Abnormality analysis method and device, computer equipment and storage medium

Abstract

The invention belongs to the technical field of data processing, and relates to an exception analysis method which comprises the following steps: when an application program is started, loading and initializing a preset specified monitoring component; inserting a preset monitoring code into a byte code of a target method of the application program based on the specified monitoring component to capture key information of the application program in a method calling process of the target method; acquiring a specified identifier corresponding to the method call of the target method; performing series processing on the key information based on the specified identifier, and generating a calling link diagram corresponding to the key information; performing exception analysis on the calling link diagram to screen out corresponding exceptional nodes; and generating an exception reason corresponding to the application program based on the exception node. The invention further provides an anomaly analysis device, computer equipment and a storage medium. In addition, the invention also relates to a block chain technology, and the exception reason can be stored in a block chain. According to the method and the device, the exception analysis efficiency of the application program is effectively improved based on the use of the specified monitoring component.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to anomaly analysis methods, devices, computer equipment and storage media. Background Art

[0002] In the daily operation of the financial industry, an efficient and stable financial service system is the key to building trust between enterprises and customers and ensuring smooth transactions. However, with the complexity of financial business and the sharp increase in transaction volume, financial applications will inevitably encounter various abnormal conditions during operation, among which slow access speed is a common one. Such problems not only directly affect the user experience, but may also further lead to business interruption, resulting in economic losses and reputation damage.

[0003] Traditional financial application anomaly troubleshooting often relies on manual intervention by the operation and maintenance team. When a financial application encounters anomalies such as slow access, due to the complexity of the system architecture and the nature of multi-party interaction, the operation and maintenance personnel first need to check the possible causes one by one, enable debug logs, and simulate and reproduce the production environment functions in the test environment to determine the specific problem. This process not only requires deep professional knowledge and rich experience accumulation, but is also often time-consuming and inefficient. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose an anomaly analysis method, apparatus, computer equipment and storage medium to solve the technical problem that the existing anomaly troubleshooting method for financial applications often relies on manual intervention by the operation and maintenance team, which is time-consuming and inefficient.

[0005] In order to solve the above technical problems, the present application provides an abnormality analysis method, which adopts the following technical solution:

[0006] When the application starts, load and initialize the preset specified monitoring components;

[0007] Inserting a preset monitoring code into the bytecode of the target method of the application based on the designated monitoring component to capture key information of the application during the method call process of the target method; wherein the key information at least includes the call link and the method execution time;

[0008] Obtaining a specified identifier corresponding to a method call of the target method;

[0009] The key information is processed in series based on the designated identifier to generate a call chain graph corresponding to the key information; wherein the call chain graph displays the call sequence and processing time of each node included in the call chain;

[0010] Performing abnormal analysis on the call link graph to filter out corresponding abnormal nodes;

[0011] An exception reason corresponding to the application is generated based on the exception node.

[0012] Furthermore, the step of performing serial processing on the key information based on the designated identifier to generate a call chain graph corresponding to the key information specifically includes:

[0013] Integrate the key information to obtain corresponding integrated information;

[0014] Performing deduplication processing on the integrated information to obtain corresponding first integrated information;

[0015] Cleaning the first integrated information to obtain corresponding second integrated information;

[0016] Performing concatenation processing on the second integrated information based on the designated identifier to obtain corresponding concatenation information;

[0017] The serial connection information is processed by graph generation based on a preset graphical tool to obtain a corresponding call chain graph.

[0018] Furthermore, the step of performing abnormal analysis on the call link graph and screening out corresponding abnormal nodes specifically includes:

[0019] Obtaining a specified processing time consumption of a specified node from the call link graph; wherein the specified node is any one of all the nodes;

[0020] Determine whether the specified processing time is greater than a preset time threshold;

[0021] If the designated processing time is greater than the time threshold, the designated node is determined to be an abnormal node;

[0022] If the designated processing time is less than the time threshold, it is determined that the designated node is not an abnormal node.

[0023] Furthermore, the step of generating an abnormal reason corresponding to the application based on the abnormal node specifically includes:

[0024] Obtain detailed information of the abnormal node;

[0025] Perform location processing of the problem code based on the detailed information to obtain the corresponding target code position;

[0026] Perform code logic analysis based on the target code position to obtain corresponding analysis results;

[0027] An abnormality cause corresponding to the application is generated based on the analysis result.

[0028] Furthermore, after the step of obtaining the designated identifier corresponding to the method call of the target method, the method further includes:

[0029] Calling the preset target storage system;

[0030] Generate an index corresponding to the key information based on the specified identifier;

[0031] Based on the index, the key information is stored in the target storage system.

[0032] Furthermore, after the step of performing abnormal analysis on the call link graph and screening out corresponding abnormal nodes, the method further includes:

[0033] Get the preset alarm rules;

[0034] Generate alarm information corresponding to the abnormal node based on the alarm rule;

[0035] Determine the designated notification method corresponding to the designated personnel;

[0036] Based on the designated notification method, the alarm information is sent to the designated person.

