, the second moment is before the first moment, and the fluctuation of the system load at the second moment and the system load at the previous moment of the second moment is less than a preset threshold, and the log information of the abnormal process at the second moment is obtained as the log information before the failure.

[0016] Furthermore, when the monitoring frequency is dynamically adjusted according to the fluctuation of the system load, it includes:

[0017] Obtain the results of comparing system load information at adjacent moments;

[0018] If the fluctuation of the system load at adjacent moments is greater than the preset threshold, the monitoring frequency is increased;

[0019] If the fluctuation of the system load at adjacent moments is less than the preset threshold, the monitoring frequency is maintained;

[0020] If the fluctuations of the system load at a specified number of adjacent moments are all less than the preset threshold, the monitoring frequency is restored to the initial value.

[0021] Furthermore, when the log information is preprocessed to obtain a process analysis report, it includes: extracting target information from the log information, and generating a process analysis report according to a specified format for the target information; and performing a paradigm analysis on the process analysis report and matching the case library to obtain a process fault analysis result, it includes: reading the target information in the process analysis report, performing a paradigm analysis on the target information and matching the case library.

[0022] Furthermore, performing paradigm analysis on the target information and matching the case library includes the step of performing paradigm analysis on the target information, specifically including: matching the target information with a preset paradigm question library to obtain corresponding paradigm steps, performing judgment analysis on the target information in turn according to the paradigm steps to obtain analysis results of each judgment branch, wherein the paradigm step includes multiple step fields, and each step field includes a judgment branch and an analysis indication to perform paradigm step switching and problem judgment.

[0023] Furthermore, performing paradigm analysis on the target information and matching the case library includes the step of matching the target information with the case library, specifically including: traversing all information in the preset case library and matching it with the target information, and taking the information with a matching degree greater than the target value as the matching result.

[0024] Furthermore, when the target information is subjected to paradigm analysis and matched with a case library, the method further includes: if there is no matching result in both the paradigm question library and the case library, aggregating and saving a corresponding analysis report.

[0025] Furthermore, before performing paradigm analysis on the process analysis report and matching the case library to obtain the process fault analysis result, it also includes: summarizing new problems and importing them into the case library or paradigm problem library; importing new case information into the case library or paradigm problem library.

[0026] The present invention also provides a process fault analysis system, comprising:

[0027] The client is used to obtain system load information and process information according to the monitoring frequency, select the process whose resource usage is greater than the basic index as the abnormal process, obtain the log information of the first moment and the previous moment of the abnormal process, and the first moment and the previous moment are adjacent moments in the monitoring frequency; it is also used to pre-process the log information to obtain a process analysis report and send it to the analysis center, and it is also used to dynamically adjust the monitoring frequency according to the fluctuation of the system load;

[0028] The analysis center is used to obtain the process analysis report, and then perform paradigm analysis on the process analysis report and match the case library to obtain the process fault analysis results.

[0029] Compared with the prior art, the advantages of the present invention are:

[0030] The present invention dynamically adjusts the monitoring frequency of the process according to the fluctuation of resource occupancy rate, and can quickly locate the abnormal process by comparing the resource occupancy rate of the process. After pre-processing the log file of the abnormal process and performing case library matching, the known problems can be quickly identified and solutions can be given. At the same time, accurate analysis results can be obtained through paradigm analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 4 is a system structure diagram of an embodiment of the present invention.

[0032] Figure 2 The figure is a flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The present invention is further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.

[0034] This embodiment proposes a process fault analysis method, which provides process-level problem location and fault analysis for the Linux operating system. By regularly checking the system load status and the status of the processes running on the system, problems can be identified in a timely manner, and key log information before and during the fault can be obtained. In addition, the design implements an analysis center that intelligently and automatically analyzes process problems, greatly improving the efficiency of locating problems. Figure 1 As shown, it includes the client and the analysis center. The method is as follows:

[0035] 1. Deploy a daemon process in the client that is responsible for monitoring and analysis: obtain system load information and process information regularly, and perform preliminary analysis to find abnormal processes.

[0036] 2. Client analysis and summary and monitoring strategy adjustment: Through preliminary analysis of relevant information of the process and summarization according to the specified template, output the analysis report of the process and dynamically adjust the monitoring strategy.

[0037] 3. Analysis center: As the server, it performs paradigm analysis on the content of the analysis report, matches it with the central case library, and outputs the final analysis results.

