Fault positioning method and device based on link log, electronic equipment and medium

Abstract

The invention discloses a fault positioning method and device based on a link log, electronic equipment and a medium, and relates to the technical field of data processing. The method comprises the following steps: acquiring multiple link log data of a target service; determining at least one time consumption interval, and performing statistics on each entity field and error report condition of each link log data based on each time consumption interval to obtain a first number of each entity field in a target time consumption interval and an error report number of each entity field in the target time consumption interval; based on each first number and each report error number, respectively determining the correlation between each entity field and the report error, and obtaining each first correlation calculation result; and determining a target entity field according to each first correlation calculation result, and positioning a fault of the target service based on the target entity field. According to the scheme provided by the embodiment of the invention, the fault of the target service can be quickly and accurately positioned, and help is provided for subsequent fault removal of the target service.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a link log-based fault locating method, device, electronic device and medium. Background Art

[0002] When the target business implements the corresponding functions, the data interaction behind it is complex, the number of server nodes and services called is large, and there are complex networking and calling relationships between services. In order to analyze and solve the abnormal situations of service processing, it is necessary to determine the calling relationship between services and the response time of each service node through link tracking (link log) to help technicians solve the faults in the service system.

[0003] The so-called link log is a request that goes through the interface calls of multiple projects. It strings together all the requests called in this request through a global ID. Through the global ID, all the system logs involved can be quickly located, making it convenient to troubleshoot problems when they occur online.

[0004] At present, after collecting thousands of link logs reporting errors, it is difficult to troubleshoot and quickly locate the entity that caused the fault. Summary of the invention

[0005] The present invention provides a link log-based fault location method, device, electronic device and medium, so as to quickly and accurately locate the fault of a target service and provide assistance for the subsequent target service fault elimination.

[0006] According to one aspect of the present invention, a fault location method based on a link log is provided, the method comprising:

[0007] Acquire multiple link log data of the target business; the link log data includes: at least one entity field, the time taken to complete the target request, and the error situation;

[0008] Determine at least one time-consuming interval, and based on each of the time-consuming intervals, perform statistics on each of the entity fields and the error reporting of each of the link log data to obtain a first number of each of the entity fields within the target time-consuming interval and the number of errors within the target time-consuming interval;

[0009] Based on each of the first numbers and each of the error numbers, respectively determine the correlation between each entity field and the error, and obtain each first correlation calculation result;

[0010] A target entity field is determined according to each of the first correlation calculation results, and a fault of the target business is located based on the target entity field.

[0011] According to another aspect of the present invention, a link log-based fault location device is provided, the device comprising:

[0012] A link log data acquisition module is used to acquire multiple link log data of the target business; the link log data includes: at least one entity field, the time taken to complete the target request, and the error situation;

[0013] A determination module, used to determine at least one time-consuming interval, and based on each of the time-consuming intervals, perform statistics on each of the entity fields and the error reporting of each of the link log data to obtain a first number of each of the entity fields within a target time-consuming interval and a number of errors within the target time-consuming interval;

[0014] A correlation calculation result determination module, used to determine the correlation between each entity field and the error report based on each of the first numbers and each of the error report numbers, and obtain each first correlation calculation result;

[0015] A fault locating module is used to determine a target entity field according to each of the first correlation calculation results, and locate the fault of the target business based on the target entity field.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the link log-based fault location method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the link log-based fault location method described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the fault location method based on the link log described in any embodiment of the present invention is implemented.