[0037] Furthermore, after the step of performing serial processing on the key information based on the designated identifier to generate a call chain graph corresponding to the key information, the method further includes:

[0038] Call the preset display interface;

[0039] Determining an information display area in the display interface;

[0040] The call chain diagram is displayed in the information display area of ​​the display interface.

[0041] In order to solve the above technical problems, the embodiment of the present application also provides an abnormality analysis device, which adopts the following technical solution:

[0042] The loading module is used to load and initialize the preset specified monitoring components when the application starts;

[0043] A first processing module is used to insert a preset monitoring code into the bytecode of the target method of the application based on the specified monitoring component to capture key information of the application during the method call process of the target method; wherein the key information at least includes a call link and a method execution time;

[0044] A first acquisition module, used to acquire a specified identifier corresponding to a method call of the target method;

[0045] A second processing module is used to perform serial processing on the key information based on the specified identifier to generate a call chain graph corresponding to the key information; wherein the call chain graph displays the call sequence and processing time of each node included in the call chain;

[0046] An analysis module is used to perform abnormal analysis on the call link graph and filter out corresponding abnormal nodes;

[0047] The first generating module is used to generate an abnormal reason corresponding to the application based on the abnormal node.

[0048] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0049] When the application starts, load and initialize the preset specified monitoring components;

[0050] Inserting a preset monitoring code into the bytecode of the target method of the application based on the designated monitoring component to capture key information of the application during the method call process of the target method; wherein the key information at least includes the call link and the method execution time;

[0051] Obtaining a specified identifier corresponding to a method call of the target method;

[0052] The key information is processed in series based on the designated identifier to generate a call chain graph corresponding to the key information; wherein the call chain graph displays the call sequence and processing time of each node included in the call chain;

[0053] Performing abnormal analysis on the call link graph to filter out corresponding abnormal nodes;

[0054] An exception reason corresponding to the application is generated based on the exception node.

[0055] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0056] When the application starts, load and initialize the preset specified monitoring components;

[0057] Inserting a preset monitoring code into the bytecode of the target method of the application based on the designated monitoring component to capture key information of the application during the method call process of the target method; wherein the key information at least includes the call link and the method execution time;

[0058] Obtaining a specified identifier corresponding to a method call of the target method;

[0059] The key information is processed in series based on the designated identifier to generate a call chain graph corresponding to the key information; wherein the call chain graph displays the call sequence and processing time of each node included in the call chain;

[0060] Performing abnormal analysis on the call link graph to filter out corresponding abnormal nodes;

[0061] An exception reason corresponding to the application is generated based on the exception node.

[0062] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0063] The present application first loads and initializes a preset designated monitoring component when the application is started; then, based on the designated monitoring component, a preset monitoring code is inserted into the bytecode of the target method of the application to capture key information of the application during the method call process of the target method; wherein, the key information at least includes a call link and a method execution time; then, a designated identifier corresponding to the method call of the target method is obtained; subsequently, the key information is processed in series based on the designated identifier to generate a call link graph corresponding to the key information; wherein, the call link graph displays the call order and processing time of each node contained in the call link; further, the call link graph is subjected to exception analysis processing to filter out corresponding abnormal nodes; finally, an exception cause corresponding to the application is generated based on the abnormal node. When the application is started, the present application loads and initializes the preset designated monitoring component, then captures the key information of the application during the method call process of the target method based on the use of the designated monitoring component, and obtains the designated identifier corresponding to the method call of the target method, and then performs serial processing on the key information based on the designated identifier to generate a call chain graph corresponding to the key information, and subsequently performs exception analysis processing on the call chain graph to screen out the corresponding exception nodes, so that the exception cause corresponding to the application can be automatically and accurately generated based on the obtained exception nodes, thereby effectively improving the efficiency of exception analysis of the application and ensuring the accuracy of the exception cause corresponding to the generated application. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0065] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0066] Figure 2 A flowchart according to an embodiment of the abnormality analysis method of the present application;

[0067] Figure 3 is a structural schematic diagram of an embodiment of an abnormality analysis device according to the present application;

[0068] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0069] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0070] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0071] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0072] like Figure 1As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0073] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0074] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to the laptop computer 1011, tablet computer 1012 or mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0075] The server 103 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal device 101 .

[0076] It should be noted that the anomaly analysis method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the anomaly analysis device is generally arranged in the server / terminal device.

[0077] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0078] Continue to refer Figure 2 , shows a flow chart of an embodiment of the abnormality analysis method according to the present application. According to different requirements, the order of the steps in the flow chart can be changed, and some steps can be omitted. The abnormality analysis method provided in the embodiment of the present application can be applied to any scenario that requires abnormality analysis, and the abnormality analysis method can be applied to products in these scenarios, for example, abnormality analysis in the financial insurance field. The abnormality analysis method comprises the following steps:

[0079] Step S201, when the application is started, load and initialize the preset designated monitoring component.

