File analysis method and device, equipment, storage medium and product

Abstract

The invention discloses a file analysis method and device, equipment, a storage medium and a product, and relates to the technical field of file analysis, and the method comprises the steps of obtaining a thread dump file by responding to system alarm information; performing structured analysis on the thread dump file to obtain a thread analysis table; performing thread analysis on the thread dump file on the basis of the thread analysis table to obtain an alarm analysis result, automatically performing structured analysis on the thread dump file through the scheme to obtain the thread analysis table containing various key information of the thread, and then performing automatic thread analysis on the basis of the thread analysis table to obtain an alarm analysis result. The problems of excessive threads, program blockage, resource competition and the like are quickly checked, the fault positioning threshold is reduced, and the efficiency and accuracy of troubleshooting are improved.

Description

Technical Field

[0001] The present application relates to the field of file analysis technology, and in particular to a file analysis method, device, equipment, storage medium and product. Background Art

[0002] In today's software development and system monitoring fields, thread dump files are widely used as an important diagnostic tool to analyze thread states in the Java Virtual Machine (JVM). Thread dump files can provide stack information of all threads at a certain moment, which is crucial for troubleshooting performance issues, deadlocks, resource contention, and other faults. However, traditional thread dump file analysis methods mainly rely on manual operations, which is not only inefficient but also prone to errors. Analysts need to have a deep understanding of the Java virtual machine to accurately interpret the complex information in the thread dump file, which undoubtedly increases the threshold for fault location.

[0003] When processing thread dump files, existing technologies usually require analysts to check the status and stack information of each thread one by one. This method is not only time-consuming, but also difficult to fully cover all threads. When faced with complex fault scenarios, manual analysis often fails to accurately locate the problem, which seriously affects the efficiency and accuracy of troubleshooting. In addition, the manual analysis process is easily limited by the analyst's personal experience and skills, which makes it difficult to ensure the consistency and reliability of the analysis results.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present application is to provide a file analysis method, apparatus, device, storage medium and computer program product, aiming to improve the efficiency and accuracy of thread dump file analysis.

[0006] To achieve the above purpose, the present application proposes a file analysis method, which includes:

[0007] In response to the system warning information, obtaining a thread dump file;

[0008] Performing structured analysis on the thread dump file to obtain a thread analysis table;

[0009] Thread analysis is performed on the thread dump file based on the thread parsing table to obtain an alarm analysis result.

[0010] In one embodiment, the step of obtaining a thread dump file in response to the system alarm information includes:

[0011] In response to the system alarm information, trigger the file collection process and generate a file collection trigger signal and a thread dump command;

[0012] Acquire the target process ID according to the file acquisition trigger signal;

[0013] According to the target process ID, a thread dump collector is called to execute the thread dump command to obtain a plurality of thread dump files corresponding to the target process.

[0014] In one embodiment, the thread parsing table includes thread key field information, the thread key field information includes thread lock information, and the step of performing thread analysis on the thread dump file based on the thread parsing table to obtain an alarm analysis result includes:

[0015] Performing thread name clustering analysis based on the thread parsing table to obtain thread name clustering analysis results;

[0016] Performing thread stack clustering analysis based on a preset thread stack clustering analysis algorithm and the thread parsing table to obtain a thread stack clustering analysis result;

[0017] Performing a blocked thread dependency analysis based on the thread parsing table and the thread lock information to obtain a blocked thread dependency analysis result;

[0018] An alarm analysis result is generated based on the process name clustering analysis result, the thread stack clustering analysis result and the blocked thread dependency analysis result.

[0019] In one embodiment, the step of performing thread name cluster analysis based on the thread resolution table to obtain thread name cluster analysis results further includes:

[0020] Traversing the thread parsing table, and obtaining the target thread name according to the thread key field information;

[0021] Removing the thread program number of the target thread name by using a preset regular expression to obtain a thread name prefix;

[0022] Perform thread name prefix association based on the thread name prefix to obtain a thread-prefix correspondence list, wherein the thread-prefix correspondence list includes the number of prefix-associated threads;

[0023] If the number of threads associated with the prefix is ​​greater than a preset first number threshold, the thread name prefix corresponding to the number of threads associated with the prefix is ​​determined as the target thread name prefix to obtain a thread name clustering analysis result.

