Application program exception monitoring method and device, equipment, medium and product

Abstract

The invention discloses an exception monitoring method, device and equipment for an application program, a medium and a product, and relates to the technical field of network monitoring, the method comprises the following steps: determining a core service of a to-be-monitored application program based on type information of the to-be-monitored application program, the core service comprising at least one sub-service; determining a target risk area of the to-be-monitored application program based on the core service and a preset corresponding relationship between the service and the risk area, the target risk area comprising at least one sub-risk area, and the sub-risk areas being in one-to-one correspondence with the sub-services; and determining a monitoring result of the to-be-monitored application program based on the operation information of the monitoring point of each sub-risk area. The monitoring result of the to-be-monitored application program is determined according to the operation information of the monitoring points of the risk area of the core business of the to-be-monitored application program, the workload of data acquisition work and processing work is reduced under the condition that the monitoring accuracy is ensured, and the efficiency of application program monitoring work is improved.

Description

Technical Field

[0001] The present invention relates to the field of network monitoring technology, and in particular to an abnormality monitoring method, device, equipment, medium and product for application programs. Background Art

[0002] With the popularity of mobile devices, mobile applications have become the core tools in daily life. In order to make the user experience stable and smooth, the performance monitoring of mobile applications is one of the key issues that has received much attention in the field of network monitoring.

[0003] The existing application monitoring method is to collect key performance indicators such as the application's processor and memory usage, parse the collected data, and obtain the application's monitoring report. However, if the sufficiently detailed user behavior path and code execution details cannot be captured, it will be impossible to timely analyze and locate the abnormal location and cause of the abnormality in the application, affecting the accuracy of the application's problem location and the efficiency of solving the problem. Secondly, once a large amount of application operation data needs to be collected, it will extend the duration of the application monitoring work and reduce the application monitoring efficiency. Summary of the invention

[0004] The present invention provides an application abnormality monitoring method, device, equipment, medium and product, which determine the monitoring results of the application to be monitored based on the operating information of the monitoring points in the risk area of ​​the core business of the application to be monitored, greatly reduce the workload of data acquisition and processing work while ensuring the accuracy of monitoring, improve the efficiency of application monitoring work, and ensure the effectiveness of monitoring conclusions.

[0005] According to one aspect of the present invention, a method for monitoring anomalies of an application is provided, the method comprising:

[0006] Determining a core business of the application to be monitored based on the type information of the application to be monitored, wherein the core business includes at least one sub-core business;

[0007] Based on the core business and the correspondence between the pre-set business and risk areas, determine the target risk area of ​​the application to be monitored, wherein the target risk area includes at least one sub-risk area, and the sub-risk area corresponds to the sub-core business one by one;

[0008] Based on the operation information of the monitoring points in each sub-risk area, the monitoring results of the application to be monitored are determined.

[0009] According to another aspect of the present invention, a device for monitoring anomalies of an application is provided. The device for monitoring anomalies of an application is used to implement the method for monitoring anomalies of an application in any embodiment of the present invention. The device includes:

[0010] A service acquisition module, used to determine the core service of the application to be monitored based on the type information of the application to be monitored, wherein the core service includes at least one sub-core service;

[0011] A region determination module, used to determine the target risk region of the application to be monitored based on the core business and the pre-set correspondence between the business and the risk region, wherein the target risk region includes at least one sub-risk region, and the sub-risk region corresponds to the sub-core business one by one;

[0012] The application diagnosis module is used to determine the monitoring results of the application to be monitored based on the operation information of the monitoring points in each sub-risk area.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and a memory communicatively coupled to the at least one processor;

[0015] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the method for abnormality monitoring of an application program in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions for implementing the method for monitoring anomalies of an application program in any embodiment of the present invention when the computer instructions are executed by a processor.

[0017] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the method for monitoring anomalies of an application program according to any embodiment of the present invention is implemented.

[0018] The abnormal monitoring method of the application of the present invention includes: determining the core business of the application to be monitored based on the type information of the application to be monitored, wherein the core business includes at least one sub-core business; determining the target risk area of ​​the application to be monitored based on the correspondence between the core business and the pre-set business and risk area, wherein the target risk area includes at least one sub-risk area, and the sub-risk area corresponds to the sub-core business one by one; determining the monitoring result of the application to be monitored based on the operation information of the monitoring points of each sub-risk area. The technical scheme of the present invention determines the monitoring result of the application to be monitored according to the operation information of the monitoring points of the risk area of ​​the core business of the application to be monitored. The operation information of the monitoring points of the risk area of ​​the core business is representative and can represent the operation status of the application to be monitored. While ensuring the accuracy of monitoring, the workload of data acquisition and processing is greatly reduced, the efficiency of application monitoring is improved, and the effectiveness of monitoring conclusions is guaranteed. The problem of parsing the collected data such as the processor and memory usage of the application to obtain the application monitoring report has been solved. If the user behavior path and code execution details cannot be captured in sufficient detail, it will be impossible to timely analyze and locate the abnormal location and cause of the abnormality in the application, affecting the accuracy of locating the problem and the efficiency of solving the problem. If a large amount of application operation data needs to be collected, the duration of the application monitoring work will be extended, and the low monitoring efficiency of the application will be reduced.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0021] Figure 1 It is a flowchart of an abnormality monitoring method for an application program provided by the present invention;