[0022] The technical solution of the embodiment of the present invention is to obtain multiple link log data of the target business; the link log data includes: at least one entity field, the time taken to complete the target request and the error situation; determine at least one time interval, and based on each time interval, perform statistics on the entity fields and error situations of each link log data to obtain a first number of each entity field within the target time interval, and the number of errors within the target time interval; based on each first number and each error number, determine the correlation between each entity field and the error to obtain each first correlation calculation result; determine the target entity field according to each first correlation calculation result, and locate the fault of the target business based on the target entity field, so as to quickly and accurately locate the fault of the target business and provide assistance for the subsequent troubleshooting of the target business.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a fault location method based on link logs provided according to Embodiment 1 of the present invention;

[0026] Figure 2 is a flow chart of a fault location method based on link logs provided according to Embodiment 2 of the present invention;

[0027] Figure 3 It is a structural schematic diagram of a link log-based fault location device provided according to Embodiment 3 of the present invention;

[0028] Figure 4 It is a structural schematic diagram of an electronic device for implementing a link log-based fault location method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 This is a flowchart of a link log-based fault location method provided according to the first embodiment of the present invention. This embodiment is applicable to the situation where the target service fault is located based on the link log data of the target service. The method can be executed by a link log-based fault location device. The link log-based fault location device can be implemented in the form of hardware and / or software. The link log-based fault location device can be configured in an electronic device with data processing capabilities such as a computer, server, cloud server or tablet computer. Specifically, refer to Figure 1 , the method comprising:

[0033] Step 110: Obtain multiple link log data of the target business.

[0034] The link log data includes: at least one entity field, the time taken to complete the target request, and the error situation.

[0035] In an optional implementation of this embodiment, the link log data generated by each business in the target system can be collected by the link collector according to a preset collection ratio; wherein each link log data may include at least one entity field, the time taken to complete the target request, and the error situation; the entity field may include: host name, process name, name of the application in the distributed system or the uniform resource locator (URL) of the request, etc.; the time taken to complete the target request may be 120ms, 150ms or 400ms, etc.; the error situation of each link log data may be an error or a non-error, in this embodiment 1 represents an error, and 0 represents no error. It can be understood that the collected link log data may also include the tracking identifier of each link log data or the unique identifier in the cross-service call, etc., which is not limited in this embodiment.

[0036] In this embodiment, the target system can be any system, for example, a shopping system, a query system or a search engine, etc., which is not limited in this embodiment; the target system can include multiple businesses; illustratively, for a shopping system, it can include an order generation business, an order evaluation business or a payment business, etc., which is not limited in this embodiment.

[0037] The target business involved in this embodiment may be any business in the target system, such as the order generation business, order evaluation business or payment business involved above, which is not limited in this embodiment.

[0038] In an example of this embodiment, the collected log data of each link may be as shown in Table 1:

[0039] Table 1

[0040]

[0041] In Table 1, traceid is the tracking identifier of each link log data; spanid is the unique identifier of each link log data in cross-service calls; host, process, k8s.name and http.url are the entity fields of each link log data; error is the error situation of each link log data; time is the time taken to complete the request of each link log data.

[0042] It should be noted that the acquisition of each link log data in this embodiment is only obtained after authorization by the user, and the acquisition method is reasonable and legal.

[0043] Step 120, determine at least one time interval, and based on each time interval, perform statistics on each entity field and error situation of each link log data to obtain a first number of each entity field within the target time interval and the number of errors within the target time interval.

[0044] Optionally, in this embodiment, after obtaining the log data of each link, at least one time consumption interval can be determined based on the duration of each link log data; further, the entity fields and error conditions of each link log data can be counted based on each time consumption interval, so as to obtain the first number of each entity field within the target time consumption interval, and the error data within the target time consumption interval; wherein, the target time consumption interval is any determined time consumption interval, and is not limited to it in this embodiment.

[0045] In an optional implementation of this embodiment, determining at least one time-consuming interval may include: determining the maximum time-consuming duration and the minimum time-consuming duration in each of the link log data; determining the number of the time-consuming intervals and the time interval between every two adjacent time-consuming intervals based on the maximum time-consuming duration and the minimum time-consuming duration; and determining each of the time-consuming intervals according to the number of the time-consuming intervals and the time interval.

[0046] Optionally, in this embodiment, after obtaining the log data of each link, the maximum time consumption and the minimum time consumption in each link log data can be further determined; for example, the maximum time consumption of each link log data in Table 1 is 500ms, and the minimum time consumption is 120ms; further, the number of time consumption intervals and the time consumption interval between every two time consumption intervals can be determined according to the maximum time consumption and the minimum time consumption.