[0080] In this embodiment, the electronic device (eg, Figure 1 The server / terminal device shown in the figure) can obtain relevant data through a wired connection or a wireless connection. It should be noted that the above-mentioned wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future. The execution subject of this application may be a link tracking system, or simply referred to as a system. The above-mentioned designated monitoring component (agent) is a key component in the link tracking system. It usually runs as an additional part of the application to capture and record key information of the application during the method call process, such as the call link, method execution time, etc. Among them, the link tracking system is deployed on the client and the server in advance to ensure that the agent function is correctly configured and enabled. In addition, the link tracking system is integrated into the application to ensure that all remote and local calls can be monitored. According to the requirements of the link tracking system, the configuration file or startup script of the application can be modified to ensure that the application can load and initialize the agent of the link tracking system when it starts. And through the log or monitoring platform, verify whether the link tracking system has been successfully integrated into the application and can capture the call information. In addition, in business scenarios in the financial field, the above-mentioned applications may include claims applications, financial management applications, insurance applications, and so on.

[0081] The core of the link tracking system is to add monitoring logic to the program code of the application, and aggregate data through point collection, statistical information, and asynchronous upload. Whether the core monitoring logic is coupled with the business code can be divided into static and dynamic monitoring. Static monitoring is mostly applicable to programs implemented in C / C++, where the monitoring program and business code are deeply coupled; dynamic monitoring can be applied to Java programs. Through Java's agent function and bytecode enhancement technology, the monitoring code is implanted during class loading, effectively realizing the decoupling of monitoring functions and business functions.

[0082] Step S202, based on the specified monitoring component, inserts a preset monitoring code into the bytecode of the target method of the application to capture key information of the application during the method call process of the target method; wherein the key information at least includes the call link and the method execution time.

[0083] In this embodiment, the target method may refer to a business method in an application. The designated monitoring component uses Java bytecode enhancement technology at runtime to modify the bytecode of the target method of the application and implant monitoring code to implement proxy injection. After proxy injection, the designated monitoring component can capture key information of the application during the method call process of the target method, such as the call link, method execution time, etc.

[0084] Step S203: Obtain a designated identifier corresponding to the method call of the target method.

[0085] In this embodiment, each time the target method is called, the designated monitoring component generates a unique designated identifier (traceID) for connecting the entire service call link node in series. During the remote call process, the client sends the traceID as part of the request to the server. After receiving the request, the server extracts the traceID from the request and associates it with the local method call.

[0086] Step S204, performing serial processing on the key information based on the designated identifier to generate a call chain diagram corresponding to the key information; wherein the call chain diagram displays the call sequence and processing time of each node included in the call chain.

[0087] In this embodiment, the above-mentioned specific implementation process of serially processing the key information based on the specified identifier to generate a call chain graph corresponding to the key information will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0088] Step S205, performing abnormal analysis on the call link graph to filter out corresponding abnormal nodes.

[0089] In this embodiment, the above-mentioned specific implementation process of performing abnormal analysis on the call link graph and screening out the corresponding abnormal nodes will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0090] Step S206: Generate an exception cause corresponding to the application based on the exception node.

[0091] In this embodiment, the specific implementation process of generating the abnormal cause corresponding to the application based on the abnormal node will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated in detail here.

[0092] The present application first loads and initializes a preset designated monitoring component when the application is started; then, based on the designated monitoring component, a preset monitoring code is inserted into the bytecode of the target method of the application to capture key information of the application during the method call process of the target method; wherein, the key information at least includes a call link and a method execution time; then, a designated identifier corresponding to the method call of the target method is obtained; subsequently, the key information is processed in series based on the designated identifier to generate a call link graph corresponding to the key information; wherein, the call link graph displays the call order and processing time of each node contained in the call link; further, the call link graph is subjected to exception analysis processing to filter out corresponding abnormal nodes; finally, an exception cause corresponding to the application is generated based on the abnormal node. When the application is started, the present application loads and initializes the preset designated monitoring component, then captures the key information of the application during the method call process of the target method based on the use of the designated monitoring component, and obtains the designated identifier corresponding to the method call of the target method, and then performs serial processing on the key information based on the designated identifier to generate a call chain graph corresponding to the key information, and subsequently performs exception analysis processing on the call chain graph to screen out the corresponding exception nodes, so that the exception cause corresponding to the application can be automatically and accurately generated based on the obtained exception nodes, thereby effectively improving the efficiency of exception analysis of the application and ensuring the accuracy of the exception cause corresponding to the generated application.

[0093] In some optional implementations, step S204 includes the following steps:

[0094] The key information is integrated to obtain corresponding integrated information.

