Root cause location method, system, and apparatus

Abstract

Embodiments of the present specification provide a root cause positioning method, system and device, wherein the root cause positioning method comprises: obtaining historical link data corresponding to a microservice business, and determining a target abnormal positioning model corresponding to the historical link data; determining a to-be-processed link data set corresponding to the microservice business, and clustering the to-be-processed link data set, and determining a cluster center link data according to a clustering result; inputting the cluster center link data into the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data; determining a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining an abnormal link node in the target abnormal link. The model is fine-tuned based on an initial abnormal positioning model, so that the initial abnormal positioning model has wide applicability and strong generalization ability; the cluster center link data is selected for root cause positioning, so as to improve the root cause positioning speed of the microservice business.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification relate to the technical field of computer technology, and particularly relate to a root cause positioning method. BACKGROUND

[0002] With the development of computer technology, microservices on the cloud are developing rapidly. Microservice architecture is a highly scalable, highly available, and easy-to-maintain and update service architecture. More and more systems use microservice architecture due to its faster delivery, better scalability, and greater autonomy. With the increasing popularity of microservice architecture, the security of microservices has also attracted attention.

[0003] In the prior art, the work in the aspect of microservice performance debugging is based on correlation, empirical threshold, or non-scalable algorithms and deep learning models, which makes the accuracy low and the speed slow. When the microservice is expanded, the algorithm for root cause positioning according to experience and rules becomes unreliable, and even cannot realize root cause positioning. Therefore, a new method needs to be used to perform root cause positioning when a fault occurs. The method for root cause positioning according to experience and rules does not have universality, and therefore, an effective root cause positioning method is urgently needed to solve the above problems. SUMMARY

[0004] Therefore, the embodiments of the present specification provide a root cause positioning method. One or more embodiments of the present specification also relate to a root cause positioning device, a root cause positioning system, a computing device, a computer-readable storage medium, and a computer program to solve the technical defects in the prior art.

[0005] According to a first aspect of the embodiments of the present specification, a root cause positioning method is provided, comprising:

[0006] obtaining historical link data corresponding to a microservice business, and determining a target abnormal positioning model corresponding to the historical link data;

[0007] determining a to-be-processed link data set corresponding to the microservice business, and clustering the to-be-processed link data set, and determining a cluster center link data according to a clustering result;

[0008] inputting the cluster center link data into the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data;

[0009] determining a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining an abnormal link node in the target abnormal link.

[0010] According to a second aspect of the embodiments of the present specification, a root cause positioning device is provided, comprising:

[0011] an acquisition module configured to acquire historical link data corresponding to a microservice business, and determine a target abnormality positioning model corresponding to the historical link data;

[0012] a clustering module configured to determine a to-be-processed link data set corresponding to the microservice business, and cluster the to-be-processed link data set, and determine a cluster center link data according to a clustering result;

[0013] an input module configured to input the cluster center link data to the target abnormality positioning model, and obtain abnormal link node information corresponding to the cluster center link data;

[0014] a determination module configured to determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

[0015] According to a third aspect of an embodiment of the present specification, a root cause positioning system is provided, including a server and a client;

[0016] The client submits an abnormality positioning request to the server for a target microservice business;

[0017] The server parses the abnormality positioning request to obtain debugging link data and target link data; updates an initial abnormality positioning model to a to-be-used abnormality positioning model based on the debugging link data; clusters the target link data, and determines to-be-input link data according to a clustering result; inputs the to-be-input link data to the to-be-used abnormality positioning model, and obtains abnormal node information corresponding to the target microservice business; determines an abnormal node based on the abnormal node information, and generates abnormal feedback information based on the abnormal node and the abnormal node information; and sends the abnormal feedback information as a response to the abnormality positioning request to the client;

[0018] The client performs abnormality processing on the target microservice business based on the abnormal feedback information.

[0019] According to a fourth aspect of an embodiment of the present specification, a computing device is provided, including:

[0020] a memory and a processor;

[0021] The memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions, which implement the steps of the root cause positioning method when executed by the processor.

[0022] According to a fifth aspect of an embodiment of the present specification, a computer readable storage medium is provided, which stores computer executable instructions, which, when executed by a processor, implement the steps of the root cause positioning method described above.

[0023] According to a sixth aspect of an embodiment of the present specification, a computer program is provided, which, when executed in a computer, causes the computer to perform the steps of the root cause positioning method described above.

[0024] An embodiment of the present specification determines the target abnormal positioning model corresponding to the historical link data of the microservice business by acquiring the historical link data corresponding to the microservice business, determines the to-be-processed link data set corresponding to the microservice business, and clusters the to-be-processed link data set, determines the cluster center link data according to the clustering result, inputs the cluster center link data into the target abnormal positioning model, and obtains the abnormal link node information corresponding to the cluster center link data. The target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and the abnormal link node in the target abnormal link is determined. The model is fine-tuned based on the initial abnormal positioning model, so that the adjusted initial abnormal positioning model is suitable for a specific microservice business, so that the initial abnormal positioning model has a wide applicability and strong generalization ability. When the root cause positioning is performed through the target abnormal positioning model, the cluster center link data is selected for root cause positioning, and the root cause positioning speed of the microservice business is improved. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 is a structural schematic diagram of a root cause positioning method provided by an embodiment of the present specification;

[0026] Figure 2 is a flowchart of a root cause positioning method provided by an embodiment of the present specification;

[0027] Figure 3 is a process flowchart of a root cause positioning method provided by an embodiment of the present specification;

[0028] Figure 4 is a model training schematic diagram of a root cause positioning method provided by an embodiment of the present specification;

[0029] Figure 5 is a model application schematic diagram of a root cause positioning method provided by an embodiment of the present specification;

[0030] Figure 6 is a microservice synthesis schematic diagram of a root cause positioning method provided by an embodiment of the present specification;

[0031] Figure 7 is a structural schematic diagram of a root cause positioning device provided by an embodiment of the present specification;

[0032] Figure 8 is an architecture diagram of a root cause positioning system provided by one embodiment of the present specification;

[0033] Figure 9 is a structural block diagram of a computing device provided by one embodiment of the present specification. DETAILED DESCRIPTION

[0034] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present specification. However, the present specification can be practiced without the specific details, other than in the examples, and it is understood that the scope of the present specification is not limited to the details below.

[0035] The terminology used in one or more embodiments of the present specification is for the purpose of describing particular embodiments only and is not intended to be limiting of one or more embodiments of the present specification. As used in one or more embodiments of the present specification and the accompanying claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in one or more embodiments of the present specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0036] It is to be understood that the terms first, second, etc. can be employed in one or more embodiments of the present specification to describe various information, but these terms are not intended to denote or be limited to the above-described information. These terms are used only to distinguish one piece of information from another piece of information of the same type. For example, without departing from the scope of one or more embodiments of the present specification, first can be referred to as second, and similarly, second can be referred to as first. Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining."

[0037] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in one or more embodiments of the present specification are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0038] First, the terms involved in one or more embodiments of the present specification are explained.

[0039] Trace: Link tracing, starting from the client's request reaching the system boundary, records every service the request flows through until a response is returned to the client. This entire process is called a "trace".

[0040] In distributed systems, a trace is used to record the call history of a request across multiple services, including the start and end points of the request, and the services traversed in between. A Span is the basic unit in a trace, representing the process of a service handling a request, including receiving the request, processing the request, and returning a response. Specifically, each Span contains a unique identifier (Span ID), a parent Span identifier (Parent ID), a start time, an end time, the Span's duration, the Span's operation name, and the Span's label. When a request passes through a service, that service creates a new Span object, sets its Span ID to the parent Span's ID, and sets its start time to the current time. After the service completes request processing, it sets its end time to the current time and sends the Span information to the trace so that subsequent services can access this information.

[0041] MicroService: A software architecture and organization approach where software consists of small, independent services that communicate with each other through well-defined APIs.