[0047] Exemplarily, in the above example, the maximum time consumption duration is 500ms, then the number of time consumption intervals can be determined as 5, and the time consumption interval between two adjacent time consumption intervals is 100, and the obtained time consumption intervals can be respectively: 0-100, 100-200, 200-300, 300-400 and 400-500; in another example of the present embodiment, the maximum time consumption duration of each link log data is 500ms, the minimum time consumption duration is 120ms, and the difference between the maximum time consumption duration and the minimum time consumption duration is 380, then the number of time consumption intervals can be determined as 4, and the time consumption interval between two adjacent time consumption intervals is 100, and the obtained time consumption intervals can be respectively: 100-200, 200-300, 300-400 and 400-500.

[0048] In an optional implementation of the present embodiment, after determining each time-consuming interval, the number of each entity field and the number of errors in each time-consuming interval can be further determined. Optionally, in the present embodiment, statistics are taken on each entity field and the error situation of each link log data based on each time-consuming interval to obtain the first number of each entity field in the target time-consuming interval and the number of errors in the target time-consuming interval, which may include: determining a target time-consuming interval matching the target link log data based on the time range of each time-consuming interval; statistics are taken on the target link log data based on the field names of each entity field of the target link log data and the error situation; in response to a statistics completion instruction for all link log data, the first number of each entity field in the target time-consuming interval and the number of errors in the target time-consuming interval are obtained.

[0049] Optionally, in this embodiment, the target time interval described in the target link log data can be determined based on the duration of the target link log data; and the entity fields and error conditions of the target link log data are added to the column to which the target time interval belongs; after the statistics of all the collected link log data are completed, the first number of each entity field within the target time interval and the number of errors within the target time interval can be obtained.

[0050] In an example of this embodiment, for each link log data in Table 1, statistics are collected on each entity field and error situation of each link log data based on each time-consuming interval, and the statistical results shown in Table 2 can be obtained:

[0051] Table 2

[0052]

[0053]

[0054] For example, in Table 2, it can be seen that the first number of the entity field "host" in the time interval (100-200] is 3, and the first number in the time interval (200-300] is 4; the number of errors in the time interval (100-200] is 0; the number of errors in the time interval (200-300] is 2.

[0055] Step 130: Based on each of the first numbers and each of the error numbers, respectively determine the correlation between each entity field and the error, and obtain each first correlation calculation result.

[0056] In an optional implementation of the present embodiment, after obtaining the first number of each entity field of each link log data within the target time interval and the number of errors within the target time interval, the correlation between each entity field and the error can be further determined based on each first number and each error number to obtain each first correlation calculation result; for example, the relationship between the host and the error or the correlation between the process and the error, etc.

[0057] Optionally, in this embodiment, based on each of the first numbers and each of the error numbers, the correlation between each entity field and the error is determined respectively to obtain each first correlation calculation result, which may include: calculating the first average value of each of the first numbers and the second average value of each of the error numbers in each time-consuming interval; determining the covariance and the standard deviation based on the first average value and the second average value; and obtaining the first correlation calculation result according to the covariance and each of the standard deviations.

[0058] In an optional implementation of the present embodiment, after obtaining the first number of each entity field of each link log data within the target time consumption interval and the number of errors within the target time consumption interval, the first average value of each first number within each time consumption interval and the second average value of each error number can be further calculated; and the covariance and standard deviation of the target entity field and the error situation can be determined based on the first average value and the second average value; finally, the first correlation calculation result can be calculated based on the calculated covariance and standard deviation.

[0059] In an example of the present embodiment, the first numbers of the entity field "host" in each time-consuming interval are "03421" respectively, and the number of errors in each time-consuming interval is "00211" respectively; then, the first average value is (0+3+4+2+1) / 5=2; the second average value is (0+0+2+2+1) / 5=0.8; the covariance calculated based on the covariance calculation formula is 0.6; the standard deviation of the entity field "host" is 1.4142; the standard deviation of the retained number is 0.7483; finally, the calculated correlation result between the entity field "host" and the error is 0.567; exemplarily, the first correlation calculation result = 0.6 / 1.4142*0.7486 = 0.567.