[0024] In one embodiment, the step of performing thread stack clustering analysis based on a preset thread stack clustering analysis algorithm and the thread parsing table to obtain a thread stack clustering analysis result includes:

[0025] Extracting the stack information array in the thread parsing table;

[0026] Perform splicing and standardization processing based on a preset number of stack frames in the stack information array to obtain a stack character string;

[0027] Based on the stack character string, feature sorting is performed on the target threads in the thread parsing table to obtain a sorted thread list;

[0028] Traversing the sorted thread list, calculating feature similarities of adjacent stacks using a Levenshtein distance algorithm;

[0029] If the feature similarity is greater than a preset similarity threshold, determining the threads corresponding to the adjacent stacks as threads of the same type of clustering;

[0030] If the number of the same type of clustering threads is greater than a preset second number threshold, the same type of clustering threads are determined as target same type of clustering threads, and a thread stack clustering analysis result is obtained.

[0031] In one embodiment, the step of performing blocked thread dependency analysis based on the thread resolution table and thread lock information to obtain a blocked thread dependency analysis result includes:

[0032] Determine a thread whose thread lock state is blocked or waiting in the thread lock information as a target blocked thread;

[0033] Get the waiting lock ID corresponding to the target blocked thread;

[0034] The thread resolution table is traversed, and threads in the thread resolution table holding a lock ID identical to the waiting lock ID are determined as target dependent threads, thereby obtaining a blocking thread dependency analysis result.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a file analysis device, which includes:

[0036] An acquisition module, used for acquiring a thread dump file in response to a system alarm message;

[0037] A parsing module, used for performing structured parsing on the thread dump file to obtain a thread parsing table;

[0038] The analysis module is used to perform thread analysis on the thread dump file based on the thread parsing table to obtain an alarm analysis result.

[0039] In addition, to achieve the above-mentioned purpose, the present application also proposes a file analysis device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the file analysis method described above.

[0040] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the file analysis method described above are implemented.

[0041] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the file analysis method described above are implemented.

[0042] One or more technical solutions proposed in the present application obtain a thread dump file in response to system alarm information; perform structured analysis on the thread dump file to obtain a thread analysis table; perform thread analysis on the thread dump file based on the thread analysis table to obtain an alarm analysis result. The thread dump file is automatically structured analyzed through the above solution to obtain a thread analysis table containing various key information of the thread, and then automatic thread analysis is performed based on the thread analysis table to quickly troubleshoot problems such as too many threads, program congestion, resource competition, etc., thereby lowering the threshold for fault location and improving the efficiency and accuracy of file analysis used for fault troubleshooting. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1 A schematic diagram of a process flow provided for Example 1 of the method for analyzing documents of this application;

[0046] Figure 2 A schematic diagram of the process provided for Example 2 of the method for analyzing documents of this application;

[0047] Figure 3 A brief flowchart of the file analysis method provided in Example 2 of the present application;

[0048] Figure 4 This is a schematic diagram of the module structure of the file analysis device according to an embodiment of the present application;

[0049] Figure 5 Schematic diagram of the device structure of the hardware operating environment involved in the file analysis method in the embodiment of the present application.

[0050] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0052] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0053] The main solution of the embodiment of the present application is to propose a method for automatically analyzing thread dump files, aiming to improve the efficiency and accuracy of troubleshooting. The solution first uses a trigger mechanism to automatically trigger the collection process of thread dump files when the system detects an alarm of increased response delay. The collector executes the jstack command provided by the JDK to generate a dump file containing the stack information of all active threads of the current JVM, and saves it to the specified directory. Then, these unstructured thread dump files are converted into a structured data format for subsequent analysis. This step involves extracting key fields such as thread ID, thread name, thread state, held locks, waiting locks, and stack information, and saving them in a list, where each element represents a thread.

[0054] The solution then goes deeper through three core analysis steps: thread name clustering analysis is used to find the cause of too many threads; thread stack clustering analysis aims to find blocking points in the program; and blocked thread dependency analysis is used to reveal potential deadlocks, resource competition, or performance bottlenecks. Thread name clustering analysis extracts the prefixes of thread names and clusters them to identify the problem of too many threads of a certain type. Thread stack clustering analysis extracts the features of stack information, uses the Levenshtein distance algorithm to calculate the similarity of stack features, and clusters similar threads into one category. Blocked thread dependency analysis analyzes the dependencies between threads by analyzing the relationship between threads holding locks or waiting for locks.

[0055] Finally, the solution presents the analysis results by sorting and displaying the TOP results, allowing users to quickly identify and solve problems in thread dump files. This not only lowers the threshold for fault location, but also greatly improves the efficiency and accuracy of troubleshooting, and solves the defects of existing technologies such as low efficiency, easy errors, and difficulty in comprehensive problem location of manual analysis.