[0095] In this embodiment, all key information of the application program in the method calling process of the target method captured based on the designated monitoring component may be integrated to ensure the integrity and accuracy of the integrated information.

[0096] Deduplication processing is performed on the integrated information to obtain corresponding first integrated information.

[0097] In this embodiment, duplicate data in the integrated information may be deduplicated by using a deduplication tool with a deduplication function, thereby obtaining corresponding first integrated information.

[0098] The first integrated information is cleaned to obtain corresponding second integrated information.

[0099] In this embodiment, the invalid data in the first integrated information can be cleaned by using a cleaning tool with a cleaning function, so as to obtain the corresponding second integrated information.

[0100] The second integrated information is serially processed based on the designated identifier to obtain corresponding serially connected information.

[0101] In this embodiment, the designated identifier is an identifier that uniquely identifies a target method call in the link tracking system. It can connect the node data in the call link in series, that is, aggregate the node data with the same designated identifier to form a complete call link, which is convenient for subsequent analysis and troubleshooting.

[0102] The serial connection information is processed by graph generation based on a preset graphical tool to obtain a corresponding call chain graph.

[0103] In this embodiment, a graphical tool can be used to generate a graph for the serial connection information to generate a corresponding call chain graph, and the call sequence, time consumption, abnormal information, etc. of each node are displayed in the call chain graph.

[0104] The present application obtains the corresponding integrated information by integrating the key information; then deduplicates the integrated information to obtain the corresponding first integrated information; then cleans the first integrated information to obtain the corresponding second integrated information; then performs serial connection processing on the second integrated information based on the specified identifier to obtain the corresponding serial connection information; finally, performs graph generation processing on the serial connection information based on a preset graphical tool to obtain the corresponding call chain graph. The present application obtains the corresponding second integrated information by integrating, deduplicating and cleaning the key information; then performs serial connection processing on the second integrated information based on the specified identifier to obtain the corresponding serial connection information; then performs graph generation processing on the serial connection information based on the use of a graphical tool, thereby realizing the rapid and accurate generation of a call chain graph corresponding to the key information, improving the generation efficiency and accuracy of the call chain graph, and facilitating the subsequent effective anomaly detection of the application based on the obtained call chain graph.

[0105] In some optional implementations of this embodiment, step S205 includes the following steps:

[0106] The specified processing time consumption of the specified node is obtained from the call link graph.

[0107] In this embodiment, the designated node is any one of all the nodes, and the abnormality analysis steps of each node are the same.

[0108] Determine whether the specified processing time is greater than a preset time threshold.

[0109] In this embodiment, a time consumption threshold of each node or the entire call link is set according to historical data or business requirements.

[0110] If the designated processing time consumption is greater than the time consumption threshold, it is determined that the designated node is an abnormal node.

[0111] In this embodiment, by comparing the acquired designated processing time consumption with a set time consumption threshold, if the designated processing time consumption is greater than the set time consumption threshold, it is determined that the designated node is an abnormal node.

[0112] If the designated processing time is less than the time threshold, it is determined that the designated node is not an abnormal node.

[0113] In this embodiment, by comparing the acquired designated processing time with a set time threshold, if the designated processing time is less than the set time threshold, it is determined that the designated node is not an abnormal node.

[0114] The present application obtains the designated processing time of the designated node from the call link graph; wherein the designated node is any one of all the nodes; then determines whether the designated processing time is greater than a preset time threshold; if the designated processing time is greater than the time threshold, determines that the designated node is an abnormal node; and if the designated processing time is less than the time threshold, determines that the designated node is not an abnormal node. The present application obtains the designated processing time of the designated node from the call link graph, and then compares the designated processing time with the set time threshold numerically, and then can quickly and accurately generate the abnormal node determination result of the designated node according to the obtained numerical comparison result, thereby ensuring the accuracy of the generated abnormal node determination result.

[0115] In some optional implementations, step S206 includes the following steps:

[0116] Get detailed information about the abnormal node.

[0117] In this embodiment, the detailed information of the abnormal node may at least include the identification of the abnormal node, method call information, exception information, performance data, etc. Specifically, the identification of the abnormal node includes: such as TraceID, which is used to uniquely identify the abnormal node. The method call information includes: the name of the called method, the class to which it belongs, the parameter type and value (if possible), and the return value (if abnormal, it may be null or exception information). The exception information includes: the type of exception, error message, stack trace, etc. The performance data includes: the time consumed by the method call, CPU usage, memory consumption, etc.

[0118] Based on the detailed information, the position of the problem code is located to obtain the corresponding target code position.