[0060] Optionally, in this embodiment, the correlation between the process or entity fields such as k8s.name and the error report can be calculated according to the same method; it can be understood that the greater the correlation calculation result, the greater the possibility that the entity field is wrong.

[0061] Step 140: Determine a target entity field according to each of the first correlation calculation results, and locate the fault of the target business based on the target entity field.

[0062] In an optional implementation of this embodiment, after each first correlation calculation result is calculated, the target entity field may be further determined according to each first correlation calculation result, and the fault of the target business may be located based on the target entity field.

[0063] Optionally, in this embodiment, the target entity field is determined according to each of the first correlation calculation results, and the fault of the target business is located based on the target entity field, which may include: sorting each of the first correlation calculation results in a set order, determining each of the first correlation calculation results that meet the preset requirements, and obtaining the target entity field corresponding to each of the first correlation calculation results that meet the preset requirements; obtaining performance data of each of the target entity fields, and locating the fault of the target business based on each of the performance data.

[0064] The set order may be from small to large or from large to small, which is not limited in this embodiment. The preset requirement may be that the correlation calculation result is greater than a set threshold, which may be 0.7, 0.8 or 0.9, etc., which is not limited in this embodiment; the preset requirement may also be the correlation calculation result that ranks in the top few places in the sorting result (for example, the top three or top five, etc.).

[0065] In an optional implementation of the present embodiment, after obtaining each first correlation calculation result, the first correlation calculation results can be sorted in ascending order, and the entity fields corresponding to the first correlation calculation results ranked in the top five in the sorted results can be determined as target entity fields; further, the performance data of each target entity field can be obtained, and the fault of the target business can be located based on the performance data of each target entity field.

[0066] In this embodiment, the performance data of the target entity field may include the CPU usage rate, memory usage rate or network monitoring data of the target entity field, which is not limited in this embodiment.

[0067] It can be understood that if the CPU usage of the target entity field reaches 99%, which obviously exceeds the set threshold, then the target entity field can be determined to be faulty; if the memory usage of the target entity field reaches 95%, which obviously exceeds the set threshold, then the target entity field can also be determined to be faulty.

[0068] The technical solution of this embodiment is to obtain multiple link log data of the target business; the link log data includes: at least one entity field, the time taken to complete the target request, and the error situation; determine at least one time interval, and based on each time interval, count the entity fields and error situations of each link log data to obtain a first number of each entity field within the target time interval, and the number of errors within the target time interval; based on each first number and each error number, determine the correlation between each entity field and the error to obtain each first correlation calculation result; determine the target entity field according to each first correlation calculation result, and locate the fault of the target business based on the target entity field, so as to quickly and accurately locate the fault of the target business and provide assistance for the subsequent troubleshooting of the target business.

[0069] Embodiment 2

[0070] Figure 2 1 is a flow chart of a fault location method based on link logs provided according to Embodiment 2 of the present invention. This embodiment is a further refinement of the above technical solution. The technical solution in this embodiment can be combined with each optional solution in one or more of the above embodiments. Figure 2 As shown, the method includes:

[0071] Step 210: Obtain multiple link log data of the target business.

[0072] Step 220: Determine at least one time-consuming interval.

[0073] Step 230: Count the entity fields and error conditions of each link log data based on each time-consuming interval to obtain a first number of each entity field within a target time-consuming interval and the number of errors within the target time-consuming interval.

[0074] Step 240: Based on each of the first numbers and each of the error numbers, respectively determine the correlation between each entity field and the error, and obtain each first correlation calculation result.

[0075] Step 250: Based on each of the time-consuming intervals, count the field values ​​of each entity field of each of the link log data to obtain a second number of field values ​​of each of the entity fields within the target time-consuming interval; based on each of the second numbers and each of the error numbers, determine the correlation between the field value of each entity field and the error to obtain each second correlation calculation result.