[0038] The specific implementation is as follows:

[0039] Daemon responsible for lightweight analysis in monitoring:

[0040] At present, system-level monitoring generally monitors the system load, memory usage, and CPU usage, while the monitoring in this embodiment is more fine-grained and intelligent. Through the system monitoring during the warm-up period, the system load during normal business operation is obtained, and the basic indicators are confirmed. Subsequently, the obtained system indicators are compared with the basic indicators to identify abnormal system load. The processes are sorted according to the load through common load analysis methods such as system tools top and ps, and abnormal processes are obtained. The log information and stack of the process are obtained at a certain frequency and dumped.

[0041] Analysis and summary and monitoring strategy adjustment:

[0042] Analysis and summarization refers to the pre-processing of the acquired process logs, summarizing the basic information of the process (including process name, process status, process startup method, process software package, execution time, etc.), process resource usage, process function call stack, etc. in a certain format in an analysis report of the specified date and time; monitoring strategy adjustment refers to the preliminary analysis based on the current logs. If the resource usage increase rate is too large, the monitoring frequency will be increased, otherwise the monitoring frequency will be reduced.

[0043] Analysis Center: The analysis center belongs to the server side, which packages the analysis reports collected by the client monitoring and transmits them to the server side. The server side conducts in-depth analysis of the process log information, including paradigm analysis, case library matching, etc., and outputs an overview of the analysis results. The case library and paradigm analysis templates of the analysis center can be continuously updated and improved by the background. The analysis center also includes monitoring and analysis programs for batch deployment of clients.

[0044] Based on the above ideas, Figure 2 As shown, the method of this embodiment includes the following steps:

[0045] S101) The client locates the abnormal process and performs preliminary analysis, including:

[0046] Obtain system load information and process information according to the monitoring frequency, select processes whose resource usage is greater than the basic index as abnormal processes, and obtain log information before and during the abnormal process failure;

[0047] Preprocessing the log information to obtain a process analysis report, and sending the process analysis report to the analysis center;

[0048] Dynamically adjust the monitoring frequency according to the fluctuation of system load. After the monitoring frequency is adjusted, the client obtains system load information and process information according to the new monitoring frequency to conduct a new round of abnormal process location and preliminary analysis;

[0049] S102) The analysis center parses the process analysis report and performs in-depth analysis, including:

[0050] Perform paradigm analysis on the process analysis report and match it with the case library to obtain the process fault analysis results.

[0051] In this embodiment, when a process whose load is greater than the basic index is selected as an abnormal process, it includes:

[0052] Compare the system load information at adjacent times. Adjacent times specifically refer to the adjacent times corresponding to the monitoring frequency. For example, if the monitoring frequency is to obtain data every 5 minutes, the difference between adjacent times is 5 minutes.

[0053] If the fluctuation of the system load at the first moment compared to the system load at the previous moment is greater than a preset threshold, the resource occupancy of all processes at the first moment is sorted to obtain a process list, and the process list is traversed to find the process whose resource occupancy is greater than the basic indicator as an abnormal process. In this embodiment, CPU utilization is used for both system load and resource occupancy, and the preset threshold is 10%. The type of system load and resource occupancy, as well as the preset threshold can be adjusted according to actual needs.

[0054] In this embodiment, when obtaining the log information of the abnormal process before and during the failure, the moment when the fluctuation of the system load compared with the previous moment is greater than the preset threshold is detected, that is, the aforementioned first moment is taken as the moment during the failure, and the log information of the abnormal process at the first moment is obtained as the log information during the failure; correspondingly, the second moment before the first moment is taken as the moment before the failure, and the fluctuation of the system load at the second moment and the system load at the previous adjacent moment of the second moment is less than the preset threshold, and the log information of the abnormal process at the second moment is obtained as the log information before the failure.

[0055] For example, when the fluctuation is first obtained to be greater than the preset threshold, the corresponding moment is the first moment, and the log information of the abnormal process at the first moment is the log information during the fault, and the adjacent moment before the first moment is the second moment, and the log information of the abnormal process at the second moment is the log information before the fault.

[0056] In this embodiment, when the log information is preprocessed to obtain a process analysis report, it includes: extracting target information from the log information, the target information specifically refers to the basic information of the process in the log information obtained at corresponding moments before and during the fault (including process name, process status, process startup method, software package to which the process belongs, execution time, etc.), the resource usage of the process (memory, CPU usage, file handle usage during collection), the memory distribution of the process (including user state, kernel, file page, anonymous page, swap usage, etc.), the function call stack of the process, and the message log of the kernel error before the corresponding moment, and then, generating a process analysis report according to a specified format for the target information, specifically summarizing the aforementioned target information in a specified format in an analysis report of a specified date and time, and the specified format and the specified date and time can be adjusted according to actual needs.