[0119] In this embodiment, the type of exception, such as NullPointerException, SQLException, TimeoutException, etc., can be identified by analyzing the detailed information. This helps to preliminarily determine the possible cause of the problem. Then read the error message in detail, which usually provides the specific cause or condition that caused the exception. Then analyze the stack trace to determine the specific location where the exception occurred (i.e., which line of code of which class or method). Each line in the stack trace represents the location of a method call, starting from the location where the exception is thrown and tracing back to the starting point of the call chain. Among them, the information in the stack trace can be used to locate the specific code location. Specifically, find the specific file and line number where the exception is thrown in the stack trace. Then open the corresponding source code file in a code editor or IDE. Then locate the code line, that is, scroll to the specified line number to view the specific code implementation.

[0120] Code logic analysis is performed based on the target code position to obtain corresponding analysis results.

[0121] In this embodiment, the context and role of the code in the entire application can be understood by reading the surrounding code. Then check the variables and parameters to confirm whether the values ​​of all variables and parameters meet expectations, especially those related to exceptions. Then check the control flow structures such as conditional statements, loops, exception handling, etc. to ensure that their logic is correct. If the exception is related to an external system or service (such as a database, API call, etc.), it is also necessary to analyze the status and behavior of these external dependencies. Through the above code logic analysis and processing, the corresponding analysis results are integrated.

[0122] An abnormality cause corresponding to the application is generated based on the analysis result.

[0123] In this embodiment, the abnormal cause of the application problem can be determined based on the generated analysis results. Specifically, it may include: Programming errors: such as null pointer reference, array out of bounds, type conversion errors, etc. Configuration problems: such as database connection configuration errors, external service URL errors, etc. Resource limitations: such as insufficient memory, CPU overload, insufficient disk space, etc. External system problems: such as unavailable third-party services, network delays or interruptions, etc.

[0124] In addition, after determining the cause of the application exception, you can further develop a corresponding solution, which may include modifying the code, adjusting the configuration, optimizing resource usage, or coordinating with external system providers.

[0125] The present application obtains the detailed information of the abnormal node; then performs location processing of the problem code based on the detailed information to obtain the corresponding target code position; then performs code logic analysis based on the target code position to obtain the corresponding analysis result; and subsequently generates the abnormal cause corresponding to the application based on the analysis result. The present application obtains the detailed information of the abnormal node by performing location processing of the problem code based on the obtained target code position to obtain the corresponding target code position; then performs code logic analysis based on the target code position to obtain the corresponding analysis result, and then based on the analysis result, it can realize automatic and accurate generation of the abnormal cause corresponding to the problem caused by the application, thereby improving the generation efficiency of the abnormal cause and ensuring the accuracy of the obtained abnormal cause.

[0126] In some optional implementations, after step S203, the electronic device may further perform the following steps:

[0127] Call the preset target storage system.

[0128] In this embodiment, there is no specific limitation on the selection of the target storage system, which can be determined according to actual business needs, for example, storage systems such as Elasticsearch and Cassandra can be used. Alternatively, an aggregation service platform can also be used.

[0129] An index corresponding to the key information is generated based on the designated identifier.

[0130] In this embodiment, indexing of key information in the target storage system may be achieved by using a designated identifier.

[0131] Based on the index, the key information is stored in the target storage system.

[0132] In this embodiment, after the indexing process of the key information is completed, the key information is stored in the target storage system for subsequent rapid retrieval and query.

[0133] This application calls a preset target storage system; then generates an index corresponding to the key information based on the specified identifier; and subsequently stores the key information in the target storage system based on the index. After capturing the key information of the application during the method call process of the target method, this application will intelligently call the target storage system, and generate an index corresponding to the key information based on the specified identifier, and then store the key information in the target storage system according to the generated index, so as to realize intelligent storage of key information, ensure the security of key information, and facilitate subsequent rapid retrieval and query.

[0134] In some optional implementations of this embodiment, after step S205, the electronic device may further perform the following steps:

[0135] Get the preset alarm rules.

[0136] In this embodiment, alarm rules for abnormal nodes can be preset according to business needs, such as triggering an alarm when the processing time of a certain node exceeds a certain threshold.

[0137] Alarm information corresponding to the abnormal node is generated based on the alarm rule.

[0138] In this embodiment, when an abnormality is detected in a node, corresponding alarm information may be generated according to the alarm rule, including an identification of the abnormal node, an abnormality type, an error message, etc.

[0139] Determine the designated notification method corresponding to the designated personnel.

[0140] In this embodiment, the above-mentioned designated personnel may be relevant personnel corresponding to the operation and maintenance processing of the abnormal node. According to the contact information and preferences of the designated personnel, a suitable alarm method may be selected as the above-mentioned designated notification method, such as email, SMS, message queue, etc.

[0141] Based on the designated notification method, the alarm information is sent to the designated person.

[0142] In this embodiment, the generated alarm information may be sent to relevant personnel through a selected designated notification method.