[0076] In an optional implementation of the present embodiment, after determining each time-consuming interval, the field value of each entity field of each link log data can be counted based on each time-consuming interval to obtain a second number of field values ​​of each entity field within the target time-consuming interval; further, based on each second number and the number of errors of each link log data within each time-consuming interval, the correlation between the field value of each entity field and the error can be determined respectively to obtain each second correlation calculation result.

[0077] It can be understood that, in each link log data involved in Table 1, if the entity field is a host, then the field value corresponding to the entity field may be: host-01, host-02, and host-03.

[0078] In an example of this embodiment, for each link log data in Table 1, each time-consuming interval performs statistics on the field value of each entity field of each link log data, and the statistical results shown in Table 3 can be obtained:

[0079] Table 3

[0080]

[0081]

[0082] It can be seen from Table 3 that the number of the field value "host-01" of the entity field host in the time interval (100-200] is 1, that is, the second number of the field value "host-01" of the entity field host in the time interval (100-200] is 1.

[0083] Optionally, in this embodiment, after obtaining the second number of field values ​​of each entity field within the target time interval, the correlation between the field value of each entity field and the error can be determined based on the second number and the number of errors to obtain the second correlation calculation results.

[0084] In an optional implementation of the present embodiment, based on the second number and each error number, the correlation between the field value of each entity field and the error is determined respectively to obtain each second correlation calculation result, which may include: calculating the third average value of each second number in each time-consuming interval and the second average value of each error number; determining the covariance and the standard deviation based on the third average value and the second average value; and obtaining the second correlation calculation result according to the covariance and each standard deviation.

[0085] Step 260, respectively add the second correlation calculation result corresponding to the target entity field and the first correlation calculation result to obtain the target correlation calculation result; sort each of the target correlation calculation results according to a set order, determine each target correlation calculation result that meets the preset requirements, and obtain the target entity field corresponding to each target correlation calculation result that meets the preset requirements, and the field value of the target entity field; obtain a reference entity field with the same field value as the target entity field from the entity library, and obtain performance data of each target entity field and each reference entity field; determine an entity relationship topology diagram between each target entity field and each reference entity field; locate the fault of the target business based on the entity relationship topology diagram and each performance data.

[0086] In an optional implementation of the present embodiment, after obtaining the first correlation calculation result and the second correlation calculation result, the first correlation calculation result corresponding to each entity field can be added. For example, the first correlation calculation result related to the entity field "host" and the error report and the second correlation calculation result related to the entity field value "host-01" and the error report can be added to obtain the target correlation calculation result.

[0087] Further, the target correlation calculation results can be sorted in a set order to determine the target correlation calculation results that meet the preset requirements, and the target entity fields corresponding to the target correlation calculation results that meet the preset requirements and the field values ​​of the target entity fields can be obtained. Further, the reference entity fields with the same field values ​​as the target entity fields can be obtained from the entity library, and the performance data of the target entity fields and the reference entity fields can be obtained; further, the entity relationship topology diagram of the target entity fields and the reference entity fields can be determined; further, the fault of the target business can be located based on the entity relationship topology diagram and the performance data.

[0088] In an example of this embodiment, the first correlation calculation results, the second correlation calculation results, and the target correlation calculation results may be as shown in Table 4:

[0089] Table 4

[0090]

[0091] In this embodiment, after calculating the first correlation calculation results, the second correlation calculation results and the target correlation calculation results in Table 4, the maximum field value related to the error can be obtained. Further, the entity library can be connected to obtain entities with the same specific value; for example, in the above example, host-host-01 is host:host-01 in the log, but in the entity library, entity.host:host-01; the relationship between entities can also be obtained (for example, k8s.name-app-service-02 belongs to host:host-01). Further, the performance data of each entity can be obtained, and further, the failure of the target business can be determined based on the relationship between the entities and the performance data of each entity.

[0092] In an optional implementation of the present embodiment, before locating the fault of the target service, the correlation between the time consumption of each link log data and the error report can also be calculated. The specific correlation calculation method can refer to the determination process of the first correlation calculation result, or the determination process of the second correlation calculation result, which will not be repeated in this embodiment.