[0057] In this embodiment, dynamically adjusting the monitoring frequency according to the fluctuation of the system load includes:

[0058] Obtaining the result of comparing the system load information at the adjacent moments;

[0059] If the fluctuation of the system load at adjacent moments is greater than the preset threshold, the monitoring frequency is increased. For example, the original monitoring frequency is to obtain data every 5 minutes. The increased monitoring frequency reduces the time interval between obtaining data on both sides and becomes to obtain data every 1 minute. The time interval coefficient of the monitoring frequency is 0.2. The time interval coefficient of the monitoring frequency can also be adjusted according to actual needs.

[0060] If the fluctuation of the system load at adjacent moments is greater than the preset threshold, the monitoring frequency is maintained;

[0061] If the fluctuations of the system load at a specified number of adjacent moments are all smaller than the preset threshold, the monitoring frequency is restored to the initial value. The specified number in this embodiment is 3. For example, after the monitoring frequency is modified to obtain data once every 1 minute, the fluctuations of the system load at adjacent moments obtained for the next 3 consecutive minutes are all smaller than the preset threshold, the monitoring frequency is restored to obtain data once every 5 minutes.

[0062] In this embodiment, when the analysis center performs paradigm analysis on the process analysis report and matches the case library to obtain the process fault analysis results, it includes: reading the target information in the process analysis report of the specified client, performing paradigm analysis on the target information and matching the case library. The specified client can be a specified client or multiple specified clients, thereby enabling the server to specify or batch perform in-depth summary analysis on the client's process analysis report.

[0063] In this embodiment, performing paradigm analysis on the target information and matching the case library includes the step of performing paradigm analysis on the target information, specifically including: matching the target information with a preset paradigm question library to obtain corresponding paradigm steps, performing judgment analysis on the target information in turn according to the paradigm steps to obtain analysis results of each judgment branch, wherein the paradigm step includes multiple step fields, and each step field includes a judgment branch and an analysis indication to perform paradigm step switching and problem judgment.

[0064] Specifically, paradigm analysis means that the analysis center can identify that the problem belongs to a certain module or a certain type of problem based on an error log or a function call stack or resource usage characteristics. The analysis methods of the module or this type of problem have been sorted out as paradigm steps based on experience. Information can be extracted in sequence according to the steps for judgment and analysis. Each judgment branch can obtain analysis results, and finally the analysis results of logs at multiple time points are compared and summarized and output into an analysis report overview.

[0065] The paradigm steps, problem description, error log keywords, function call stack, and resource usage characteristics of the paradigm analysis are stored in a database table with the problem ID as the primary key. The paradigm steps include multiple step fields, each of which has a judgment branch and analysis instructions, which can be used to switch paradigm steps and determine problems. The results of the paradigm analysis output to the analysis report overview must include the paradigm problem ID, problem description, the selection and cause of the paradigm analysis judgment branch, and the analysis results.

[0066] In this embodiment, performing paradigm analysis on the target information and matching the case library includes the step of matching the target information with the case library, specifically including: traversing all information in the preset case library and matching it with the target information, and taking the information with a matching degree greater than the target value as the matching result. In this embodiment, the target value is 90%, and the target value can be adjusted according to actual conditions.

[0067] Specifically, the case library is implemented as a lightweight database table such as sqlite3. The fields must contain case ID, case name, keyword feature code, function call stack, problem cause, and solution. Matching is performed based on the keyword feature code, function call stack, and case library records in the analysis report at each time point. A match is considered successful if the match degree reaches 90%. The matching results of analysis reports at multiple time points are compared and summarized and output to the analysis report overview. The output results include case name, problem cause, and solution.

[0068] In this embodiment, before performing paradigm analysis on the process analysis report and matching the case library to obtain the process fault analysis result, a learning step of the analysis center is also included, including:

[0069] Summarize new problems and import them into case libraries or paradigm problem libraries. For example, when R&D technicians locate and analyze problems and summarize them, they import them into case libraries or paradigm problem libraries according to established templates.

[0070] Import new case information into the case library or paradigm question library. For example, case information such as buglist maintained by an organization unit can be automatically compiled and entered into the case library or paradigm question library through scripts.

[0071] In this embodiment, when the target information is subjected to paradigm analysis and matched to the case library, it also includes processing steps when the problem cannot be solved through the case library and paradigm analysis: if there is no matching result in the paradigm problem library and the case library, the corresponding analysis reports are summarized and saved, and the analysis center obtains the analysis reports and logs at each time point for further analysis by R&D. The summarized and organized logs can assist R&D in quickly locating the problem.