[0042] Few-shot learning, also known as learning with limited data, is a machine learning task that learns the features or patterns of a small number of labeled data samples to generalize and recognize new data. Traditional machine learning models require large amounts of labeled data to train, while few-shot learning can achieve good results with minimal data, making it highly valuable for applications.

[0043] SBERT (Sentence-BERT) is a pre-trained model based on BERT, primarily used to generate vector representations of text, especially for calculating the similarity between sentences. Unlike traditional BERT models that only take text sequences as input, SBERT introduces special training techniques such as sentence pair construction and multi-task learning. This allows the model to learn more semantic information about sentences during pre-training and encode it into a fixed-length vector representation. This vector representation can be used to calculate the similarity between sentences, such as cosine similarity and Manhattan distance, thereby enabling tasks such as text matching, semantic search, and sentiment analysis.

[0044] Counterfactual: refers to the process of reversing the inference of an event that has already occurred, that is, assuming that the event that has occurred is different, opposite or does not occur, and then observing the results under these assumptions. In simple terms, it is a way of thinking "if that thing didn't happen, what would the result be?" This way of thinking can help people better understand and analyze events that have occurred and draw some valuable conclusions and lessons from them, while also helping people predict and avoid potential problems in the future.

[0045] GNN: (Graph Neural Network, GNN), graph neural network, is a deep learning model based on graph structure, mainly used for processing graph data. In simple terms, it is a method of analyzing and processing graph data using deep learning. For example, we can consider the friend relationship in social networks, transportation routes in logistics, and molecular structures in chemical reactions as graph data. Graph neural networks can learn the features and relationships in these graph data, and perform tasks such as classification, clustering, and prediction on the nodes and edges in the graph. Unlike traditional convolutional neural networks, recurrent neural networks and other models, graph neural networks are mainly designed and optimized based on graph theory and graph algorithms, and have some unique operations such as graph convolution, graph attention mechanism, etc. Through these operations, graph neural networks can effectively process different types of graph data and have achieved many successful applications in various tasks such as node classification, graph classification, link prediction, etc.

[0046] GIN: Graph Isomorphism Network (GIN), graph isomorphism network, is a graph neural network proposed by Xu et al. It is an improved algorithm based on graph convolutional neural network (GCN). The goal of GIN is to learn the local neighborhood substructure between nodes to classify, cluster, and reconstruct graphs.

[0047] Jaccard index: The Jaccard index is a measure of the similarity between two sets, with a value ranging from 0 to 1. It is defined as the size of the intersection of the two sets divided by the size of their union, i.e., J(A, B) = |A ∩ B| / |A ∪ B|, where A and B are two sets and |A| represents the size (number of elements) of set A. The Jaccard index can be used to evaluate the similarity between two sets in terms of their elements, with a value closer to 1 indicating a higher degree of similarity between the two sets and a value closer to 0 indicating a lower degree of similarity. In practical applications, the Jaccard index is commonly used in text processing, image processing, data mining, and other fields, such as calculating the similarity between queries and documents in search engines or calculating the similarity between different clusters in clustering analysis.

[0048] With the development of computer technology, microservices on the cloud are rapidly developing. Microservices architecture is a highly scalable, highly available, and easy-to-maintain service architecture. Due to its faster delivery, better scalability, and greater autonomy, more and more systems use microservices architecture. As microservices architecture becomes increasingly popular, security issues of microservices have also attracted attention. The growing scale of microservices makes the RPC dependency graph complex, exacerbates the tail-of-scale effect, and makes many experienced rules unreliable. Previous work on microservices performance debugging was based on correlation, empirical thresholds, or non-scalable algorithms and deep learning models, none of which used microservices benchmarks with comparable production service scale to quantitatively evaluate their accuracy and performance, making them questionable in production-scale microservices. When microservices are scaled up, many heuristic methods based on experience and rules for root cause analysis algorithms become unreliable or even unverifiable. In microservices architecture, since different services may run on different nodes and their communication may be affected by network latency, packet loss, and other factors, new methods are needed to analyze and solve faults when they occur. In this case, more advanced data analysis techniques and tools are needed to help identify and fix faults.

[0049] In the prior art, work on microservices performance debugging is based on correlation, empirical thresholds, or non-scalable algorithms and deep learning models, resulting in low accuracy and slow speed. When microservices are scaled up, algorithms based on experience and rules for root cause localization become unreliable or even unverifiable. Therefore, new methods are needed to perform root cause localization when faults occur. In order to perform root cause diagnosis on Trace data of microservices in a production environment and improve problem-solving efficiency, the present embodiment provides a root cause localization method.

[0050] Figure 1 FIG. 1 shows a structural schematic diagram of a root cause positioning method according to an embodiment of the present specification; as Figure 1 As shown, in a microservice business scenario, historical link data corresponding to the microservice business is obtained, a target abnormal positioning model for root cause positioning is determined, the target abnormal positioning model can be obtained by fine-tuning an initial abnormal positioning model with the historical link data as training samples, that is, the initial abnormal positioning model is updated based on the historical link data to obtain the target abnormal positioning model. A set of to-be-processed link data corresponding to the microservice business is determined, and the set of to-be-processed link data is clustered, and a cluster center link data is determined according to the clustering result. The cluster center link data is input into the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data. The target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and an abnormal link node is determined in the target abnormal link. The root cause positioning of the to-be-processed link data is realized.

[0051] The model fine-tuning is performed based on the initial abnormal positioning model, so that the adjusted initial abnormal positioning model is suitable for a specific microservice business, and the initial abnormal positioning model has wide applicability and strong generalization ability; when the root cause positioning is performed by the target abnormal positioning model, the cluster center link data is selected for root cause positioning, and the root cause positioning speed of the microservice business is improved.

[0052] In the present specification, a root cause positioning method is provided, and the present specification also relates to a root cause positioning device, a root cause positioning system, a computing device, and a computer readable storage medium, which are described in detail one by one in the following embodiments.

[0053] Referring to Figure 2 , Figure 2 FIG. 2 shows a flowchart of a root cause positioning method according to an embodiment of the present specification, specifically including the following steps.

[0054] Step S202: Obtain historical link data corresponding to a microservice business, and determine a target abnormal positioning model corresponding to the historical link data.

[0055] Specifically, microservice is an architecture and organization method for developing software, in which the software is composed of small independent services that communicate through well-defined APIs; accordingly, the microservice business is a business based on the microservice architecture, and the types of services include but are not limited to computing, storage, etc.; the historical link data refers to the Trace data generated under the microservice business; the target abnormal positioning model corresponds to the microservice business and has the ability to identify abnormal data in the link data corresponding to the microservice business.

[0056] Based on this, the microservice business in the target field is determined, and a small amount of link data generated under the microservice business is obtained as historical link data. Based on the small amount of historical link data, model training is performed, so that the target anomaly positioning model obtained by training matches the microservice business in the target field. The target anomaly positioning model can identify anomalies in the link data generated under the microservice business in the target field and perform root cause positioning of the anomalies.

[0057] In actual application, when determining the target anomaly positioning model, an initial anomaly positioning model with anomaly identification capability can be obtained first, and then the initial anomaly positioning model is trained based on the obtained historical link data to obtain a target anomaly positioning model corresponding to the field of the microservice business. In addition, when determining the target inheritance positioning model, a training set can be constructed based on the obtained historical link data corresponding to the microservice business, an initial anomaly positioning model for anomaly positioning is constructed, and then the initial anomaly positioning model is trained based on the training set until a target anomaly positioning model that meets the training stop condition is obtained.

[0058] Further, in order to make the target anomaly positioning model have better anomaly positioning capability, the initial anomaly positioning model can be trained to obtain the target anomaly positioning model. The initial anomaly positioning model is a prediction model with anomaly detection and root cause positioning capability. Considering the generalization capability of the initial positioning model, rich training samples can be considered when training the model, link data corresponding to at least two initial microservice businesses is obtained to construct a link data sample set, and the specific implementation is as follows:

[0059] The initial anomaly positioning model is updated to a target anomaly positioning model corresponding to the historical link data. The training of the initial anomaly positioning model includes: determining a to-be-trained link data set based on at least two initial microservice businesses; constructing a link data sample set based on at least two to-be-trained link data included in the to-be-trained link data set; and training the to-be-trained anomaly positioning model using the link data sample set until an initial anomaly positioning model that meets the training stop condition is obtained.