[0093] For example, if the calculated correlation result between the time consumption of each link log data and the error reporting is 0.7, it is considered that the longer the time consumption of the link log data is, the greater the possibility of error reporting is.

[0094] The scheme of this embodiment can count the field values ​​of each entity field of each link log data based on each time-consuming interval to obtain a second number of field values ​​of each entity field within the target time-consuming interval; based on each second number and each error number, respectively determine the correlation between the field value of each entity field and the error to obtain each second correlation calculation result, and further, respectively add the second correlation calculation result corresponding to the target entity field and the first correlation calculation result to obtain the target correlation calculation result; sort each of the target correlation calculation results in a set order to determine each target correlation calculation result that meets the preset requirements, and obtain the target entity field corresponding to each target correlation calculation result that meets the preset requirements, and the field value of the target entity field; obtain a reference entity field with the same field value as the target entity field from the entity library, and obtain performance data of each target entity field and each reference entity field; determine an entity relationship topology diagram between each target entity field and each reference entity field; locate the fault of the target business based on the entity relationship topology diagram and each performance data, thereby improving the accuracy of fault location.

[0095] The solution of this embodiment can efficiently screen out the factors that have the greatest impact on the fault by calculating the correlation between the entity fields and their values ​​and the error reports, thereby giving priority to investigation and repair; at the same time, the analyzed field values ​​are connected to the entity library to obtain specific entities and their relationships, which can help the system realize automated fault analysis and improve positioning efficiency; by connecting to the performance data storage device, not only can the root cause analysis of the fault be realized, but also the performance monitoring data can be integrated into the fault handling process to provide more comprehensive information support; at the same time, the front end displays the entity relationship and performance data in the form of a topology diagram, which is intuitive and clear, allowing users to quickly understand complex system relationships, thereby accelerating troubleshooting.

[0096] Embodiment 3

[0097] Figure 3 FIG. 1 is a schematic diagram of a structure of a fault location device based on a link log according to Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a link log data acquisition module 310 , a determination module 320 , a correlation calculation result determination module 330 and a fault location module 340 .

[0098] The link log data acquisition module 310 is used to acquire multiple link log data of the target business; the link log data includes: at least one entity field, the time taken to complete the target request, and the error situation;

[0099] The determination module 320 is used to determine at least one time-consuming interval, and based on each of the time-consuming intervals, perform statistics on each of the entity fields and the error reporting of each of the link log data to obtain a first number of each of the entity fields within the target time-consuming interval and the number of errors within the target time-consuming interval;

[0100] A correlation calculation result determination module 330 is used to determine the correlation between each entity field and the error report based on each of the first numbers and each of the error report numbers, and obtain each first correlation calculation result;

[0101] The fault locating module 340 is configured to determine a target entity field according to each of the first correlation calculation results, and locate the fault of the target service based on the target entity field.

[0102] The solution of this embodiment is to obtain multiple link log data of the target business through the link log data acquisition module; determine at least one time-consuming interval through the determination module, and based on each of the time-consuming intervals, perform statistics on each entity field and the error situation of each link log data to obtain a first number of each entity field within the target time-consuming interval, and the number of errors within the target time-consuming interval; determine the correlation between each entity field and the error based on each of the first numbers and each of the error numbers through the correlation calculation result determination module to obtain each first correlation calculation result; determine the target entity field according to each of the first correlation calculation results through the fault location module, and locate the fault of the target business based on the target entity field, so as to quickly and accurately locate the fault of the target business and provide assistance for the subsequent fault elimination of the target business.

[0103] In an optional implementation of this embodiment, the determination module 320 is specifically used to determine the maximum time consumption duration and the minimum time consumption duration in each link log data;

[0104] Determine the number of the time-consuming intervals and the time-consuming interval between every two adjacent time-consuming intervals based on the maximum time-consuming duration and the minimum time-consuming duration;

[0105] Each of the time-consuming intervals is determined according to the number of the time-consuming intervals and the time-consuming interval.