[0022] Figure 2 It is a flow chart of another abnormality monitoring method for an application program provided by the present invention;

[0023] Figure 3 It is a schematic diagram of an abnormal link monitoring operation provided by the present invention;

[0024] Figure 4It is a schematic diagram of a forward link monitoring operation provided by the present invention;

[0025] Figure 5 It is a schematic diagram of a local log monitoring work provided by the present invention;

[0026] Figure 6 It is a structural schematic diagram of an abnormality monitoring device for an application program provided by the present invention;

[0027] Figure 7 It is a structural schematic diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] At present, the monitoring methods of applications mainly rely on Bugly or Sensors data. The above two methods have shortcomings such as insufficient data granularity, real-time priority, poor relevance to specific businesses, and poor depth of log analysis. Insufficient data granularity means that the current monitoring solutions often cannot capture sufficiently detailed user behavior paths and code execution details, which leads to challenges in analyzing and locating the specific causes of problems in applications. The lack of in-depth insights makes it difficult for developers to quickly understand the context and root causes of the problem, affecting the efficiency and accuracy of problem solving. Limited real-time performance means that there is a delay in data updates in some monitoring systems, which cannot achieve true real-time monitoring, and cannot promptly notify relevant developers to solve problems. Poor relevance to specific businesses means that although the current monitoring framework provides a wide range of performance and user behavior monitoring functions for mobile applications, it lacks customized real-time monitoring capabilities for specific business needs. This means that although it can capture and analyze general performance indicators and user behavior patterns, it is not enough to identify and respond to subtle changes and needs specific to individual business logic or user scenarios, and the accuracy of business monitoring and problem diagnosis is slightly poor. Poor depth of log analysis means that the current solutions all provide general solutions and do not have the ability to conduct in-depth business impact analysis, which affects the identification and resolution of complex business problems.

[0031] The abnormality monitoring method of the application of the present invention includes three parts: abnormality monitoring, forward link monitoring and local log monitoring. The abnormality monitoring focuses on monitoring the core business. The core business is representative and is used to maintain the operation of the application. The preliminary diagnostic conclusion of the application can be quickly obtained. Abnormal monitoring monitors all businesses of the application to ensure the comprehensiveness of the diagnostic conclusion of the application. Local log monitoring processes the local data of the client that reports the abnormality, analyzes the abnormal information of the client in detail, and ensures the integrity of the monitoring work. The method of the present invention aims to solve the defects in the existing monitoring methods, and realize the optimization of user experience, improve the real-time performance of monitoring, enhance data granularity, support customized monitoring of specific businesses, simplify operation and analysis processes, improve problem solving efficiency, intelligently analyze logs and help solve difficult problems.

[0032] Figure 1 This is a flow chart of an abnormality monitoring method for an application provided by the present invention. This embodiment can be used to quickly, efficiently, accurately, personally and specifically determine whether the application to be monitored has abnormalities. The method can be executed by the abnormality monitoring device for an application provided by the present invention. The device can be implemented in the form of hardware and / or software. In a specific embodiment, the device can be integrated in an electronic device. The following embodiments will be described by taking the device integrated in an electronic device as an example. Figure 1 , the method specifically comprises the following steps:

[0033] S101. Determine the core business of the application to be monitored based on the type information of the application to be monitored.

[0034] Among them, the applications to be monitored can be understood as applications that need to be monitored online, including but not limited to recruitment applications, web access applications, information search applications, audio and video applications, and shopping applications. Type information can be understood as data that describes the characteristics and attributes of the application, which is the unique identity information of the application and is used to assist users, developers, and operating systems in understanding the functions, uses, and compatibility of the application. Type information includes but is not limited to application name, version number, developer information, operating system compatibility, file type association, permission requirements, function description, system resource requirements, dependencies, license information, update information, user interface language, and supported hardware. The application includes multiple functions. The core business of the application to be monitored can be understood as the main function and / or purpose of the application, which is the main reason for the existence and use of the application. The core business includes but is not limited to functional positioning, user value, core processes, user interaction, data processing, business logic, performance requirements, security, scalability, user experience, compliance, and business model.

[0035] Specifically, the core business can be understood as the mainstream business of the application to be monitored, the main business of the application to be monitored, or the supporting business of the application to be monitored. The core business includes at least one sub-core business. Different applications have different core businesses. The application to be monitored can be located according to the type of the application to be monitored, and the core business of the application to be monitored can be determined.

[0036] For example, assume that the core business of a recruitment application is to create a resume, query recruitment information, and submit a resume, and the core business of a shopping application is to place an order, display a product, index a product, and recommend product-related information. If the type of application to be monitored is a recruitment type, the core business is determined to be the resume creation, query recruitment information, and submit a resume; if the type of application to be monitored is a shopping type, the core business is determined to be the order placement, display a product, index a product, and recommend product-related information.

[0037] The advantage of this setting is that it can quickly locate the core business of the application that needs to be monitored, thereby improving the monitoring efficiency of the application.

[0038] S102: Determine the target risk area of ​​the application to be monitored based on the core business and the pre-set correspondence between the business and the risk area.

[0039] Among them, the correspondence between the pre-set businesses and risk areas can be understood as the positioning method of the risk areas of each core business set in advance. The target risk area of ​​the application to be monitored can be understood as the potential risk area of ​​the application to be monitored. Monitoring the target risk area can be understood to some extent as monitoring the application to be monitored. The target risk area includes at least one sub-risk area, and the sub-risk area corresponds one-to-one to the sub-core business.