[0060] Specifically, the initial microservice business can be a microservice business in any business scenario, and the business scenario can be a computing business or a storage business, etc. The to-be-trained link data set refers to a data set composed of link data corresponding to the initial microservice business collected. The link data sample set refers to a sample set used for model training. Correspondingly, the initial abnormal positioning model is an abnormal positioning model with root cause positioning capability after the to-be-trained abnormal positioning model is trained based on the link data sample set. When collecting the link data samples included in the link data sample set, there can be multiple sampling methods. For example: for any microservice system, the Trace data within a certain time period is divided according to different microservice entrances, the overall delay of each service entrance Trace within this period of time is calculated, the Trace data is sampled according to the calculated delay distribution, and then complete original training data is obtained. The initial abnormal positioning model is used for root cause positioning of the Trace data to determine the root cause node of the abnormality in the Trace data. The target abnormal positioning model refers to an abnormal positioning model obtained by updating the initial abnormal positioning model. The historical link data is used to adjust the initial abnormal positioning model, so that the target abnormal positioning model has the ability to identify abnormal data in the link data corresponding to the microservice business.

[0061] Based on this, at least two initial microservice businesses are determined, and link data in each initial microservice business is collected to construct a to-be-trained link data set. At least two to-be-trained link data included in the to-be-trained link data set are determined, each to-be-trained link data is processed to obtain link data samples corresponding to the to-be-trained link data, and a link data sample set is constructed. The to-be-trained abnormal positioning model is trained using the link data sample set, the link data sample is causally modeled based on the to-be-trained abnormal positioning model, the link data sample is embedded and coded using the to-be-trained abnormal positioning model, and then the to-be-trained abnormal positioning model is trained through a specific loss function, so that the to-be-trained abnormal positioning model learns the embedded features until an initial abnormal positioning model that meets the training stop condition is obtained.

[0062] The initial abnormal positioning model is determined, and the initial abnormal positioning model is updated based on a small amount of historical link data, so that the updated initial abnormal positioning model matches the microservice business in the target field. The initial abnormal positioning model is updated to a target abnormal positioning model. The target abnormal positioning model can identify abnormalities in link data generated under the microservice business in the target field and perform root cause positioning of the abnormalities.

[0063] In practical applications, the initial abnormal positioning model is trained based on link data of multiple microservice businesses in multiple fields, and therefore the initial abnormal positioning model has strong generalization ability. When the initial abnormal positioning model is used for abnormal positioning, the initial abnormal positioning model can be fine-tuned based on link data under different microservice businesses, so that the fine-tuned initial abnormal positioning model is used for root cause positioning of the link data. When the root cause positioning and abnormal root cause analysis are performed, the counterfactual method can be used. Counterfactual query is that under certain circumstances, if some spans are restored to the normal state, what is the expected trace duration and error state. That is, this query is based on the assumption that if some spans are in the normal state, how will the entire system run. The initial abnormal positioning model uses an iterative method to restore the service to the normal state, predicts the counterfactual trace state, and checks whether it is predicted to be normal, thereby locating the root cause of the abnormality.

[0064] For example, an initial microservice business for providing a computing service and an initial microservice business for providing a storage service are determined, link data of each microservice business is obtained, and a link data sample set is constructed. The GNN-based to-be-trained abnormal positioning model is trained using the link data sample set until the initial abnormal positioning model that meets the training stop condition is obtained.

[0065] In summary, the link data sample set for training the to-be-trained abnormal positioning model is constructed based on the link data of at least two initial microservice businesses, so that the to-be-trained abnormal positioning model can adapt to multiple types of microservice businesses, and the to-be-trained abnormal positioning model after training has good generalization ability.

[0066] Further, considering that the link data of the microservice business contains various types of data such as type, start time, end time, and state, when training the abnormal positioning model based on the link data, the prediction ability of the model can be considered, and various types of data in the link data can be fully utilized. The specific implementation is as follows:

[0067] The to-be-trained link data is converted into a text vector, and time information and state information of the to-be-trained link data are determined; the text vector is updated based on the time information and the state information, and a link data sample corresponding to the to-be-trained link data is constructed based on the updated text vector.

[0068] Specifically, the text vector can be understood as an embedded feature representation of the to-be-trained link data, and the generation of the text vector can adopt various ways such as the Bert model; the time information can include the start time, end time, and time consumption of the to-be-trained link data; and the state information can be determined based on the to-be-trained link data, that is, the state code or link state contained in the to-be-trained link data is taken as the state information. The time information can also be the start time, end time, and exclusive time of the link node corresponding to the to-be-trained link data; and the state information can be the node state information of the link node contained in the to-be-trained link data.

[0069] Based on this, the to-be-trained link data is converted into a text vector through an encoding model or an encoding algorithm. The time information and the state information of the training link data are determined. The text vector is updated based on the time information and the state information, and the time information and the state information are integrated into the text vector. The link data sample corresponding to the to-be-trained link data is constructed based on the updated text vector.

[0070] In the above example, the to-be-trained link data is converted into a text vector by using a Bert model or an SBert model. The exclusive time of the Span is calculated based on the start time and the end time of the Span in the to-be-trained link data, and is taken as the time information corresponding to the to-be-trained link data. When calculating the exclusive time of the Span, the relationship between the parent Span and the child Span also needs to be considered. If a Span is a child Span of its parent Span, its exclusive time should be the sum of the time of the parent Span and the time of the child Span. If the start time of a Span is T1, the end time is T2, and it has two child Spans with start times of T3 and T4 and end times of T5 and T6, respectively, then the exclusive time of the Span is (T2-T1)-(T5-T3)-(T6-T4).

[0071] In summary, the time information and the state information of the link data are integrated into the to-be-trained link data, so that the to-be-trained link data is used to train the initial abnormal positioning model, and the prediction accuracy of the initial abnormal positioning model is improved.

[0072] Further, considering that the training cost of the initial abnormal positioning model is high, in order to improve the utilization rate of the initial abnormal positioning model, a common method is to improve the generalization ability of the initial abnormal positioning model, so that the initial abnormal positioning model has high applicability, and the specific implementation is as follows:

[0073] determining at least two initial micro-service businesses; collecting at least two pieces of link data corresponding to the at least two initial micro-service businesses respectively according to a preset data collection strategy; dividing the at least two pieces of link data corresponding to the at least two initial micro-service businesses respectively according to a preset data division rule, determining a to-be-trained link data subset corresponding to each initial micro-service business according to a division result; and constructing a to-be-trained link data set based on the at least two to-be-trained link data subsets.

[0074] Specifically, the data collection strategy can be data collection through a data collection tool, or data acquisition through manual collection; the data division rule can be division according to data collection time or data generation time, or division according to data type, which can be calculation data or storage data.

[0075] Based on this, at least two initial micro-service businesses of various types such as traffic type nodes, disk IO intensive nodes, and computing intensive nodes are determined. At least two pieces of link data corresponding to the at least two initial micro-service businesses are collected according to a preset data collection strategy. The at least two pieces of link data corresponding to the at least two initial micro-service businesses are divided according to a preset data division rule, and a to-be-trained link data subset corresponding to each initial micro-service business is determined according to a division result; and a to-be-trained link data set is constructed based on the at least two to-be-trained link data subsets.

[0076] Following the above example, among the micro-service businesses of various types such as traffic type nodes, disk IO intensive nodes, and computing intensive nodes, the micro-service businesses that need to be collected are selected, and the link data generated under each micro-service business is obtained. The link data generated under each micro-service business obtained is divided to realize data classification. Then, according to the classification result, a link data subset corresponding to each micro-service business is determined, and a to-be-trained link data set of various data set types is constructed based on each link data subset.