[0072] This embodiment also provides a process fault analysis system, including:

[0073] The client is used to obtain system load information and process information according to the monitoring frequency, select the process whose resource usage is greater than the basic index as the abnormal process, obtain the log information of the first moment and the previous moment of the abnormal process, and the first moment and the previous moment are adjacent moments in the monitoring frequency; it is also used to pre-process the log information to obtain a process analysis report and send it to the analysis center, and it is also used to dynamically adjust the monitoring frequency according to the fluctuation of the system load;

[0074] The analysis center is used to obtain the process analysis report, and then perform paradigm analysis on the process analysis report and match the case library to obtain the process fault analysis results.

[0075] The process failure analysis system of this embodiment works as follows:

[0076] (1) The client program starts a background thread to monitor system load and memory resource usage;

[0077] (2) After starting monitoring, obtain the average CPU usage every X (default 5) minutes, compare the last value with the previous value, and sort the CPU usage list of the process if the fluctuation is greater than M (default 10)%, traverse the process to find the process with a CPU greater than X, and immediately collect two consecutive process log information, including the basic information of the process, the resource usage of the process, the user state and kernel state stack of the process, etc., save it in a file with the date and time as the file name, and reduce X (X = 0.2*X). If the fluctuation is less than M%, continue to compare, and if the fluctuation is less than M% for three consecutive comparisons, then restore X. (This block calculation method is only an example of one method, and other algorithms can be used instead);

[0078] (3) Preprocess each log file and collect basic process information: process name, process resource usage (memory, CPU usage, file handle usage during collection), process memory distribution (including user state, kernel, file page, anonymous page, swap usage, etc.), process function call stack, and kernel error message log 1 minute before the current time point;

[0079] (4) The analysis center uses IP and host name as a server to manage the client. The server can monitor the process of the client in batches, collect analysis reports, etc. The server can perform in-depth summary analysis of the client analysis reports in batches or in specific batches, that is, perform paradigm analysis and case library matching.

[0080] (5) Paradigm analysis means that the analysis center can identify that the problem belongs to a certain module or a certain type of problem based on an error log or a function call stack or resource usage characteristics. The analysis methods of the module or the type of problem have been sorted out as paradigm steps based on experience. Information can be extracted in sequence according to the steps for judgment and analysis. Each judgment branch can obtain analysis results. Finally, the analysis results of the logs at multiple time points are compared and summarized and output to the analysis report overview.

[0081] The paradigm steps, problem description, error log keywords, function call stack, and resource usage characteristics of the paradigm analysis are stored in a database table with the problem ID as the primary key. The paradigm steps include multiple step fields, each of which has a judgment branch and analysis instructions, which can be used to switch paradigm steps and determine problems. The results of the paradigm analysis output to the analysis report overview must include the paradigm problem ID, problem description, the selection and cause of the paradigm analysis judgment branch, and the analysis results.

[0082] (6) Matching of case libraries. The case libraries are implemented as lightweight database tables such as sqlite3. The fields must contain case ID, case name, keyword signature, function call stack, problem cause, and solution. Matching is performed based on the keyword signature, function call stack, and case library records in the analysis report at each time point. A match is considered successful if the match degree reaches 90%. The matching results of the analysis reports at multiple time points are compared and summarized and output to the analysis report overview. The output results include case name, problem cause, and solution.

[0083] (7) Analysis center learning: After R&D technicians locate and analyze the problem, they summarize the problem and import it into the case library or paradigm problem library according to the established template; the case information such as the buglist maintained by the organization unit is automatically organized and entered into the case library or paradigm problem library through scripts.

[0084] (8) When the problem cannot be solved through case library and paradigm analysis, the analysis center obtains the time point analysis report and logs for further analysis by R&D. The logs summarized here can help R&D quickly locate the problem.

[0085] In summary, the present invention implements process fault analysis based on the Linux system, and has the following advantages:

[0086] First, for application process problems on the operating system, the paradigm analysis concept and the case matching analysis method of the analysis center are used. The case library matching analysis can quickly identify known problems and provide solutions. The paradigm problem analysis can perform automated if-else analysis based on the existing paradigm analysis steps, output the cause and conclusion of each judgment branch, and obtain analysis results or assist R&D in analyzing problems.

[0087] Second, the monitoring and analysis strategy for processes on the operating system can automatically monitor and analyze application process problems on the operating system and dynamically adjust the monitoring frequency by identifying problems with specific processes through load retrieval. This greatly frees up O&M and R&D manpower, and can also obtain valuable log information and analysis overviews before and during failures, helping R&D personnel locate difficult problems.