[0040] Exemplarily, it is assumed that the pre-set correspondence between businesses and risk areas indicates that the sub-risk area corresponding to business 1 is area 1, the sub-risk area corresponding to business 2 is area 2, the sub-risk area corresponding to business 3 is area 3, the sub-risk area corresponding to business 4 is area 4, and the sub-risk area corresponding to business 5 is area 5. If the core businesses are business 2, business 1, and business 4, the target risk area is determined to be the set of areas consisting of area 1, area 2, and area 3.

[0041] Specifically, potential risk areas include areas that must be monitored by the application to be monitored, empirical monitoring areas, and areas where anomalies have occurred in the past. The purpose of this setting is to minimize the amount of information that needs to be processed while ensuring the accuracy of the monitoring conclusions, reduce the workload of the processor, and improve the monitoring efficiency of the application.

[0042] S103: Determine the monitoring result of the application to be monitored based on the operation information of the monitoring points of each sub-risk area.

[0043] The risk area will carry out tracking to obtain operation information at fixed locations. Each core business of the present invention has its own tracking rules. The monitoring points in the sub-risk area can be understood as the code or tool inserted in the core business of the application to record specific user behaviors or events. The monitoring points include but are not limited to interception monitoring points and key position calibration points. The operation information can be understood as the user behavior or events obtained by the monitoring points. The monitoring results of the application to be monitored can be understood as the monitoring conclusions of the application to be monitored, which are used to indicate whether the application to be monitored has abnormalities, whether debugging is required, how to debug, etc. This embodiment does not limit this.

[0044] Specifically, by analyzing the operation information of the monitoring points of each sub-risk area, it can be determined whether there are any abnormalities in the core business corresponding to each sub-risk area, and then determine whether there are any abnormalities in the application to be monitored. For example, if the core business corresponding to each sub-risk area is normal, the monitoring result of the application to be monitored is normal. If there is an abnormality in the core business corresponding to the sub-risk area, it is necessary to further analyze the cause of the abnormality of the core business, for example, the core business itself has an operational abnormality, and the dependency of the core business has an abnormality, so as to generate a monitoring report for the application to be monitored, provide data support for operation and maintenance personnel to repair the application, shorten the operation and maintenance time, and improve the operation and maintenance efficiency.

[0045] It is worth noting that the present invention can use an intelligent algorithm model to determine monitoring points, improve the efficiency of determining monitoring points, actively identify and collect data that may cause errors, and at the same time, control the intelligent algorithm model to continuously learn the captured data, continuously optimize the error monitoring model, improve the accuracy of monitoring, and reduce the false alarm rate.

[0046] The technical solution of this embodiment determines the monitoring result of the application to be monitored based on the operating information of the monitoring points in the risk area of ​​the core business of the application to be monitored. The operating information of the monitoring points in the risk area of ​​the core business is representative and can represent the operating status of the application to be monitored. While ensuring the accuracy of monitoring, the workload of data acquisition and processing is greatly reduced, the efficiency of application monitoring is improved, and the effectiveness of monitoring conclusions is guaranteed. The problem of parsing the collected data such as the processor and memory usage of the application to obtain the monitoring report of the application is solved. If the user behavior path and code execution details that are fine enough cannot be captured, the abnormal location and cause of the abnormality in the application cannot be analyzed and located in time, which affects the accuracy of problem location and the efficiency of solving the problem of the application. If a large amount of application operation data needs to be collected, the duration of application monitoring will be extended, and the monitoring efficiency of the application will be reduced.

[0047] Figure 2 This is a flow chart of another abnormality monitoring method for an application provided by the present invention. This embodiment can be used to quickly, efficiently, accurately, personally and specifically determine whether the application to be monitored has abnormalities. The method can be executed by the abnormality monitoring device for an application provided by the present invention. The device can be implemented in the form of hardware and / or software. In a specific embodiment, the device can be integrated in an electronic device. The following embodiments will be described by taking the device integrated in an electronic device as an example. Figure 2 , the method specifically comprises the following steps:

[0048] S201. Determine the core business of the application to be monitored based on the type information of the application to be monitored.

[0049] In this embodiment, the application to be monitored can be understood as an application that needs to be monitored online, including but not limited to recruitment applications, web access applications, information retrieval applications, audio and video applications, and shopping applications. The type information can be understood as data that describes the characteristics and attributes of the application, which is the unique identity information of the application and is used to assist users, developers, and operating systems in understanding the functions, uses, and compatibility of the application. The type information includes but is not limited to the application name, version number, developer information, operating system compatibility, file type associations, permission requirements, function descriptions, system resource requirements, dependencies, license information, update information, user interface language, and supported hardware. The application includes multiple functions, and the core business of the application to be monitored can be understood as the main function and / or purpose of the application, which is the main reason for the existence and use of the application. The core business includes but is not limited to functional positioning, user value, core processes, user interaction, data processing, business logic, performance requirements, security, scalability, user experience, compliance, and business model.

[0050] Specifically, the core business can be understood as the mainstream business of the application to be monitored, the main business of the application to be monitored, or the supporting business of the application to be monitored. The core business includes at least one sub-core business. Different applications have different core businesses. The application to be monitored can be located according to the type of the application to be monitored, and the core business of the application to be monitored can be determined.