[0056] When processing thread dump files, existing technologies usually require analysts to check the status and stack information of each thread one by one. This method is not only time-consuming, but also difficult to fully cover all threads. When faced with complex fault scenarios, manual analysis often fails to accurately locate the problem, which seriously affects the efficiency and accuracy of troubleshooting. In addition, the manual analysis process is easily limited by the analyst's personal experience and skills, which makes it difficult to ensure the consistency and reliability of the analysis results.

[0057] The present application provides a solution, which obtains a thread dump file in response to system alarm information; performs structured parsing on the thread dump file to obtain a thread parsing table; performs thread analysis on the thread dump file based on the thread parsing table to obtain an alarm analysis result. The thread dump file is automatically structured parsed through the above solution to obtain a thread parsing table containing various key information of the thread, and then automatic thread analysis is performed based on the thread parsing table to quickly troubleshoot problems such as too many threads, program congestion, resource competition, etc., thereby lowering the threshold for fault location and improving the efficiency and accuracy of file analysis for fault troubleshooting.

[0058] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a file analysis system, etc. The following takes the file analysis system as an example to illustrate this embodiment and the following embodiments.

[0059] Based on this, the present application embodiment provides a file analysis method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the document analysis method of this application.

[0060] In this embodiment, the file analysis method includes steps S1000 to S3000:

[0061] Step S1000: Responding to the system alarm information, obtaining a thread dump file;

[0062] It should be noted that, in this embodiment, in order to solve the problems that the existing analysis of thread dump files is mostly done manually, which is not only inefficient but also prone to errors, and for complex fault scenarios, it relies on the in-depth understanding of the Java virtual machine by the analyst, and the threshold is high, the embodiment of the present application proposes a method that can automatically analyze thread dump files to improve the efficiency and accuracy of troubleshooting. First, responding to the system alarm information means that when the system monitors an abnormal situation, such as an increase in response delay, the alarm system will be automatically triggered. The alarm system then sends a trigger signal to the thread dump collector, instructing it to start collecting thread dump files. This process ensures that when a thread state abnormality is detected or a potential problem occurs in the system, the key thread dump file can be obtained in time. The thread dump file is a snapshot of the stack information of all threads of the Java virtual machine at a certain moment, which is crucial for analyzing and locating problems. In addition, it should be noted that the process of collecting thread dump files involves executing the jstack command provided by JDK, which generates a dump file containing all active threads in the JVM. By default, the collector will collect dump information of all threads, and the generated dump file will be saved in the specified directory and given a unique file name to avoid conflicts. The purpose of this step is to quickly obtain comprehensive thread status information when the system is abnormal, providing a data basis for subsequent analysis.

[0063] For example, in a specific implementation, after the system monitors the increase in response delay, it automatically triggers the alarm system, which then sends a trigger signal to the thread dump collector. After receiving the signal, the collector executes the jstack command to generate a dump file containing all thread stack information of the current JVM and saves it to the / tmp directory with the file name "thread_dump_ <timestamp>.txt", where <timestamp>The current timestamp ensures the uniqueness of the file name.

[0064] Step S2000: performing structural analysis on the thread dump file to obtain a thread analysis table;

[0065] It should be noted that structured parsing of thread dump files refers to converting the unstructured dump file content into a structured format for subsequent analysis and processing. This step involves extracting key fields such as thread ID, thread name, thread state, held locks, waiting locks, and stack information, and saving them in a list, with each element representing a thread. In this way, the original text information can be converted into a data structure that is easy to analyze, thereby improving the efficiency and accuracy of the analysis. In addition, it should be noted that the generation of the thread parsing table is to provide structured data support for subsequent thread analysis. In this step, the detailed information of each thread in the thread dump file will be extracted and organized into a table in a certain format. Such a table not only contains the basic information of the thread, but also contains the state and stack information of the thread, providing the necessary data basis for subsequent clustering analysis and dependency analysis.

[0066] For example, in a specific implementation, the thread dump file is converted into a structured data format to facilitate subsequent analysis and processing. All threads are saved into a list, each element in the list represents a thread, and each thread may include the following key fields:

[0067] Thread ID: A number or string that uniquely identifies a thread. This field ensures that each thread has a unique identity in the data structure, making it easier to index and query.

[0068] Thread name: A descriptive name for a thread, used to distinguish between different threads. The thread name is usually assigned by the developer when creating the thread, and is somewhat readable and descriptive.