[0106] In an optional implementation of this embodiment, the determination module 320 is further specifically configured to determine a target time-consuming interval matching the target link log data based on the time-consuming range of each of the time-consuming intervals;

[0107] Performing statistics on the target link log data based on the field names of each entity field of the target link log data and the error conditions;

[0108] In response to the statistics completion instruction of all link log data, a first number of each entity field within the target time interval and a number of errors within the target time interval are obtained.

[0109] In an optional implementation of this embodiment, the correlation calculation result determination module 330 is specifically configured to respectively calculate a first average value of each first number in each time-consuming interval and a second average value of each error reporting number;

[0110] determining a covariance and a standard deviation based on the first mean and the second mean;

[0111] A first correlation calculation result is obtained according to the covariance and each of the standard deviations.

[0112] In an optional implementation of this embodiment, the fault location module 340 is specifically used to sort the first correlation calculation results according to a set order, determine the first correlation calculation results that meet the preset requirements, and obtain the target entity field corresponding to the first correlation calculation results that meet the preset requirements;

[0113] Performance data of each of the target entity fields is obtained, and the fault of the target business is located according to each of the performance data.

[0114] In an optional implementation of this embodiment, the fault location device based on the link log further includes: a second correlation calculation result determination module, which is used to count the field values ​​of each entity field of each link log data based on each time-consuming interval to obtain a second number of field values ​​of each entity field within the target time-consuming interval;

[0115] Based on each of the second numbers and each of the error numbers, the correlation between the field value of each entity field and the error is determined respectively to obtain each second correlation calculation result.

[0116] In an optional implementation of this embodiment, the fault location module 340 is further specifically configured to add the second correlation calculation result corresponding to the target entity field and the first correlation calculation result to obtain a target correlation calculation result;

[0117] Sorting the target correlation calculation results according to a set order, determining the target correlation calculation results that meet the preset requirements, and obtaining the target entity fields corresponding to the target correlation calculation results that meet the preset requirements, as well as the field values ​​of the target entity fields;

[0118] Obtaining from the entity library a reference entity field having the same field value as the target entity field, and obtaining performance data of each target entity field and each reference entity field;

[0119] Determine an entity relationship topology diagram between each target entity field and each reference entity field;

[0120] The fault of the target business is located based on the entity relationship topology diagram and each of the performance data.

[0121] The link log-based fault location device provided in the embodiment of the present invention can execute the link log-based fault location method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0122] Embodiment 4

[0123] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0124] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0125] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0126] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a fault location method based on a link log, the method comprising: obtaining multiple link log data of a target service; the link log data comprises: at least one entity field, the time taken to complete a target request, and an error situation; determining at least one time interval, and based on each of the time intervals, performing statistics on each of the entity fields and the error situation of each of the link log data, obtaining a first number of each of the entity fields within the target time interval, and the number of errors within the target time interval; based on each of the first numbers and each of the error numbers, respectively determining the correlation between each of the entity fields and the error, obtaining each of the first correlation calculation results; determining the target entity field according to each of the first correlation calculation results, and locating the fault of the target service based on the target entity field.

[0127] In some embodiments, the link log-based fault location method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the link log-based fault location method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the link log-based fault location method in any other appropriate manner (e.g., by means of firmware).

[0128] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0129] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0130] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0132] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0133] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0134] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0135] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A fault location method based on link log, characterized in that: include: Obtain multiple link log data of the target business; The link log data includes: at least one entity field, the time taken to complete the target request, and the error situation; Determine at least one time-consuming interval, and based on each of the time-consuming intervals, perform statistics on each of the entity fields and the error reporting of each of the link log data to obtain a first number of each of the entity fields within the target time-consuming interval and the number of errors within the target time-consuming interval; Based on each of the first numbers and each of the error numbers, respectively determine the correlation between each entity field and the error, and obtain each first correlation calculation result; A target entity field is determined according to each of the first correlation calculation results, and a fault of the target business is located based on the target entity field.