[0051] For example, assume that the core business of a recruitment application is to create a resume, query recruitment information, and submit a resume, and the core business of a shopping application is to place an order, display a product, index a product, and recommend product-related information. If the type of application to be monitored is a recruitment type, the core business is determined to be the resume creation, query recruitment information, and submit a resume; if the type of application to be monitored is a shopping type, the core business is determined to be the order placement, display a product, index a product, and recommend product-related information.

[0052] S202: Use the core business to search in the correspondence between the business and the risk area to obtain the first risk area of ​​the application to be monitored.

[0053] The correspondence between businesses and risk areas can be understood as an information table that records the areas that must be monitored for each business, and the first risk area is a necessary monitoring area for the core business.

[0054] Specifically, the present invention searches the corresponding relationship between the business and the risk area through the core business, and determines the matched area as the first risk area of ​​the application to be monitored. The advantage of this setting is that the necessary monitoring area of ​​the application to be monitored can be determined quickly, efficiently and accurately.

[0055] It is worth noting that the correspondence between business and risk areas is updated regularly. The purpose of this setting is to ensure the real-time correspondence between business and risk areas, and to ensure the accuracy of the necessary monitoring areas and the correctness of the monitoring results.

[0056] S203: Determine a second risk area of ​​the application to be monitored based on the received supplementary monitoring instruction of the core business.

[0057] Among them, the supplementary monitoring instructions can be understood as monitoring instructions manually triggered by monitoring workers. The supplementary monitoring instructions contain empirical monitoring information, that is, the risk areas that need to be monitored determined by monitoring personnel based on monitoring experience. The second risk area is the empirical monitoring area of ​​the core business.

[0058] Specifically, the supplementary monitoring instruction includes regional indication information of the empirical monitoring area of ​​the core business of the application to be monitored, and determining the second risk area of ​​the application to be monitored is to determine the empirical monitoring area according to the regional indication information of the empirical monitoring area in the supplementary monitoring instruction.

[0059] S204: Determine a third risk area of ​​the application to be monitored based on historical monitoring information of the core business.

[0060] The historical monitoring information can be understood as the historical monitoring data of the application to be monitored, and the third risk area is the area corresponding to the abnormal monitoring information in the historical monitoring information. The advantage of this setting is that the area where historical failures occurred can be monitored to improve the reliability of the monitoring conclusion.

[0061] S205: Determine a collection of the first risk area, the second risk area, and the third risk area as a target risk area.

[0062] Specifically, the collection of the first risk area, the second risk area and the third risk area is determined as the target risk area, but if there are repeated areas, only one area is retained in the collection. The purpose of this setting is to reduce unnecessary data acquisition work and save processor power consumption.

[0063] The advantage of the target risk area setting method of the present invention is that it ensures the accuracy of the monitoring conclusion while screening typical risk areas, determining the smallest and most comprehensive monitoring areas, and reducing the workload of the processor.

[0064] S206: Determine whether the operation information of the monitoring points in each sub-risk area meets the preset warning conditions.

[0065] In this embodiment, risk areas will be buried to obtain operation information at fixed locations. The monitoring points in the sub-risk areas can be understood as codes or tools inserted in the core business of the application to record specific user behaviors or events. The monitoring points include but are not limited to interception monitoring points and key location calibration points. The operation information can be understood as user behaviors or events obtained by the monitoring points. The preset warning conditions can be understood as the basis for judging whether the application to be monitored has anomalies that need to be alerted to the operation and maintenance personnel. For example, the abnormal data of the operation information of the monitoring points in each sub-risk area does not exceed the preset threshold. The preset threshold is determined based on the proportion of abnormal data in all access data and the average access data volume during the test time period (for example, it can be the product of the proportion of abnormal data in all access data and the average access data volume), which is used to quantify the warning conditions. This embodiment does not limit the specific value of the warning threshold.

[0066] Specifically, if the operation information of the monitoring points of each sub-risk area does not meet the preset warning conditions, S207 is executed; if there is operation data meeting the preset warning conditions in the operation information of the monitoring points of each sub-risk area, S208 is executed.

[0067] S207: Determine that the monitoring result of the application to be monitored is normal operation, and update the preset warning condition.

[0068] Among them, updating the preset warning conditions can be understood as adaptively reducing the warning threshold according to the preset rules. If the monitoring result of the application to be monitored is running normally or multiple monitoring results of the application to be monitored are running normally, the warning threshold can be adaptively reduced. The purpose of such setting is to ensure that the sensitivity and stability of the monitoring system are in the best state.

[0069] S208: Determine that the monitoring result of the application to be monitored is an operation abnormality, and determine abnormal warning information of the application to be monitored based on the operation data that meets the preset warning conditions.

[0070] Among them, the operating data that meets the preset warning conditions can be understood as data with operating abnormalities, and the abnormal warning information can be understood as the abnormal report of the monitored application that needs to be displayed, including but not limited to the abnormal type, abnormal location, abnormal cause and abnormal response measures, which is used to assist operation and maintenance personnel in debugging the monitored application.