[0077] In summary, based on the link data of the at least two initial micro-service businesses, a to-be-trained link data set is constructed, thereby realizing rich data types and business types in the to-be-trained link data set, improving the generalization ability of the model after training the abnormal positioning model, and improving the prediction accuracy of the model.

[0078] Further, considering the complexity of the data structure of the to-be-trained link data, the various types of data in the to-be-trained link data can be integrated, so that the abnormal positioning model can fully learn the features of the sample data during subsequent abnormal positioning model training, thereby improving the prediction ability of the abnormal positioning model. The specific implementation is as follows:

[0079] The to-be-trained link data is encoded, and a text vector corresponding to the to-be-trained link data is determined according to a processing result; the start time and the end time of the sub-link data contained in the to-be-trained link data are calculated, and time information corresponding to the to-be-trained link data is determined according to a calculation result; and the sub-state information of the sub-link data contained in the to-be-trained link data is taken as the state information of the to-be-trained link data.

[0080] Therefore, the to-be-trained link data is encoded by using the SBert model, and a text vector corresponding to the to-be-trained link data is determined according to a processing result. The sub-link data contained in the to-be-trained link data is determined, the exclusive time of the sub-link data is calculated according to the start time and the end time of the sub-link data, the exclusive time of the sub-link data contained in the to-be-trained link data is taken as the time information of the to-be-trained link data, and the sub-state information of the sub-link data contained in the to-be-trained link data is taken as the state information of the to-be-trained link data.

[0081] In the above example, the Service and name in the Trace data are encoded to have semantic information (converted into a 768-dimensional vector by using SBert), and special characters, hexadecimal codes and case letters are converted during the encoding. The exclusive time of the Span (sub-link data) is calculated. The duration of the synchronization span of the non-leaf node includes the time spent in the service and the waiting time of the sub-span thereof. The own duration and the waiting time are separated to facilitate positioning of the root cause of the high-delay Trace.

[0082] In summary, the various types of data such as time information and state information in the to-be-trained link data are integrated, so that the abnormal positioning model can sufficiently learn the characteristics of the sample data during subsequent abnormal positioning model training, and the prediction ability of the abnormal positioning model is improved.

[0083] Step S204: Determine the to-be-processed link data set corresponding to the microservice business, and cluster the to-be-processed link data set, and determine the cluster center link data according to the clustering result.

[0084] Specifically, after the above obtaining the historical link data corresponding to the microservice business, and updating the initial abnormal positioning model to the target abnormal positioning model based on the historical link data, the set of link data to be processed corresponding to the microservice business can be determined, and the set of link data to be processed is clustered, and the cluster center link data is determined according to the clustering result. The set of link data to be processed refers to the set of link data obtained by collecting link data for the microservice business; the set of link data to be processed includes link data with abnormalities; the clustering method can use DBSCAN algorithm, k-means algorithm, etc., which is not limited in the embodiment; the cluster center link data refers to the cluster center link data obtained by clustering the set of link data to be processed, which is used as input to the target abnormal positioning model for abnormal detection.

[0085] Based on this, after the above obtaining the historical link data corresponding to the microservice business, and updating the initial abnormal positioning model to the target abnormal positioning model based on the historical link data, collecting link data for the microservice business, and using the link data collection strategy to collect the link data corresponding to the microservice business as the set of link data to be processed. Determine the distance index corresponding to the link data to be processed, and cluster the set of link data to be processed based on the distance index, and determine the cluster center link data according to the clustering result.

[0086] In practical applications, the Span identifier is composed of its label: (Service, name, kind) tuple, and its error state and the labels of all ancestor Spans within the maximum distance d_max, to reflect the structure and state of a given Trace. Different Spans sharing the same identifier are merged in a set, and their weights are equal to the sum of their durations. When the structure and execution state of two Traces are similar, the same elements with similar weights can be found in the two Trace sets. We use the extended Jaccard index to calculate the similarity of the Trace sets. Use the DBSCAN algorithm for clustering to get the structure similar Trace clusters, and find the representative (cluster center) Trace link from them as the Trace link to be analyzed for root cause.

[0087] Step S206: inputting the cluster center link data into the target abnormal positioning model to obtain the abnormal link node information corresponding to the cluster center link data.

[0088] Specifically, after determining the to-be-processed link data set corresponding to the micro-service business, clustering the to-be-processed link data set, and determining the cluster center link data according to the clustering result, the cluster center link data can be input into the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data, wherein the abnormal link node information refers to abnormal description information or abnormal node description information, for example: the abnormal description information is A type data, and the corresponding abnormal link node is the node recording the A type data; the abnormal description information is B data (data or string), and the corresponding abnormal link node is the node recording the B data. The abnormal link node information can be abnormal information contained in the cluster center link data, and the abnormal types include but are not limited to data abnormality, label abnormality, state abnormality, time abnormality, and resource abnormality.

[0089] Based on this, after determining the to-be-processed link data set corresponding to the micro-service business, clustering the to-be-processed link data set, and determining the cluster center link data according to the clustering result, the cluster center link data is input into the target abnormal positioning model, the target abnormal positioning model uses the counterfactual method to locate the root cause of the cluster center link data, and the target abnormal positioning model outputs the abnormal link node information corresponding to the cluster center link data. Further, abnormal analysis and fault recovery are performed based on the abnormal link node information.

[0090] In practical applications, the target abnormal positioning model can be an abnormal positioning model obtained by using a GNN model to perform causal modeling on Trace data. CBN (Causal Bayesian Networks, causal inference network based on Bayesian theory) is used to depict the propagation of error information in Trace data, GIN (Graph Isomorphism Network) is used to embed and encode Trace link data, and a specific loss function is used for learning, and finally the learning of embedded features is completed. The loss function can be formula (1) as follows:

[0091]

[0092] Wherein, d i represents the time consumption of Span; represents the exclusive time of Span; e i represents the error state of Span; In the error propagation process of the parent Span, the error of the parent Span itself, the duration and error state of the child Span need to be considered, and the maximum value of them is selected as the error of the parent Span. Thus, the error can be correctly propagated along the causal DAG (Directed Acyclic Graph).

[0093] Further, in determining the microservice business corresponding to the to-be-processed link data, considering the convenience and accuracy of data acquisition, the existing data acquisition technology can be used to realize data acquisition, and the specific implementation is as follows:

[0094] At least two pieces of to-be-processed link data corresponding to the microservice business are acquired based on the preset data acquisition strategy; and a to-be-processed link data set is constructed by using the at least two pieces of to-be-processed link data.

[0095] Based on this, according to OpenTelemetry (distributed link tracking standard), and the link data acquisition tool, the link data acquisition of the microservice business is realized, and at least two pieces of to-be-processed link data corresponding to the microservice business are acquired based on the preset data acquisition strategy. The at least two pieces of to-be-processed link data are stored in the data set to realize the construction of the to-be-processed link data set.

[0096] Following the above example, OpenTelemetry is composed of a group of APIs, SDK tools, and is used to observe, generate, collect and export various observable data. When collecting the link data of the microservice, the Trace data of the microservice is collected by using OpenTelemetry. The collected Trace data is stored in the set to construct the to-be-processed link data set.

[0097] As described above, the to-be-processed link data corresponding to the microservice business is acquired through the preset data acquisition strategy, thereby improving the efficiency and accuracy of link data acquisition.

[0098] Further, considering that the number of link data under the microservice business is relatively large, abnormal detection and root cause positioning are performed on each piece of link data, which will consume a large amount of computing resources and processing time. In order to improve the efficiency of abnormal detection and root cause positioning, the clustering center link data can be determined by clustering the to-be-processed link data, so that only the clustering center link data is input into the target abnormal positioning model, and the specific implementation is as follows:

[0099] Determine the to-be-processed link data contained in the to-be-processed link data set; cluster the to-be-processed link data set according to the data structure, link state and time weight of each to-be-processed link data in the to-be-processed link data set, and determine the clustering center link data according to the clustering result.