[0069] Thread state: A field indicating the current state of a thread, such as running, waiting, blocked, etc. The thread state reflects the execution status of a thread at a certain moment and is an important basis for analyzing thread behavior.

[0070] Held locks: There can be multiple locks held at the same time, so an array is used for storage. Each element in the array represents a lock, including the lock ID and lock name.

[0071] Waiting lock: records the lock that the current thread is waiting for, including the lock ID and lock name

[0072] Stack information: The call stack information of a thread is an array containing multiple stack frames. Each stack frame records in detail the call path of the thread at a certain moment, including method name, class name, file name, line number, etc. The stack information provides rich context information for locating problems.

[0073] Step S3000: performing thread analysis on the thread dump file based on the thread parsing table to obtain an alarm analysis result.

[0074] It should be noted that, in this embodiment, thread analysis is performed based on the thread resolution table, with the purpose of discovering problems such as too many threads, program congestion and resource competition. This step involves three major functions: thread name clustering analysis, thread stack clustering analysis and blocked thread dependency analysis. Thread name clustering analysis is used to discover the problem of too many threads of a certain type, thread stack clustering analysis is used to discover congestion points in the program, and blocked thread dependency analysis is used to reveal potential deadlocks, resource competition or performance bottlenecks. In addition, it should be noted that the process of thread analysis is to process and analyze the data in the thread resolution table through an algorithm to identify and locate problems. For example, thread name clustering analysis will cluster threads with the same thread prefix into one category, thread stack clustering analysis will cluster threads with similar stacks into one category, and blocked thread dependency analysis will analyze the dependencies between threads. The results of these analyses will provide direct clues and basis for troubleshooting.

[0075] For example, in a specific implementation, the system first performs a thread name cluster analysis on the thread resolution table, extracts the prefixes of the thread names and clusters them, and identifies the categories with too many threads. Next, the system performs a thread stack cluster analysis, and by calculating the similarity of the stack features, it clusters similar threads into one category to find the blocking points in the program. Finally, the system performs a blocked thread dependency analysis, and by analyzing the relationship between threads holding locks or waiting for locks, it reveals potential deadlocks and resource contention problems. After the analysis is completed, the system will generate an alarm analysis report based on the analysis results. The report can include information such as the reasons for too many threads, program blocking points, and resource contention problems, providing a reference for troubleshooting.

[0076] In a feasible implementation manner, step S1000 may include steps S1100 to S1300:

[0077] Step S1100: In response to the system alarm information, trigger the file collection process and generate a file collection trigger signal and a thread dump command;

[0078] Step S1200: acquiring a target process ID according to the file collection trigger signal;

[0079] Step S1300: According to the target process ID, a thread dump collector is called to execute the thread dump command to obtain a plurality of thread dump files corresponding to the target process.

[0080] It should be noted that responding to system alarm information to obtain thread dump files is the first step in automatically analyzing thread status. System alarm information is usually generated by the monitoring system when abnormal behavior such as increased response time is detected. At this time, the system triggers the file collection process, generates a file collection trigger signal and a thread dump command. The thread dump command usually refers to the jstack command, which is a tool provided by the JDK for generating a thread snapshot of the Java virtual machine at the current moment. The role of the file collection trigger signal is to activate the thread dump collector and obtain the ID of the target Java process based on the signal. This is a key step in locating the specific Java process that needs to be analyzed.

[0081] In addition, it should be noted that after obtaining the target process ID, the system calls the thread dump collector to execute the thread dump command and generates several thread dump files for the target process. These files contain the stack information of all active threads in the Java virtual machine, providing raw data for subsequent fault analysis.

[0082] Specifically, when the alarm system generates an alarm, the system will trigger the collection process of the thread dump file. The specific steps include: first, when the system detects an alarm of increased response delay, the alarm system will send a trigger signal to the thread dump collector. This step ensures that key thread dump files can be collected in time when the thread status is abnormal or potential problems occur in the system. After receiving the trigger signal, the thread dump collector will execute the jstack command provided by JDK to generate a thread dump file. jstack is a command line tool provided by the Java virtual machine, which is used to generate a thread snapshot of the Java virtual machine at the current moment.