[0071] Specifically, based on the operation data that meets the preset warning conditions, the abnormal warning information of the application to be monitored is determined. On the one hand, the amount of data processing can be reduced, and on the other hand, the abnormal position and abnormal type can be quickly and accurately located. Taking the recruitment application as an example, if the operation data that meets the preset warning conditions is a business of submitting resumes, then determining the abnormal type, abnormal location, abnormal cause and abnormal response measures will be related to the resume submission action. If the operation data that meets the preset warning conditions is a business of establishing a resume, then determining the abnormal type, abnormal location, abnormal cause and abnormal response measures will be related to the resume establishment action. The abnormal warning information of the present invention will be sent to the corresponding abnormal handling personnel in a timely manner to ensure that the relevant responsible persons can quickly receive accurate notifications and respond in a timely manner.

[0072] Exemplarily, taking a warning threshold of 100 as an example, abnormal data is accumulated by type and cleared periodically. If the accumulated amount of abnormal data of a certain type exceeds 100 at a certain moment, it is determined that there is an abnormality in the business of this type in the application.

[0073] For any sub-risk area, determining whether the operation information of the monitoring point in the sub-risk area meets the preset warning condition includes: determining whether the operation information of the monitoring point in the sub-risk area meets the abnormal calibration condition; if the operation information of the monitoring point in the sub-risk area does not meet the abnormal calibration condition, determining whether the number of abnormal operation data in the operation information of the monitoring point in the sub-risk area is greater than the warning value in the preset warning condition; when the number of abnormal operation data is not greater than the warning value in the preset warning condition, determining that the operation information of the monitoring point in the sub-risk area does not meet the preset warning condition; when the number of abnormal operation data is greater than the warning value in the preset warning condition, determining that the operation information of the monitoring point in the sub-risk area meets the preset warning condition; if the operation information of the monitoring point in the sub-risk area meets the abnormal calibration condition, determining whether the operation information of the monitoring point in the sub-risk area and the monitoring point in the sub-risk area are abnormal; when the operation information of the monitoring point in the sub-risk area is abnormal, obtaining the operation information of the monitoring point in the sub-risk area for a second time, and returning to the step of determining whether the operation information of the monitoring point in the sub-risk area meets the abnormal calibration condition; when the monitoring point in the sub-risk area is abnormal, updating the monitoring point in the sub-risk area, obtaining the operation information of the updated monitoring point in the sub-risk area, and returning to the step of determining whether the operation information of the monitoring point in the sub-risk area meets the abnormal calibration condition.

[0074] Before determining whether the operation information is abnormal, the present invention will verify the operation information to determine whether the abnormal information meets the abnormal calibration conditions. If it meets the abnormal verification conditions, it proves that there is a problem with the data, including data source abnormality and data acquisition abnormality. The data source abnormality refers to the abnormality of the monitoring point. For example, the monitoring point of the delivery establishment work appears in the monitoring point of the resume establishment work. It is necessary to re-determine the monitoring point and obtain the data information of the monitoring point. The data acquisition abnormality refers to the data of the collected operation information exceeding the range and not meeting the operation range of the operation information. It is necessary to obtain the operation information for a second time. The advantage of such a setting is that the operation information can be initially screened to avoid the processor processing the wrong data source and obtaining unreliable and useless diagnosis results, which not only ensures the reliability of the diagnosis results, but also reduces the workload of the processor.

[0075] The above monitoring logic is an abnormal monitoring logic. In order to improve the accuracy and comprehensiveness of monitoring, the present invention also sets a forward link monitoring logic, that is, to monitor all services of the application to be monitored and determine the comprehensiveness and persuasiveness of the monitoring conclusion. Specifically, the services that do not overlap with the core services in the service set of the application to be monitored will be determined as the remaining services; based on the corresponding relationship between the remaining services and the pre-set services and risk areas, the supplementary risk areas of the application to be monitored will be determined; based on the operating information of the monitoring points of the supplementary risk areas, the supplementary monitoring results of the application to be monitored will be determined; based on the supplementary monitoring results and the monitoring results, the target monitoring results of the application to be monitored will be determined.

[0076] Among them, the remaining business refers to all businesses except the core business in the application to be monitored. The supplementary risk area can be understood as the monitoring area of ​​the remaining business. Similarly, the supplementary risk area also includes the necessary monitoring area, the experience monitoring area and the historical monitoring area. The supplementary monitoring result can be understood as the diagnostic conclusion of the application to be monitored obtained after processing the operating information of the remaining business. The target monitoring result can be understood as the abnormal diagnostic conclusion or report of the application to be monitored determined by combining the remaining business and the core business. The target monitoring result of the application to be monitored determined based on the supplementary monitoring result and the monitoring result can be understood as a combination of the two monitoring conclusions to more comprehensively evaluate whether the application to be monitored has operational abnormalities.

[0077] It is worth noting that the implementation process and principle of the specific monitoring method for forward link monitoring and the monitoring method for abnormal monitoring are the same, the only difference is the data source and the monitoring point. The specific monitoring logic is not described in detail in this embodiment.

[0078] Abnormal link monitoring focuses on capturing and recording callback information in abnormal situations such as business failure, network failure, and software development kit (SDK) errors. It is a monitoring method for responding to failure situations. It can provide key error information and context when an error occurs inside the program and there is no normal callback. However, relying solely on abnormal link monitoring may ignore performance indicators and user behavior data in the normal process. Forward link monitoring can fill this gap well. Forward link monitoring can not only monitor the conversion rate of user processes and the execution time of each step, but also provide performance data of normal business processes, thereby helping the development team to optimize user experience and performance. In addition, forward link monitoring provides a more detailed business-level view, which helps to identify and analyze bottlenecks and problems in specific business scenarios, while abnormal link monitoring focuses more on error handling and recovery mechanisms at the application level. Therefore, the combination of abnormal link and forward link monitoring can provide a comprehensive and multi-dimensional monitoring perspective for development and operation and maintenance teams, ensuring that problems can be discovered and handled in a timely manner in any case, thereby improving application stability and user satisfaction.