[0100] Specifically, clustering refers to the process of dividing a collection of physical or abstract objects into multiple classes composed of similar objects. The cluster generated by clustering is a collection of data objects, which are similar to each other in the same cluster and different from the objects in other clusters. Clustering can be realized by k-means mean algorithm, DBSCAN algorithm and other clustering algorithms.

[0101] Based on this, the to-be-processed link data set contains at least two to-be-processed link data. According to the name label, category label and other data structures of each to-be-processed link data in the to-be-processed link data set, the link state and the time weight are used to cluster the to-be-processed link data set, and at least one cluster center link data is determined according to the clustering result.

[0102] Following the above example, the Span identifier consists of a tuple of labels: (Service, name, kind), as well as the error state and the labels of all the ancestor Spans within the maximum distance, reflecting the structure and state of a given Trace. Different Spans sharing the same identifier are merged in a set, whose weight is the sum of their durations. When the structure and execution state of two Traces are similar, the same elements with similar weights can be found in the two Trace sets. We use the extended Jaccard index to calculate the similarity of the Trace sets. Clustering is performed using the DBSCAN algorithm to obtain clusters of Traces with similar structures, and from which we find representative (cluster centers) Traces links as the Traces links to be analyzed for root cause.

[0103] In summary, by clustering the to-be-processed link data set, the cluster center link data is determined according to the clustering result, so as to input the cluster center link data into the target anomaly positioning model to determine the abnormal link node, improve the efficiency of anomaly detection and root cause positioning, and reduce the consumption of computing resources and time.

[0104] Step S208: determining the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining the abnormal link node in the target abnormal link.

[0105] Specifically, after inputting the cluster center link data into the target anomaly positioning model and obtaining the abnormal link node information corresponding to the cluster center link data, the target abnormal link corresponding to the microservice business can be determined based on the abnormal link node information, and the abnormal link node in the target abnormal link can be determined. The target abnormal link refers to the microservice business link corresponding to the abnormal link node information. Since the target abnormal link contains at least one link node, the abnormal link node is the node that exists abnormally in the target abnormal link.

[0106] Based on this, after inputting the cluster center link data into the target anomaly positioning model and obtaining the abnormal link node information corresponding to the cluster center link data, the target abnormal link data corresponding to the microservice business is determined based on the abnormal link node information, the target abnormal link is determined based on the target abnormal link data, and the abnormal link node in the target abnormal link is determined. In order to facilitate subsequent abnormal analysis and abnormal processing for the target abnormal link node, and realize abnormal recovery.

[0107] Further, considering that the abnormal link node information contains attribute information such as the identification of the abnormal link, etc., therefore, before determining the target abnormal link, the target abnormal link data is determined first, and the specific implementation is as follows:

[0108] determining target abnormal link data corresponding to the abnormal link node information in the to-be-processed link data set; determining the target abnormal link corresponding to the micro-service business based on the target abnormal link data; and determining the abnormal link node in the target abnormal link based on the abnormal link node information.

[0109] Specifically, the target abnormal link data refers to the link data with abnormalities in the to-be-processed link data set, and the abnormal types of the abnormal data in the target abnormal link data can be various, including but not limited to data abnormality, label abnormality, state abnormality, time abnormality, and resource abnormality.

[0110] Based on this, the target abnormal link data with abnormalities corresponding to the abnormal link node information is determined in the to-be-processed link data set based on the abnormal link node information. The target abnormal link matching the target abnormal link data in the micro-service business is determined based on the target abnormal link data. The abnormal link node is determined in the target abnormal link based on the abnormal node information contained in the abnormal link node information.

[0111] In the above example, the abnormal link node information can be the link label of the abnormal link and the link node label of the abnormal link node. The target abnormal link data with abnormalities corresponding to the abnormal link node information is determined in the to-be-processed link data set based on the link label contained in the abnormal link node information. The target abnormal link A corresponding to the target abnormal link data is determined. The abnormal link node a in the target abnormal link A is determined based on the link node label of the abnormal link node. Thus, the abnormal link node a is facilitated for subsequent abnormal processing.

[0112] In summary, the target abnormal link corresponding to the micro-service business is determined based on the target abnormal link data, and then the abnormal link node in the target abnormal link is determined, thereby improving the accuracy of the determination of the abnormal link node.

[0113] Further, after determining the abnormal link node, considering that the abnormal node can cause the normal operation of the micro-service business, therefore, the abnormal link node needs to be subjected to subsequent abnormal feedback and abnormal processing, and the specific implementation is as follows:

[0114] generating abnormal information based on the abnormal link node; and feeding back the abnormal information to an information receiver corresponding to the micro-service business.

[0115] Specifically, the abnormal information can include link node identifier of the abnormal link node, abnormal type, abnormal time and the like; the information receiver can be a client or a user for root cause positioning.

[0116] Based on this, the abnormal type and the abnormal time of the abnormal link node are determined, and the abnormal information is generated based on the link node identifier, the abnormal type and the abnormal time of the abnormal link node. The abnormal information is fed back to the information receiver corresponding to the microservice business.

[0117] In the above example, after the abnormal link node is determined, the link node label P of the abnormal link node is determined, and the abnormal type of the abnormal link node is determined: calculation abnormality, time of abnormality. The abnormal information is generated according to the node label P of the abnormal link node, the calculation abnormality and the time of abnormality, and is sent to the client or the user.

[0118] In summary, by obtaining the historical link data corresponding to the microservice business, and determining the target abnormal positioning model corresponding to the historical link data; determining the to-be-processed link data set corresponding to the microservice business, and clustering the to-be-processed link data set, determining the cluster center link data according to the clustering result; inputting the cluster center link data into the target abnormal positioning model to obtain the abnormal link node information corresponding to the cluster center link data; determining the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining the abnormal link node in the target abnormal link. On the basis of the initial abnormal positioning model, the model is fine-tuned, so that the adjusted initial abnormal positioning model is suitable for a specific microservice business, so that the initial abnormal positioning model has a wide applicability and strong generalization ability; when the root cause positioning is performed through the target abnormal positioning model, the cluster center link data is selected for root cause positioning, and the root cause positioning speed of the microservice business is improved.

[0119] The following is a combination of the accompanying Figure 3 Taking the application of the root cause positioning method provided in the specification in root cause positioning as an example, the root cause positioning method is further described. Among them, Figure 3 A flow chart of a processing process of a root cause positioning method provided by an embodiment of the specification is shown, which specifically includes the following steps.

[0120] With the development of computer technology, microservices on the cloud are rapidly developing. Microservice architecture is a highly scalable, highly available, and easy-to-maintain and update service architecture. The continuous expansion of microservices makes the RPC dependency graph complex, exacerbates the tail-of-scale effect, and makes many empirical rules unreliable. Previous work on microservice performance debugging is based on correlation, empirical thresholds, or non-scalable algorithms and deep learning models, and none of them use microservice benchmarks with comparable production service scale for quantitative evaluation, making their accuracy and performance questionable for production-scale microservices. When microservices expand, many heuristic methods of root cause analysis algorithms based on experience and rules become unreliable, and even unverifiable.

[0121] In the prior art, work on microservice performance debugging is based on correlation, empirical thresholds, or non-scalable algorithms and deep learning models, resulting in low accuracy and slow speed. When microservices expand, algorithms for root cause positioning based on experience and rules become unreliable, and even root cause positioning cannot be achieved. Therefore, a new method is needed to perform root cause positioning when a fault occurs. In order to be able to perform root cause diagnosis on Trace data of microservices in a production environment and improve problem-solving efficiency, the embodiment provides a root cause positioning method.

[0122] Step S302: Determine at least two initial microservice businesses, and collect at least two pieces of link data corresponding to the at least two initial microservice businesses respectively according to a preset data collection strategy.