[0143] This application obtains preset alarm rules; then generates alarm information corresponding to the abnormal node based on the alarm rules; then determines the designated notification method corresponding to the designated person; and subsequently sends the alarm information to the designated person based on the designated notification method. After performing abnormal analysis on the call link graph to screen out the corresponding abnormal nodes, this application will intelligently and automatically generate alarm information corresponding to the abnormal nodes based on the preset alarm rules, and then send the alarm information to the designated person through the corresponding designated notification method, thereby realizing automatic alarm notification for abnormal nodes, which is conducive to helping relevant personnel to timely discover, locate and solve abnormal problems in the application, and improve the user experience and exception handling efficiency of relevant personnel.

[0144] In some optional implementations of this embodiment, after step S204, the electronic device may further perform the following steps:

[0145] Call the preset display interface.

[0146] In this embodiment, according to actual needs, a display interface is pre-set, and the display interface includes an information display area of ​​the call link graph.

[0147] Determine an information display area in the display interface.

[0148] In this embodiment, there is no specific limitation on the area selection of the above-mentioned information display area, for example, it can be the center position of the interface.

[0149] The call chain diagram is displayed in the information display area of ​​the display interface.

[0150] In this embodiment, after the call chain diagram is displayed in the information display area in the display interface, the user's interactive function with the call chain diagram can be further realized, allowing the user to view the detailed information of the node. Specifically, a click event listener is added to the node in the call chain diagram. When a user clicks a node, an event is triggered and the unique identifier of the node is obtained. Then, based on the unique identifier of the node, the detailed information of the node is queried from the database or cache, including the called class, method, time consumption, etc. The queried detailed information is subsequently displayed in the detailed information display area. Information can be displayed in the form of tables, lists, or cards, and ensure that the information is clear and easy to read. In addition, interactive feedback can be provided to users, such as highlighting the clicked node, displaying prompt information, etc., to enhance the user experience.

[0151] This application calls a preset display interface; then determines the information display area in the display interface; and subsequently displays the call chain diagram in the information display area in the display interface. After the application performs serial processing on the key information based on the specified identifier and generates a call chain diagram corresponding to the key information, it will also intelligently call the display interface and automatically display the call chain diagram in the information display area in the display interface, so as to provide users with an intuitive and clear call chain diagram and detailed node information display, which will help relevant users quickly locate and solve abnormal problems in the application, and improve the user experience and exception handling efficiency.

[0152] In some optional implementations, the user information obtained is subject to the user's consent and complies with relevant laws and policies.

[0153] In addition, the non-Company software tools or components that appear in the embodiments of the present application are merely examples and do not represent actual use.

[0154] In addition, by integrating the link tracking system into the application, when many applications in production environments experience slow access or application function errors, the application interface can be found on the link tracking system. Through the interface, you can see the processing time of the required class and method during the call process, so as to quickly locate which class method of the application caused the problem. Developers can intuitively determine the cause of the application anomaly and can provide solutions very quickly, reducing the manpower investment in analyzing application failures, while greatly improving the efficiency of operation and maintenance, reducing customer complaints about application functions, and increasing customer satisfaction with application functions.

[0155] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0156] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned abnormal reasons, the above-mentioned abnormal reasons can also be stored in a node of a blockchain.

[0157] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0158] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0159] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0160] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0161] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0162] Further references Figure 3 , as a response to the above Figure 2 In order to realize the method shown in the figure, the present application provides an embodiment of an abnormality analysis device, and the device embodiment is Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0163] like Figure 3 As shown, the abnormality analysis device 300 described in this embodiment includes: a loading module 301, a first processing module 302, a first acquisition module 303, a second processing module 304, an analysis module 305 and a first generation module 306. Among them:

[0164] The loading module 301 is used to load and initialize the preset designated monitoring component when the application is started;

[0165] The first processing module 302 is used to insert a preset monitoring code into the bytecode of the target method of the application based on the specified monitoring component to capture key information of the application in the method call process of the target method; wherein the key information at least includes the call link and the method execution time;

[0166] A first acquisition module 303 is used to acquire a specified identifier corresponding to a method call of the target method;

[0167] The second processing module 304 is used to perform serial processing on the key information based on the specified identifier to generate a call chain graph corresponding to the key information; wherein the call chain graph displays the call sequence and processing time of each node included in the call chain;

[0168] The analysis module 305 is used to perform abnormal analysis on the call link graph and filter out corresponding abnormal nodes;

[0169] The first generating module 306 is configured to generate an abnormality cause corresponding to the application program based on the abnormal node.

[0170] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the abnormality analysis method in the above-mentioned implementation mode, and will not be described in detail here.

[0171] In some optional implementations of this embodiment, the second processing module 304 includes:

[0172] A first processing submodule is used to integrate the key information to obtain corresponding integrated information;

[0173] A second processing submodule is used to perform deduplication processing on the integrated information to obtain corresponding first integrated information;

[0174] A third processing submodule is used to clean the first integrated information to obtain corresponding second integrated information;

[0175] A fourth processing submodule, configured to perform serial connection processing on the second integrated information based on the designated identifier to obtain corresponding serial connection information;

[0176] The fifth processing submodule is used to perform graph generation processing on the series connection information based on a preset graphical tool to obtain a corresponding call chain graph.