[0079] However, sometimes the user's abnormal data cannot be captured by the processor and is only stored locally on the client. Therefore, the present invention also sets a third abnormal diagnosis logic, namely local log monitoring, which is used to analyze the user's abnormality based on the user's local log information, capture every key moment of the user's interaction with the application, and provide a comprehensive data perspective. Log analysis can provide substantial data support for the rapid resolution of problems, not only helping developers to deeply analyze the causes of abnormalities, but also speeding up the response speed of customer complaints, not only greatly improving the quality of problem diagnosis, but also strengthening the ability to monitor and optimize the user experience in depth. Specifically, the method includes: when receiving the fault warning information sent by the application to be monitored, generating a fault monitoring instruction, wherein the fault monitoring instruction is used to instruct the application to be monitored to send local log information; when receiving the local log information sent by the application to be monitored, processing the local log information to obtain the fault diagnosis result and fault repair file of the application to be monitored; sending the fault diagnosis result and fault repair file to the application to be monitored, wherein the fault diagnosis result is used to represent the fault information of the application to be monitored, and the fault repair file is used to repair the fault of the application to be monitored.

[0080] Among them, the fault warning information can be understood as the information sent by the user terminal indicating that there is an abnormality in the user's use of the application. The fault monitoring instruction can be understood as the instruction information for obtaining the local log information of the user terminal. The method of processing the local log information to obtain the fault diagnosis result of the application to be monitored is the same as the abnormal monitoring and forward link monitoring, which will not be elaborated here. The processing of the local log information will add a fault repair file determination action, which is a file used to repair the abnormality of the user terminal obtained based on the cause of the abnormality and the abnormality handling measures.

[0081] It is worth noting that in the online log monitoring of applications (Application, App), the present invention adopts a log storage solution of local and cloud hybrid storage. Local storage is highly efficient. Specifically, it uses the local storage capacity of the device to achieve extremely fast log writing performance. Through a carefully designed log management strategy, it ensures that efficient data processing capabilities can be maintained even when the device storage space is limited. A maximum local log limit of 100M is set to optimize storage usage and data writing speed. Cloud storage is elastic and durable. Specifically, by synchronizing log data to the cloud, a high-availability storage solution is provided. The elasticity of cloud storage allows the system to automatically expand according to the amount of data, and durability ensures long-term preservation and easy access to data. A 30-day retention period can be set for log data to balance the cost and the immediate value of data.

[0082] Figure 3 is a schematic diagram of an abnormal link monitoring operation provided by the present invention, Figure 4 It is a schematic diagram of a forward link monitoring work provided by the present invention. The two monitoring logics are the same as the description of this embodiment. It is worth noting that the abnormality resolution is performed by the operation and maintenance personnel. The monitoring points of the forward link monitoring are the buried points set at each step on the business link. Figure 5It is a schematic diagram of a local log monitoring work provided by the present invention. The local log monitoring work mainly includes four steps: determining local log information, transmitting logs to a cloud server, analyzing logs to troubleshoot problems, and solving problems. Among them, determining local log information is performed by a user terminal, solving problems is performed by operation and maintenance personnel, transmitting logs to a cloud server is triggered by a user terminal, analyzing logs to troubleshoot problems is performed by a cloud server, determining local log information includes four methods based on network requests, APP clicks, abnormal errors, and custom logs, the triggering methods for log transmission include user clicks on help and feedback, APP cold start check interface triggering, and triggering through custom notifications when customer complaints are received, files transmitted in the cloud will be encrypted to ensure data security, analyzing logs to troubleshoot problems includes automatically decrypting files on the server side, monitoring decrypted files, parsing abnormal causes, determining abnormal types and abnormal handling measures, so as to assist operation and maintenance personnel in solving problems, for example, assisting operation and maintenance personnel in writing repair files, and the repair files can be returned to the user terminal along the original route.

[0083] The technical solution of this embodiment determines the monitoring result of the application to be monitored according to the operation information of the monitoring point of the target risk area of ​​the application to be monitored. The target risk area includes the risk area of ​​the core business, the risk area indicated by the monitoring demand, and the abnormal risk area in the historical monitoring data. The operation information of the monitoring point of the target risk area is representative and can represent the operation of the application to be monitored. While ensuring the accuracy of monitoring, the workload of data acquisition and processing is greatly reduced, the efficiency of application monitoring work is improved, and the effectiveness of monitoring conclusions is guaranteed. Secondly, the present invention will judge the operation information of the monitoring point of each sub-risk area to determine whether the application to be monitored has an abnormality, and improve the reliability of the diagnosis result. It solves the problem of parsing the collected data such as the processor and memory usage of the application to obtain the monitoring report of the application. If the sufficiently fine user behavior path and code execution details cannot be captured, it will not be possible to timely analyze and locate the abnormal location and abnormal cause in the application, affecting the accuracy of problem location and solution efficiency of the application. If there is a lot of application operation data to be collected, the duration of application monitoring work will be extended, and the monitoring efficiency of the application will be reduced.