[0123] In order to improve the richness of data samples, when collecting link data, collect Trace data of different business systems, which can improve the generalization ability of the later model. As shown in Figure 4 When collecting data, the inventory data generated by multiple business systems is obtained, and the inventory data is used as original Trace data. The collection of link data can be realized by OpenTelemetry (a distributed link tracking standard).

[0124] Step S304: Divide the at least two pieces of link data corresponding to the at least two initial microservice businesses respectively according to a preset data division rule, and construct a to-be-trained link data set according to a division result.

[0125] Since the amount of original Trace data collected is large, the link data in the business system needs to be divided according to the Service dimension, and the running time of the service is sampled according to a certain distribution, so that the training sample can cover all service nodes and as many Trace data forms as possible.

[0126] Step S306: The to-be-trained link data in the to-be-trained link data set is encoded and processed, and the text vector corresponding to the to-be-trained link data is determined according to the processing result.

[0127] Feature engineering is performed on the original Trace data. The feature engineering includes steps such as text vector, Span exclusive time, determining error state, normalization of Span exclusive time, etc. In the text vector step, the original Trace data is processed by using the SBert model to realize the conversion of text to vector.

[0128] Step S308: Determine the time information and state information corresponding to the to-be-trained link data in the to-be-trained link data set.

[0129] The exclusive time of Span in the Trace data and the real state of Span are calculated as label information for subsequent model training. By processing the Trace data of the Open Telemetry protocol, a RPC Dependency Graph (Remote Procedure Call Dependency Graph) is constructed using the SpanID and parentSpanID in the data, and the dependency graph is renamed by corresponding (Service, name, kind). Here, the start time (startTime), end time (endTime), time consumption (duration), and status code (status Code) of the Trace are actively obtained.

[0130] The Service and name in the Trace data are encoded with semantic information (converted to a 768-dimensional vector using SBert), and special characters, hexadecimal encoding, and case conversion are removed during encoding. The exclusive time of Span is calculated, and the duration of the synchronous span of the non-leaf node includes the time spent in the service and the waiting time of its child span. Separating the own duration from the waiting time can help us locate the root cause of high latency Trace, because the own duration of the span can be used to predict the potential time saving amount, and if the performance problem related to the span is alleviated, how much time can be saved. Figure 4 The exclusive time of the parent Span (P) is (T1-T0)+(T5-T4), the exclusive time of Span (A) is T3-T1, and the exclusive time of Span (B) is T4-T2. Conversion of Span duration: the duration value is scaled using a logarithmic transformation with base 10. In addition, global mean is 4.0 and standard deviation is 1.0 for normalization, so that the anomaly positioning model can be directly applied to the trace data set without re-scaling.

[0131] Step S310: based on the time information and the state information and the text vector, a link data sample corresponding to the to-be-trained link data pair is constructed, and a link data sample set is formed.

[0132] Figure 4 In the middle, 1, 2, and 3 in the graph structure represent Service, operation, and kind, respectively, and 4 and 5 represent SpanID and parent SpanID, respectively. 6, 7, 8, and 9 represent start, end, duration, and status, respectively. The graph structure is a Trace data sample.

[0133] Step S312: the to-be-trained abnormal positioning model is trained using the link data sample set until an initial abnormal positioning model that meets the training stop condition is obtained.

[0134] The GIN model is trained using the link data sample set to obtain an abnormal positioning model with generalization ability. A counterfactual query is generated to perform root cause positioning of abnormal Trace links. CBN (Causal Bayesian Networks) is used to depict the propagation of error information in Trace data. GIN (Graph Isomorphism Network) is used to embed and encode Trace link data, and learning is performed through a specific loss function to finally complete the learning of embedded features. The counterfactual method is used for root cause analysis. Counterfactual query refers to the expected trace duration and error state if certain spans are restored to a normal state under certain conditions. That is, this query is based on the assumption that certain spans are in a normal state, and how the entire system will operate.

[0135] Step S314: obtaining historical link data corresponding to the microservice business, and updating the initial abnormal positioning model to a target abnormal positioning model based on the historical link data.

[0136] After obtaining the initial abnormal positioning model with abnormal root cause positioning capability, the application of the initial abnormal positioning model can be realized. As shown in Figure 5 The stock data under the microservice business is obtained as historical link data for fine-tuning of the initial abnormal positioning model. The initial abnormal positioning model is fine-tuned in combination with the stock data and the log data stored in the log to realize pre-training of the model, and a new model suitable for the current microservice business, i.e., the target abnormal positioning model, is obtained.

[0137] Step S316: Determine the to-be-processed link data set corresponding to the microservice business, and determine the to-be-processed link data contained in the to-be-processed link data set.

[0138] In actual Trace root cause diagnosis, link data is collected in real time, candidate data is obtained by filtering the collected link data based on specific filtering conditions, and the to-be-processed link data set that needs to be diagnosed in the microservice business is constructed based on the candidate data.

[0139] Step S318: Cluster the to-be-processed link data set, and determine the cluster center link data according to the clustering result.

[0140] A specific clustering algorithm is used to cluster the candidate data to obtain each cluster center candidate data. The Span identifier is composed of its label: (Service, name, kind) tuple, and the labels of all ancestor Spans within the maximum distance d_max, to reflect the structure and state of the given trace. Different Spans sharing the same identifier are merged in the set, and their weights are equal to the sum of their durations. When the structure and execution state of two traces are similar, the same elements with similar weights can be found in the two trace sets. We use the extended Jaccard index to calculate the similarity of the trace sets. DBSCAN algorithm is used for clustering to obtain structurally similar Trace clusters, and representative (cluster center) Trace links are found from them as the Trace links to be analyzed for root cause.

[0141] Step S320: Input the cluster center link data into the target anomaly positioning model to obtain the abnormal link node information corresponding to the cluster center link data.

[0142] Load the new model obtained by updating the initial anomaly positioning model, and perform inference on each cluster center candidate data based on the new model to realize root cause positioning of each cluster center candidate data.

[0143] Step S322: Determine the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine the abnormal link node in the target abnormal link.

[0144] After determining the abnormal link node corresponding to each cluster center candidate data, the abnormal link node where the anomaly is located is determined, and the abnormal node is processed or the abnormal information is recorded.

[0145] In practical applications, microservices can also be synthesized to provide larger-scale verification data. In open-source data, the microservice systems found are not complex, and the number of service nodes involved is small, which cannot accurately reflect the scale and complexity of microservice systems in real production environments. For limited microservice systems for evaluation, it is also difficult to accurately evaluate the capabilities of each evaluation system. Therefore, a microservice generation system is written during the experimental evaluation phase, which can support the generation of microservice systems with complex network structures and provide common fault injection methods.

[0146] As shown in Figure 6 , a number of services (0-9) are first generated, and RPCs are assigned to different services to form the entire microservice system. It randomly marks a service as a front-end, middleware, back-end, and leaf node, and these services have different positions and fan-out degrees in the RPC dependency graph. A set of commonly used service and RPC names are also collected and assigned to services and RPCs to make their semantics in the trace link data more realistic. The generated services and RPCs are used to generate a logical RPC dependency graph according to some strategies. The execution graph describes the order and dependency of child RPCs called by the same parent node. The edge from the parent RPC to the child RPC indicates that the child RPC can be directly called by the parent node without waiting for the results of any other child RPC. The edge between two child RPCs means that the target RPC can only be called after the source RPC response is received and processed. Through the above steps, a microservice system can be generated more clearly, with different types of services attached to each node (traffic type node, disk IO intensive node, computing intensive node, etc.). The above microservice system is deployed on a cloud platform. With the help of related data collectors, subsequent algorithm verification can be performed.

[0147] In this embodiment, a GNN-based model is designed to identify the root cause in microservices, which is better than previous work in terms of accuracy, performance, and flexibility, especially in large-scale cases. A distance measurement method is proposed to measure the similarity between two traces for clustering. This measurement method can distinguish traces with different call paths and fault patterns. To quantitatively evaluate the proposed method in production-scale microservices, an evaluation method using synthetic benchmarks is designed. This benchmark can be generated at any scale and deployed in a k8s cluster to simulate the behavior of real production services.