2. The fault location method based on link log according to claim 1 is characterized in that: The determining of at least one time-consuming interval includes: Determine the maximum time duration and the minimum time duration in each link log data; Determine the number of the time-consuming intervals and the time-consuming interval between every two adjacent time-consuming intervals based on the maximum time-consuming duration and the minimum time-consuming duration; Each of the time-consuming intervals is determined according to the number of the time-consuming intervals and the time-consuming interval.

3. The fault location method based on link log according to claim 1 is characterized in that: The counting of each entity field and the error situation of each link log data based on each time-consuming interval to obtain the first number of each entity field within the target time-consuming interval and the number of errors within the target time-consuming interval includes: Determine a target time-consuming interval that matches the target link log data based on the time-consuming range of each of the time-consuming intervals; Performing statistics on the target link log data based on the field names of each entity field of the target link log data and the error conditions; In response to the statistics completion instruction of all link log data, a first number of each entity field within the target time interval and a number of errors within the target time interval are obtained.

4. The fault location method based on link log according to claim 1 is characterized in that: The determining, based on each of the first numbers and each of the error numbers, the correlation between each of the entity fields and the error, and obtaining each of the first correlation calculation results, includes: Calculate the first average value of each first number and the second average value of each error number in each time-consuming interval respectively; determining a covariance and a standard deviation based on the first mean and the second mean; A first correlation calculation result is obtained according to the covariance and each of the standard deviations.

5. The fault location method based on link log according to claim 1 is characterized in that: The determining the target entity field according to each of the first correlation calculation results, and locating the fault of the target business based on the target entity field, includes: Sorting the first correlation calculation results according to a set order, determining the first correlation calculation results that meet the preset requirements, and obtaining the target entity fields corresponding to the first correlation calculation results that meet the preset requirements; Performance data of each of the target entity fields is obtained, and the fault of the target business is located according to each of the performance data.

6. The fault location method based on link log according to claim 1 is characterized in that: Before determining the target entity field according to each of the first correlation calculation results and locating the fault of the target service based on the target entity field, the method further includes: Based on each of the time-consuming intervals, statistics are performed on the field values ​​of each of the entity fields of each of the link log data to obtain a second number of the field values ​​of each of the entity fields within the target time-consuming interval; Based on each of the second numbers and each of the error numbers, the correlation between the field value of each entity field and the error is determined respectively to obtain each second correlation calculation result.

7. The fault location method based on link log according to claim 6 is characterized in that: The determining the target entity field according to each of the first correlation calculation results, and locating the fault of the target business based on the target entity field, includes: The second correlation calculation result corresponding to the target entity field and the first correlation calculation result are respectively added together to obtain a target correlation calculation result; Sorting the target correlation calculation results according to a set order, determining the target correlation calculation results that meet the preset requirements, and obtaining the target entity fields corresponding to the target correlation calculation results that meet the preset requirements, as well as the field values ​​of the target entity fields; Obtaining from the entity library a reference entity field having the same field value as the target entity field, and obtaining performance data of each target entity field and each reference entity field; Determine an entity relationship topology diagram between each target entity field and each reference entity field; The fault of the target business is located based on the entity relationship topology diagram and each of the performance data.

8. A fault location device based on link log, characterized in that: include: A link log data acquisition module is used to acquire multiple link log data of the target business; The link log data includes: at least one entity field, the time taken to complete the target request, and the error situation; A determination module, used to determine at least one time-consuming interval, and based on each of the time-consuming intervals, perform statistics on each of the entity fields and the error reporting of each of the link log data to obtain a first number of each of the entity fields within a target time-consuming interval and a number of errors within the target time-consuming interval; A correlation calculation result determination module, used to determine the correlation between each entity field and the error report based on each of the first numbers and each of the error report numbers, and obtain each first correlation calculation result; A fault locating module is used to determine a target entity field according to each of the first correlation calculation results, and locate the fault of the target business based on the target entity field.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the link log-based fault location method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the link log-based fault location method described in any one of claims 1 to 7 when executed.

Images