[0177] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the abnormality analysis method in the above-mentioned implementation mode, and will not be described in detail here.

[0178] In some optional implementations of this embodiment, the analysis module 305 includes:

[0179] A first acquisition submodule is used to acquire a specified processing time consumption of a specified node from the call link graph; wherein the specified node is any one of all the nodes;

[0180] A judgment submodule, used to judge whether the specified processing time is greater than a preset time threshold;

[0181] A first determination submodule, configured to determine that the designated node is an abnormal node if the designated processing time is greater than the time threshold;

[0182] The second determination submodule is configured to determine that the designated node is not an abnormal node if the designated processing time is less than the time threshold.

[0183] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the abnormality analysis method in the above-mentioned implementation mode, and will not be described in detail here.

[0184] In some optional implementations of this embodiment, the first generating module 306 includes:

[0185] A second acquisition submodule is used to acquire detailed information of the abnormal node;

[0186] A positioning submodule, used to perform position positioning processing on the problem code based on the detailed information to obtain the corresponding target code position;

[0187] An analysis submodule, used to perform code logic analysis based on the target code position to obtain corresponding analysis results;

[0188] A generating submodule is used to generate an abnormal reason corresponding to the application program based on the analysis result.

[0189] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the abnormality analysis method in the above-mentioned implementation mode, and will not be described in detail here.

[0190] In some optional implementations of this embodiment, the abnormality analysis device further includes:

[0191] A first calling module, used for calling a preset target storage system;

[0192] A second generating module, configured to generate an index corresponding to the key information based on the specified identifier;

[0193] A storage module is used to store the key information in the target storage system based on the index.

[0194] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the abnormality analysis method in the above-mentioned implementation mode, and will not be described in detail here.

[0195] In some optional implementations of this embodiment, the abnormality analysis device further includes:

[0196] The second acquisition module is used to acquire preset alarm rules;

[0197] A third generating module, configured to generate alarm information corresponding to the abnormal node based on the alarm rule;

[0198] A first determination module, used to determine a designated notification method corresponding to a designated person;

[0199] The sending module is used to send the alarm information to the designated person based on the designated notification method.

[0200] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the abnormality analysis method in the above-mentioned implementation mode, and will not be described in detail here.

[0201] In some optional implementations of this embodiment, the abnormality analysis device further includes:

[0202] The second calling module is used to call the preset display interface;

[0203] A second determination module, used to determine the information display area in the display interface;

[0204] The display module is used to display the call link diagram in the information display area of ​​the display interface.

[0205] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the abnormality analysis method in the above-mentioned implementation mode, and will not be described in detail here.

[0206] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0207] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0208] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0209] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of the abnormal analysis method, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0210] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run computer-readable instructions stored in the memory 41 or process data, such as computer-readable instructions for running the abnormality analysis method.

[0211] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0212] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0213] In an embodiment of the present application, first, when the application is started, a preset designated monitoring component is loaded and initialized; then, based on the designated monitoring component, a preset monitoring code is inserted into the bytecode of the target method of the application to capture key information of the application during the method call process of the target method; wherein, the key information at least includes the call link and the method execution time; then, a designated identifier corresponding to the method call of the target method is obtained; subsequently, the key information is processed in series based on the designated identifier to generate a call link graph corresponding to the key information; wherein, the call link graph shows the call order and processing time of each node contained in the call link; the call link graph is further subjected to exception analysis processing to filter out the corresponding abnormal nodes; finally, an exception cause corresponding to the application is generated based on the abnormal nodes. When the application is started, the present application loads and initializes the preset designated monitoring component, then captures the key information of the application during the method call process of the target method based on the use of the designated monitoring component, and obtains the designated identifier corresponding to the method call of the target method, and then performs serial processing on the key information based on the designated identifier to generate a call chain graph corresponding to the key information, and subsequently performs exception analysis processing on the call chain graph to screen out the corresponding exception nodes, so that the exception cause corresponding to the application can be automatically and accurately generated based on the obtained exception nodes, thereby effectively improving the efficiency of exception analysis of the application and ensuring the accuracy of the exception cause corresponding to the generated application.

[0214] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the above-mentioned abnormality analysis method.