[0148] In summary, by obtaining historical link data corresponding to the microservice business, a target abnormal positioning model corresponding to the historical link data is determined; a to-be-processed link data set corresponding to the microservice business is determined, and the to-be-processed link data set is clustered, and a cluster center link data is determined according to a clustering result; the cluster center link data is input into the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data; a target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and an abnormal link node is determined in the target abnormal link. The model is fine-tuned based on the initial abnormal positioning model, so that the adjusted initial abnormal positioning model is suitable for a specific microservice business, so that the initial abnormal positioning model has wide applicability and strong generalization ability; when the root cause positioning is performed through the target abnormal positioning model, the cluster center link data is selected for root cause positioning, and the root cause positioning speed of the microservice business is improved.

[0149] Corresponding to the method embodiments described above, the specification also provides root cause positioning device embodiments, Figure 7 A structural schematic diagram of a root cause positioning device provided by one embodiment of the specification is shown. As shown in the figure, Figure 7 The device includes:

[0150] The acquisition module 702 is configured to obtain historical link data corresponding to the microservice business, and update an initial abnormal positioning model to a target abnormal positioning model based on the historical link data;

[0151] The clustering module 704 is configured to determine a to-be-processed link data set corresponding to the microservice business, and cluster the to-be-processed link data set, and determine cluster center link data according to a clustering result;

[0152] The input module 706 is configured to input the cluster center link data into the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data;

[0153] The determination module 708 is configured to determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

[0154] An optional embodiment, the acquisition module 702 is further configured to:

[0155] update the initial abnormal positioning model to a target abnormal positioning model corresponding to the historical link data; wherein the training of the initial abnormal positioning model includes: determining a to-be-trained link data set based on at least two initial microservice businesses; constructing a link data sample set based on at least two to-be-trained link data included in the to-be-trained link data set;

[0156] train the abnormal positioning model to be trained using the link data sample set until an initial abnormal positioning model meeting a training stop condition is obtained.

[0157] In an optional embodiment, the obtaining module 702 is further configured to:

[0158] convert the link data to be trained into a text vector, and determine time information and state information of the link data to be trained; update the text vector based on the time information and the state information, and construct link data samples corresponding to the link data to be trained based on the updated text vector.

[0159] In an optional embodiment, the obtaining module 702 is further configured to:

[0160] determine at least two initial microservice businesses; collect at least two pieces of link data corresponding to the at least two initial microservice businesses respectively according to a preset data collection strategy; divide the at least two pieces of link data corresponding to the at least two initial microservice businesses respectively according to a preset data division rule, determine a subset of link data to be trained corresponding to each initial microservice business according to a division result, and construct a set of link data to be trained based on the at least two subsets of link data to be trained.

[0161] In an optional embodiment, the obtaining module 702 is further configured to:

[0162] perform encoding processing on the link data to be trained, determine a text vector corresponding to the link data to be trained according to a processing result, calculate a start time and an end time of sub-link data included in the link data to be trained, and determine time information corresponding to the link data to be trained according to a calculation result, and take sub-state information of the sub-link data included in the link data to be trained as state information of the link data to be trained.

[0163] In an optional embodiment, the input module 706 is further configured to:

[0164] obtain at least two pieces of link data to be processed corresponding to the microservice business based on a preset data obtaining strategy, and construct a set of link data to be processed using the at least two pieces of link data to be processed.

[0165] In an optional embodiment, the input module 706 is further configured to:

[0166] determine link data to be processed included in the set of link data to be processed, cluster the set of link data to be processed according to a data structure, a link state, and a time weight of each piece of link data to be processed in the set of link data to be processed, and determine a cluster center link data according to a clustering result.

[0167] In an optional embodiment, the determining module 708 is further configured to:

[0168] determine target abnormal link data in the to-be-processed link data set based on the abnormal link node information, determine a target abnormal link corresponding to the microservice business based on the target abnormal link data, and determine an abnormal link node in the target abnormal link based on the abnormal link node information.

[0169] In an optional embodiment, the determining module 708 is further configured to:

[0170] generate abnormal information based on the abnormal link node, and feed back the abnormal information to an information receiver corresponding to the microservice business.

[0171] In summary, by obtaining historical link data corresponding to the microservice business, and determining a target abnormal positioning model corresponding to the historical link data, a to-be-processed link data set corresponding to the microservice business is determined, and the to-be-processed link data set is clustered, and a cluster center link data is determined according to a clustering result. The cluster center link data is input into the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data. The target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and an abnormal link node is determined in the target abnormal link. The initial abnormal positioning model is fine-tuned based on the initial abnormal positioning model, so that the adjusted initial abnormal positioning model is applicable to a specific microservice business, so that the initial abnormal positioning model has a wide applicability and strong generalization ability. When the root cause is located by the target abnormal positioning model, the cluster center link data is selected for root cause positioning, and the root cause positioning speed of the microservice business is improved.

[0172] The above is a schematic scheme of the root cause positioning device of the embodiment. It should be noted that the technical scheme of the root cause positioning device belongs to the same concept as the technical scheme of the root cause positioning method described above. The technical scheme of the root cause positioning device is not described in detail, and can be referred to the description of the technical scheme of the root cause positioning method.

[0173] Corresponding to the method embodiments described above, the present specification also provides root cause positioning system embodiments, Figure 8 is an architectural diagram of a root cause positioning system provided by an embodiment of the present specification. The root cause positioning system 800 includes a server 810 and a client 820.

[0174] The client 820 submits an abnormal positioning request to the server 810 for a target microservice business.

[0175] The server 810 parses the abnormality positioning request to obtain debugging link data and target link data; updates an initial abnormality positioning model to a to-be-used abnormality positioning model based on the debugging link data; clusters the target link data, determines to-be-input link data according to a clustering result; inputs the to-be-input link data to the to-be-used abnormality positioning model, obtains abnormal node information corresponding to the target microservice business; determines an abnormal node based on the abnormal node information, and generates abnormal feedback information based on the abnormal node and the abnormal node information; and sends the abnormal feedback information as a response to the abnormality positioning request to the client 820.

[0176] The client 820 performs abnormality processing on the target microservice business based on the abnormal feedback information.

[0177] In actual application, the client corresponds to any demand party that has a microservice root cause positioning demand. The demand party submits an abnormality positioning request to the server by operating the client. The server obtains debugging link data and target link data after parsing the abnormality positioning request; the debugging link data is used to fine-tune an initial abnormality positioning model, so that the prediction ability of the adjusted initial abnormality positioning model can realize abnormality positioning on the link data of the target microservice business. The initial abnormality positioning model is updated to a to-be-used abnormality positioning model based on the debugging link data. The target link data is clustered, and to-be-input link data is determined according to a clustering result. The to-be-input link data is input to the to-be-used abnormality positioning model, and abnormal node information corresponding to the target microservice business is obtained. An abnormal node is determined based on the abnormal node information, and abnormal feedback information is generated based on the abnormal node and the abnormal node information. The abnormal feedback information is sent as a response to the abnormality positioning request to the client. After receiving the abnormal feedback information, the client can perform abnormality processing on the target microservice business based on the abnormal feedback information, where the abnormality processing includes but is not limited to recovering the abnormality, recording the abnormality type and the abnormality cause, and sending the abnormal feedback information to an abnormality processing personnel.

[0178] In summary, the model is fine-tuned based on the initial abnormality positioning model, so that the adjusted initial abnormality positioning model is suitable for a specific microservice business, and the initial abnormality positioning model has wide applicability and strong generalization ability. When root cause positioning is performed through the target abnormality positioning model, the cluster center link data is selected for root cause positioning, and the root cause positioning speed of the microservice business is improved.

[0179] Figure 9A structural block diagram of a computing device 900 is shown, according to one embodiment of the present specification. The components of the computing device 900 include, but are not limited to, a memory 910 and a processor 920. The processor 920 is connected with the memory 910 through a bus 930, and a database 950 is used to save data.