[0088] Third, the client-server process monitoring and analysis mode can not only be deployed in batches, but also continuously improve the analysis center and paradigm analysis. The client-server monitoring and analysis mode can be used as a carrier for R&D personnel to locate problems. With the continuous entry of the paradigm analysis framework of R&D and the continuous "learning" of the analysis center case library, when the case library and paradigm problem library of the analysis center learn to a certain extent, it can greatly improve the accuracy of problem analysis, quickly locate and solve problems, and greatly improve the availability, reliability and stability of the operating system.

[0089] The above is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment, it is not intended to limit the present invention. Therefore, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A process fault analysis method, characterized in that: The following steps are involved: Obtain system load information and process information according to the monitoring frequency, select processes whose resource usage is greater than the basic index as abnormal processes, and obtain log information before and during the abnormal process failure; Preprocess the log information to obtain a process analysis report, and dynamically adjust the monitoring frequency according to the fluctuation of system load; Perform paradigm analysis on the process analysis report and match it with the case library to obtain the process fault analysis results.

2. The process fault analysis method according to claim 1, characterized in that: When selecting a process with a load greater than the basic indicator as an abnormal process, it includes: Compare system load information at adjacent times; If the fluctuation of the system load at the first moment compared with the system load at the previous moment is greater than a preset threshold, the resource usage of all processes at the first moment is sorted to obtain a process list, and the process list is traversed to find the process whose resource usage is greater than the basic indicator as an abnormal process.

3. The process fault analysis method according to claim 2, characterized in that: When obtaining log information before and during an abnormal process failure, it includes: Taking the first moment as the moment of the fault, obtaining the log information of the abnormal process at the first moment as the log information of the fault; The second moment is taken as the moment before the failure, the second moment is before the first moment, and the fluctuation of the system load at the second moment and the system load at the previous moment of the second moment is less than a preset threshold, and the log information of the abnormal process at the second moment is obtained as the log information before the failure.

4. The process fault analysis method according to claim 2, characterized in that: When dynamically adjusting the monitoring frequency based on fluctuations in system load, this includes: Obtain the results of comparing system load information at adjacent moments; If the fluctuation of the system load at adjacent moments is greater than the preset threshold, the monitoring frequency is increased; If the fluctuation of the system load at adjacent moments is less than the preset threshold, the monitoring frequency is maintained; If the fluctuations of the system load at a specified number of adjacent moments are all less than the preset threshold, the monitoring frequency is restored to the initial value.

5. The process fault analysis method according to claim 1, characterized in that: When the log information is preprocessed to obtain a process analysis report, it includes: extracting target information from the log information, and generating a process analysis report according to a specified format for the target information; when the process analysis report is subjected to paradigm analysis and matched with a case library to obtain a process fault analysis result, it includes: reading the target information in the process analysis report, and conducting paradigm analysis on the target information and matching with a case library.

6. The process fault analysis method according to claim 5, characterized in that: Performing paradigm analysis on the target information and matching the case library includes the steps of performing paradigm analysis on the target information, specifically including: matching the target information with a preset paradigm question library to obtain corresponding paradigm steps, performing judgment analysis on the target information in turn according to the paradigm steps to obtain analysis results of each judgment branch, wherein the paradigm step includes multiple step fields, and each step field includes a judgment branch and an analysis indication to perform paradigm step switching and problem judgment.

7. The process fault analysis method according to claim 5, characterized in that: Performing paradigm analysis on the target information and matching the case library includes the step of matching the target information with the case library, specifically including: traversing all information in the preset case library and matching with the target information, and taking the information with a matching degree greater than the target value as the matching result.

8. The process fault analysis method according to claim 6 or 7, characterized in that: When the target information is subjected to paradigm analysis and matched with a case library, the method further includes: if there is no matching result in the paradigm question library and the case library, a corresponding analysis report is summarized and saved.

9. The process fault analysis method according to claim 1, characterized in that: Before performing paradigm analysis on the process analysis report and matching the case library to obtain the process fault analysis result, it also includes: summarizing new problems and importing them into the case library or paradigm problem library; importing new case information into the case library or paradigm problem library.

10. A process fault analysis system, characterized in that: include: The client is used to obtain system load information and process information according to the monitoring frequency, select the process whose resource usage is greater than the basic index as the abnormal process, obtain the log information of the first moment and the previous moment of the abnormal process, and the first moment and the previous moment are adjacent moments in the monitoring frequency; it is also used to pre-process the log information to obtain a process analysis report and send it to the analysis center, and it is also used to dynamically adjust the monitoring frequency according to the fluctuation of the system load; The analysis center is used to obtain the process analysis report, and then perform paradigm analysis on the process analysis report and match the case library to obtain the process fault analysis results.

Images