[0215] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0216] In an embodiment of the present application, first, when the application is started, a preset designated monitoring component is loaded and initialized; then, based on the designated monitoring component, a preset monitoring code is inserted into the bytecode of the target method of the application to capture key information of the application during the method call process of the target method; wherein, the key information at least includes the call link and the method execution time; then, a designated identifier corresponding to the method call of the target method is obtained; subsequently, the key information is processed in series based on the designated identifier to generate a call link graph corresponding to the key information; wherein, the call link graph shows the call order and processing time of each node contained in the call link; the call link graph is further subjected to exception analysis processing to filter out the corresponding abnormal nodes; finally, an exception cause corresponding to the application is generated based on the abnormal nodes. When the application is started, the present application loads and initializes the preset designated monitoring component, then captures the key information of the application during the method call process of the target method based on the use of the designated monitoring component, and obtains the designated identifier corresponding to the method call of the target method, and then performs serial processing on the key information based on the designated identifier to generate a call chain graph corresponding to the key information, and subsequently performs exception analysis processing on the call chain graph to screen out the corresponding exception nodes, so that the exception cause corresponding to the application can be automatically and accurately generated based on the obtained exception nodes, thereby effectively improving the efficiency of exception analysis of the application and ensuring the accuracy of the exception cause corresponding to the generated application.

[0217] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0218] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. An abnormality analysis method, characterized in that: The steps include: When the application starts, load and initialize the preset specified monitoring components; Inserting a preset monitoring code into the bytecode of the target method of the application based on the designated monitoring component to capture key information of the application during the method call process of the target method; wherein the key information at least includes the call link and the method execution time; Obtaining a specified identifier corresponding to a method call of the target method; The key information is processed in series based on the designated identifier to generate a call chain graph corresponding to the key information; wherein the call chain graph displays the call sequence and processing time of each node included in the call chain; Performing abnormal analysis on the call link graph to filter out corresponding abnormal nodes; An exception reason corresponding to the application is generated based on the exception node.

2. The abnormality analysis method according to claim 1, characterized in that: The step of performing serial processing on the key information based on the designated identifier to generate a call chain graph corresponding to the key information specifically includes: Integrate the key information to obtain corresponding integrated information; Performing deduplication processing on the integrated information to obtain corresponding first integrated information; Cleaning the first integrated information to obtain corresponding second integrated information; Performing concatenation processing on the second integrated information based on the designated identifier to obtain corresponding concatenation information; The serial connection information is processed by graph generation based on a preset graphical tool to obtain a corresponding call chain graph.

3. The abnormality analysis method according to claim 1, characterized in that: The step of performing abnormal analysis on the call link graph and screening out corresponding abnormal nodes specifically includes: Obtaining a specified processing time consumption of a specified node from the call link graph; wherein the specified node is any one of all the nodes; Determine whether the specified processing time is greater than a preset time threshold; If the designated processing time is greater than the time threshold, the designated node is determined to be an abnormal node; If the designated processing time is less than the time threshold, it is determined that the designated node is not an abnormal node.

4. The abnormality analysis method according to claim 1, characterized in that: The step of generating an abnormal reason corresponding to the application based on the abnormal node specifically includes: Obtain detailed information of the abnormal node; Perform location processing of the problem code based on the detailed information to obtain the corresponding target code position; Perform code logic analysis based on the target code position to obtain corresponding analysis results; An abnormality cause corresponding to the application is generated based on the analysis result.

5. The abnormality analysis method according to claim 1, characterized in that: After the step of obtaining the designated identifier corresponding to the method call of the target method, the method further includes: Calling the preset target storage system; Generate an index corresponding to the key information based on the specified identifier; Based on the index, the key information is stored in the target storage system.

6. The abnormality analysis method according to claim 1, characterized in that: After the step of performing abnormal analysis on the call link graph and screening out corresponding abnormal nodes, the method further includes: Get the preset alarm rules; Generate alarm information corresponding to the abnormal node based on the alarm rule; Determine the designated notification method corresponding to the designated personnel; Based on the designated notification method, the alarm information is sent to the designated person.

7. The abnormality analysis method according to claim 1, characterized in that: After the step of performing serial processing on the key information based on the designated identifier to generate a call chain graph corresponding to the key information, the method further includes: Call the preset display interface; Determining an information display area in the display interface; The call chain diagram is displayed in the information display area of ​​the display interface.

8. An abnormality analysis device, characterized in that: include: The loading module is used to load and initialize the preset specified monitoring components when the application starts; A first processing module is used to insert a preset monitoring code into the bytecode of the target method of the application based on the specified monitoring component to capture key information of the application during the method call process of the target method; wherein the key information at least includes a call link and a method execution time; A first acquisition module, used to acquire a specified identifier corresponding to a method call of the target method; A second processing module is used to perform serial processing on the key information based on the specified identifier to generate a call chain graph corresponding to the key information; wherein the call chain graph displays the call sequence and processing time of each node included in the call chain; An analysis module is used to perform abnormal analysis on the call link graph and filter out corresponding abnormal nodes; The first generating module is used to generate an abnormal reason corresponding to the application based on the abnormal node.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the abnormality analysis method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the abnormality analysis method according to any one of claims 1 to 7 are implemented.

Images