[0180] The computing device 900 also includes an access device 940, which enables the computing device 900 to communicate via one or more networks 960. Examples of these networks include the Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. The access device 940 can include one or more of any type of network interface (e.g., a network interface card (NIC)), wired or wireless, such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, Near Field Communication (NFC).

[0181] In one embodiment of the present specification, the above-mentioned components of the computing device 900 and other components not shown in the Figure 9 may be connected with each other, for example, through a bus. It should be understood that Figure 9 The structural block diagram of the computing device shown is only for the purpose of example, and is not a limitation on the scope of the present specification. Other components can be added or replaced as needed by those skilled in the art.

[0182] The computing device 900 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other type of mobile device, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 900 can also be a mobile or stationary server.

[0183] The processor 920 is configured to execute computer-executable instructions to perform the steps of the root cause localization method described above.

[0184] The above describes a schematic solution of the computing device of the embodiment. It should be noted that the technical solution of the computing device and the technical solution of the root cause localization method described above belong to the same concept, and the details of the technical solution of the computing device that are not described in detail can be referred to the description of the technical solution of the root cause localization method.

[0185] An embodiment of the present specification also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the root cause localization method described above.

[0186] The above describes a schematic solution of the computer-readable storage medium of the embodiment. It should be noted that the technical solution of the storage medium and the technical solution of the root cause localization method described above belong to the same concept, and the details of the technical solution of the storage medium that are not described in detail can be referred to the description of the technical solution of the root cause localization method.

[0187] An embodiment of the present specification also provides a computer program, which, when executed in a computer, causes the computer to perform the steps of the root cause localization method described above.

[0188] The above describes a schematic solution of the computer program of the embodiment. It should be noted that the technical solution of the computer program and the technical solution of the root cause localization method described above belong to the same concept, and the details of the technical solution of the computer program that are not described in detail can be referred to the description of the technical solution of the root cause localization method.

[0189] The above-described embodiments of the application have several aspects, no single one of which is solely responsible for the application's desirable attributes. Without limiting the scope of the application as expressed by the claims which follow, some further embodiments make these aspects even more useful. Other embodiments can result in less desirable attributes.

[0190] The computer readable medium can include any entity or apparatus capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, software distribution medium, etc. It should be noted that the computer readable medium can include appropriate contents according to the requirements of patent practice, for example, according to the patent practice in some regions, the computer readable medium does not include electrical carrier signals and telecommunication signals.

[0191] It should be noted that for the foregoing method embodiments, the descriptions are expressed as a series of action combinations for the sake of simplicity and brevity, but those skilled in the art should know that the present application is not limited by the order of the actions, because according to the present application, certain steps can be performed in other orders or simultaneously. In addition, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily all the necessary actions and modules of the present application.

[0192] In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0193] The preferred embodiments of the present application disclosed above are only used to help explain the present application. The alternative embodiments do not describe all the details and do not limit the application to the specific embodiments described. Obviously, according to the content of the embodiments of the present application, many modifications and changes can be made. The present application selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of the present application, so that those skilled in the art can well understand and use the present application. The present application is limited by the claims and their entire scope and equivalents.

Claims

1. A root cause positioning method, comprising: obtaining historical link data corresponding to a microservice business, and determining a target abnormal positioning model corresponding to the historical link data; determining a to-be-processed link data set corresponding to the microservice business, and clustering the to-be-processed link data set, and determining a cluster center link data according to a clustering result; inputting the cluster center link data into the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data; determining a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining an abnormal link node in the target abnormal link.

2. The method of claim 1, wherein the determining a target abnormal positioning model corresponding to the historical link data comprises: updating an initial abnormal positioning model to the target abnormal positioning model corresponding to the historical link data; wherein the training of the initial abnormal positioning model comprises: determining a to-be-trained link data set based on at least two initial microservice businesses; constructing a link data sample set based on at least two to-be-trained link data contained in the to-be-trained link data set; and training a to-be-trained abnormal positioning model using the link data sample set until an initial abnormal positioning model meeting a training stop condition is obtained.

3. The method of claim 2, wherein the construction of any one link data sample in the link data sample set comprises: converting the to-be-trained link data into a text vector, and determining time information and state information of the to-be-trained link data; updating the text vector based on the time information and the state information, and constructing a link data sample corresponding to the to-be-trained link data based on the updated text vector.

4. The method of claim 2, wherein the determining a to-be-trained link data set based on at least two initial microservice businesses comprises: determining at least two initial microservice businesses; collecting at least two link data corresponding to the at least two initial microservice businesses according to a preset data collection strategy; dividing the at least two link data corresponding to the at least two initial microservice businesses according to a preset data division rule, and determining a to-be-trained link data subset corresponding to each initial microservice business according to a division result; constructing a to-be-trained link data set based on the at least two to-be-trained link data subsets.

5. The method of claim 3, wherein the converting the to-be-trained link data into a text vector, and determining time information and state information of the to-be-trained link data comprises: performing encoding processing on the to-be-trained link data, and determining a text vector corresponding to the to-be-trained link data according to a processing result; calculating start time and end time of sub-link data contained in the to-be-trained link data, and determining time information corresponding to the to-be-trained link data according to a calculation result; taking sub-state information of the sub-link data contained in the to-be-trained link data as state information of the to-be-trained link data.

6. The method of claim 1, wherein the determining a to-be-processed link data set corresponding to the microservice business comprises: acquire at least two pieces of to-be-processed link data corresponding to the microservice business based on a preset data acquisition strategy; construct a to-be-processed link data set by using the at least two pieces of to-be-processed link data.

7. The method of claim 1, wherein the clustering of the to-be-processed link data set comprises: determining to-be-processed link data included in the to-be-processed link data set; and clustering the to-be-processed link data set according to data structures, link states, and time weights of each to-be-processed link data in the to-be-processed link data set, and determining a cluster center link data according to a clustering result.

8. The method of claim 1, wherein the determining of the target abnormal link corresponding to the microservice business based on the abnormal link node information and the determination of an abnormal link node in the target abnormal link comprise: determining target abnormal link data in the to-be-processed link data set based on the abnormal link node information; determining the target abnormal link corresponding to the microservice business based on the target abnormal link data; and determining an abnormal link node in the target abnormal link based on the abnormal link node information.

9. The method of claim 1, further comprising, after the step of determining the abnormal link node in the target abnormal link: generating abnormal information based on the abnormal link node; and feeding back the abnormal information to an information receiver corresponding to the microservice business.

10. A root cause positioning system, comprising a server client; the client, submitting an abnormal positioning request to the server for a target microservice business; the server, parsing the abnormal positioning request to obtain debugging link data and target link data, and updating an initial abnormal positioning model to a to-be-used abnormal positioning model based on the debugging link data; clustering the target link data, and determining to-be-input link data according to a clustering result; inputting the to-be-input link data to the to-be-used abnormal positioning model to obtain abnormal node information corresponding to the target microservice business; determining an abnormal node based on the abnormal node information, and generating abnormal feedback information based on the abnormal node and the abnormal node information; sending the abnormal feedback information as a response to the abnormal positioning request to the client; and the client, performing abnormal processing on the target microservice business based on the abnormal feedback information.

11. A root cause positioning apparatus, comprising: an acquisition module configured to acquire historical link data corresponding to a microservice business, and determine a target abnormal positioning model corresponding to the historical link data; a clustering module configured to determine a to-be-processed link data set corresponding to the microservice business, and cluster the to-be-processed link data set, and determine a cluster center link data according to a clustering result; an input module configured to input the cluster center link data to the target abnormal positioning model to obtain abnormal link node information corresponding to the cluster center link data. A determining module configured to determine a target abnormal link corresponding to the micro-service business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link. 12.A computing device comprising: a memory and a processor; the memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the root cause locating method according to any one of claims 1 to 9. 13.A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the root cause locating method according to any one of claims 1 to 9.

Images