[0084] Figure 6 FIG. 1 is a schematic diagram of the structure of an abnormality monitoring device for an application provided by the present invention. Figure 6 As shown, the device includes: a service acquisition module 301, a region determination module 302 and an application diagnosis module 303.

[0085] The service acquisition module is used to determine the core service of the application to be monitored based on the type information of the application to be monitored, wherein the core service includes at least one sub-core service.

[0086] The area determination module is used to determine the target risk area of ​​the application to be monitored based on the core business and the pre-set correspondence between the business and the risk area, wherein the target risk area includes at least one sub-risk area, and the sub-risk area corresponds to the sub-core business one by one.

[0087] The application diagnosis module is used to determine the monitoring results of the application to be monitored based on the operation information of the monitoring points in each sub-risk area.

[0088] Optionally, the area determination module 302 is specifically used to use the core business to search in the correspondence between the business and the risk area to obtain the first risk area of ​​the application to be monitored, wherein the first risk area is the necessary monitoring area of ​​the core business; based on the received supplementary monitoring instructions of the core business, determine the second risk area of ​​the application to be monitored, wherein the second risk area is the experience monitoring area of ​​the core business; based on the historical monitoring information of the core business, determine the third risk area of ​​the application to be monitored, wherein the third risk area is the area corresponding to the abnormal monitoring information in the historical monitoring information; determine the area collection of the first risk area, the second risk area and the third risk area as the target risk area.

[0089] Optionally, the application diagnosis module 303 is specifically used to determine whether the operating information of the monitoring points of each sub-risk area meets the preset warning conditions; if the operating information of the monitoring points of each sub-risk area does not meet the preset warning conditions, the monitoring result of the application to be monitored is determined to be normal operation, and the preset warning conditions are updated; if there is operating data that meets the preset warning conditions in the operating information of the monitoring points of each sub-risk area, the monitoring result of the application to be monitored is determined to be abnormal operation, and the abnormal warning information of the application to be monitored is determined based on the operating data that meets the preset warning conditions.

[0090] Optionally, for any sub-risk area, a diagnostic module 303 is applied, which is specifically used to determine whether the operation information of the monitoring point of the sub-risk area meets the abnormal calibration condition; if the operation information of the monitoring point of the sub-risk area does not meet the abnormal calibration condition, it is determined whether the number of abnormal operation data in the operation information of the monitoring point of the sub-risk area is greater than the warning value in the preset warning condition; when the number of abnormal operation data is not greater than the warning value in the preset warning condition, it is determined that the operation information of the monitoring point of the sub-risk area does not meet the preset warning condition, and when the number of abnormal operation data is greater than the warning value in the preset warning condition, it is determined that the operation information of the monitoring point of the sub-risk area meets the preset warning condition; if the operation information of the monitoring point of the sub-risk area meets the abnormal calibration condition, it is determined whether the operation information of the monitoring point of the sub-risk area and the monitoring point of the sub-risk area are abnormal; when the operation information of the monitoring point of the sub-risk area is abnormal, the operation information of the monitoring point of the sub-risk area is obtained for a second time, and the step of determining whether the operation information of the monitoring point of the sub-risk area meets the abnormal calibration condition is returned; when the monitoring point of the sub-risk area is abnormal, the monitoring point of the sub-risk area is updated, the operation information of the updated monitoring point of the sub-risk area is obtained, and the step of determining whether the operation information of the monitoring point of the sub-risk area meets the abnormal calibration condition is returned.

[0091] Optionally, the device also includes a processing module, which is used to determine that the businesses in the business set of the application to be monitored that do not overlap with the core business are remaining businesses; based on the corresponding relationship between the remaining businesses and pre-set businesses and risk areas, determine the supplementary risk area of ​​the application to be monitored; based on the operation information of the monitoring points in the supplementary risk area, determine the supplementary monitoring results of the application to be monitored; based on the supplementary monitoring results and the monitoring results, determine the target monitoring results of the application to be monitored.

[0092] Optionally, the processing module is also used to generate a fault monitoring instruction upon receiving fault warning information sent by the application to be monitored, wherein the fault monitoring instruction is used to instruct the application to be monitored to send local log information; upon receiving local log information sent by the application to be monitored, the local log information is processed to obtain the fault diagnosis result and fault repair file of the application to be monitored; and the fault diagnosis result and fault repair file are sent to the application to be monitored, wherein the fault diagnosis result is used to represent the fault information of the application to be monitored, and the fault repair file is used to repair the fault of the application to be monitored.

[0093] The application anomaly monitoring device provided in this embodiment can execute the application anomaly monitoring method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0094] Figure 7: is a schematic diagram of the structure of an electronic device provided by the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0095] like Figure 7 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (also called random access memory, RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, ROM 12 and RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0096] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0097] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as an abnormality monitoring method for an application.

[0098] In some embodiments, the abnormality monitoring method of the application program can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the abnormality monitoring method of the application program described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the abnormality monitoring method of the application program by any other appropriate means (for example, by means of firmware).

[0099] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0100] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0101] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0102] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0103] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server) or a computing system that includes middleware components (e.g., an application server) or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein) or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0104] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0105] In one embodiment, the present invention further includes a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the method for monitoring anomalies of an application program of any embodiment of the present invention is implemented.

[0106] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0107] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0108] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for monitoring abnormality of an application, characterized in that: include: Determine the core business of the application to be monitored based on the type information of the application to be monitored, wherein the core business includes at least one sub-core business; Based on the core business and the correspondence between the pre-set business and risk areas, determine the target risk area of ​​the application to be monitored, wherein the target risk area includes at least one sub-risk area, and the sub-risk area corresponds to the sub-core business one by one; Based on the operation information of the monitoring points in each of the sub-risk areas, the monitoring result of the application to be monitored is determined.

2. The method according to claim 1, characterized in that The determining the target risk area of ​​the application to be monitored based on the correspondence between the core business and the pre-set business and risk area includes: Using the core business to search in the correspondence between the business and the risk area, a first risk area of ​​the application to be monitored is obtained, wherein the first risk area is a necessary monitoring area of ​​the core business; Determining a second risk area of ​​the application to be monitored based on the received supplementary monitoring instruction of the core business, wherein the second risk area is an experience monitoring area of ​​the core business; Based on the historical monitoring information of the core business, determining a third risk area of ​​the application to be monitored, wherein the third risk area is an area corresponding to abnormal monitoring information in the historical monitoring information; Determine a collection of the first risk area, the second risk area, and the third risk area as the target risk area.

3. The method according to claim 1, characterized in that The determining the monitoring result of the application to be monitored based on the operation information of the monitoring points of each of the sub-risk areas includes: Determine whether the operation information of the monitoring points in each of the sub-risk areas meets the preset warning conditions; If the operation information of the monitoring points of each of the sub-risk areas does not meet the preset warning condition, determining that the monitoring result of the application to be monitored is running normally, and updating the preset warning condition; If there is operating data that meets the preset warning conditions in the operating information of the monitoring points of each sub-risk area, the monitoring result of the application to be monitored is determined to be an operating abnormality, and the abnormal warning information of the application to be monitored is determined based on the operating data that meets the preset warning conditions.

4. The method according to claim 3, characterized in that For any sub-risk area, determining whether the operation information of the monitoring point in the sub-risk area meets the preset warning condition includes: Determining whether the operation information of the monitoring points in the sub-risk area meets the abnormal calibration conditions; If the operation information of the monitoring points in the sub-risk area does not meet the abnormal calibration condition, determining whether the number of abnormal operation data in the operation information of the monitoring points in the sub-risk area is greater than the warning value in the preset warning condition; When the amount of the abnormal operation data is not greater than the warning value in the preset warning condition, it is determined that the operation information of the monitoring point in the sub-risk area does not meet the preset warning condition; when the amount of the abnormal operation data is greater than the warning value in the preset warning condition, it is determined that the operation information of the monitoring point in the sub-risk area meets the preset warning condition; If the operation information of the monitoring point of the sub-risk area meets the abnormal calibration condition, determining whether the operation information of the monitoring point of the sub-risk area and the monitoring point of the sub-risk area is abnormal; When the operation information of the monitoring points in the sub-risk area is abnormal, the operation information of the monitoring points in the sub-risk area is obtained for a second time, and the step of determining whether the operation information of the monitoring points in the sub-risk area meets the abnormal calibration conditions is returned; when the monitoring points in the sub-risk area are abnormal, the monitoring points in the sub-risk area are updated, the operation information of the updated monitoring points in the sub-risk area is obtained, and the step of determining whether the operation information of the monitoring points in the sub-risk area meets the abnormal calibration conditions is returned.

5. The method according to claim 1, characterized in that: Also includes: Determine that the services in the service set of the application to be monitored that do not overlap with the core services are the remaining services; Determining the supplementary risk area of ​​the application to be monitored based on the correspondence between the remaining business and the pre-set business and risk area; Determining a supplementary monitoring result of the application to be monitored based on the operation information of the monitoring point of the supplementary risk area; Based on the supplementary monitoring result and the monitoring result, a target monitoring result of the application to be monitored is determined.

6. The method according to claim 1, characterized in that Also includes: When receiving fault warning information sent by the application to be monitored, generating a fault monitoring instruction, wherein the fault monitoring instruction is used to instruct the application to be monitored to send local log information; When receiving the local log information sent by the application to be monitored, processing the local log information to obtain a fault diagnosis result and a fault repair file of the application to be monitored; The fault diagnosis result and the fault repair file are sent to the application to be monitored, wherein the fault diagnosis result is used to indicate the fault information of the application to be monitored, and the fault repair file is used to repair the fault of the application to be monitored.

7. An abnormality monitoring device for an application, characterized in that: A method for monitoring anomalies of an application program according to any one of claims 1 to 6, wherein the device for monitoring anomalies of an application program comprises: A service acquisition module, configured to determine a core service of the application to be monitored based on the type information of the application to be monitored, wherein the core service includes at least one sub-core service; A region determination module, used to determine the target risk region of the application to be monitored based on the core business and the pre-set correspondence between the business and the risk region, wherein the target risk region includes at least one sub-risk region, and the sub-risk region corresponds to the sub-core business one by one; The application diagnosis module is used to determine the monitoring result of the application to be monitored based on the operation information of the monitoring points of each sub-risk area.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for monitoring anomalies of an application program as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormality monitoring method of an application program described in any one of claims 1 to 6 when executed.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the abnormality monitoring method of the application program according to any one of claims 1 to 6.

Images