[0083] In this embodiment, the dump information of all threads is collected by default. This means that the jstack command will not specify a specific thread ID or filter, but will generate a dump file containing all active threads in the JVM. The thread dump collector executes the jstack command and specifies the Java process ID (PID) for generating the dump file. After the jstack command is run, a text file containing the stack information of all threads of the current JVM will be generated. The collector saves the generated thread dump file to the specified directory (in this case, the / tmp directory) and assigns a unique file name to avoid conflicts.

[0084] For example, in one feasible implementation, when the system monitoring component detects an increase in response latency, it generates an alarm message. After receiving this information, the alarm system triggers the thread dump file collection process, which generates a file collection trigger signal and a thread dump command. After receiving the trigger signal, the thread dump collector determines the ID of the target Java process based on the information contained in the signal. Subsequently, the collector uses this process ID to execute the jstack command, and the execution result of the command generates a text file containing all thread stack information of the current JVM. These files are saved in a predetermined directory, such as / tmp, and each file has a unique file name, such as "thread_dump_ <pid> _ <timestamp>.txt", where <pid>Represents the process ID, <timestamp>Represents the timestamp to ensure the uniqueness of the file name. In this way, the system can collect a snapshot of the thread status at the time of the alarm, providing a data basis for further analysis.

[0085] In a feasible implementation manner, the thread parsing table includes thread key field information, and the thread key field information includes thread lock information. Step S3000 may include steps S3100 to S3400:

[0086] Step S3100: performing thread name cluster analysis based on the thread resolution table to obtain thread name cluster analysis results;

[0087] Step S3200: performing thread stack clustering analysis based on a preset thread stack clustering analysis algorithm and the thread parsing table to obtain a thread stack clustering analysis result;

[0088] Step S3300: performing a blocked thread dependency analysis based on the thread resolution table and the thread lock information to obtain a blocked thread dependency analysis result;

[0089] Step S3400: Generate an alarm analysis result based on the process name clustering analysis result, the thread stack clustering analysis result and the blocked thread dependency analysis result.

[0090] It should be noted that, in this embodiment, the thread parsing table may include thread key field information in the thread dump file, such as thread ID, thread name, thread state, held locks and waiting locks, and stack information. This information provides rich context for subsequent analysis, enabling in-depth analysis of the state and behavior of the thread. Thread lock information is particularly important because it involves synchronization between threads and potential deadlock problems. In addition, in this embodiment, the thread dump file analysis is divided into three parts: thread name clustering analysis, thread stack clustering analysis, and blocked thread dependency analysis. Thread name clustering analysis is to cluster threads with the same thread prefix into one category, which is used to find the problem of too many threads in a certain category, while thread stack clustering analysis is to cluster threads with similar stacks into one category, which is used to find blocking points in the program. Finally, blocked thread dependency analysis is to analyze the dependency relationship between threads by deeply analyzing the relationship between threads holding locks or waiting locks, so as to reveal potential deadlocks, resource competition or performance bottlenecks in the program.

[0091] The purpose of thread name cluster analysis is to identify threads with the same prefix, so as to find out the situation of too many threads being created. Thread stack cluster analysis analyzes the call stack of threads to find out the hot methods or classes that cause program blockage. Blocked thread dependency analysis reveals potential deadlock and resource competition problems by analyzing the lock waiting and holding relationship between threads.

[0092] In addition, it should be noted that through the above analysis steps, the system can automatically extract valuable information from the thread dump file and present it in a structured manner, greatly improving the efficiency and accuracy of troubleshooting. This method reduces the dependence on the experience of analysts, allowing even less experienced personnel to quickly locate and solve problems.

[0093] For example, in a feasible implementation, the system first responds to the alarm information generated by the monitoring component, triggers the file collection process, and generates a file collection trigger signal and a thread dump command. After receiving the trigger signal, the thread dump collector executes the jstack command to generate a thread dump file. Then, the system performs structured parsing on these files, extracts key fields such as thread ID, thread name, thread status, held locks, waiting locks, and stack information, and forms a thread parsing table.

[0094] On this basis, the system performs thread name clustering analysis, removes the serial number in the thread name through regular expressions, obtains thread name prefixes, and clusters based on these prefixes. For thread stack clustering analysis, the system extracts the first 10 stack frames in the stack information array, concatenates and standardizes them, and then sorts the threads according to the stack string, and calculates the feature similarity of adjacent stacks through the Levenshtein distance algorithm to identify similar threads.

[0095] For blocked thread dependency analysis, the system identifies threads whose lock states are blocked or waiting, and obtains the waiting lock IDs corresponding to these threads. Then, the system traverses the thread resolution table to find threads holding the same lock as the waiting lock ID, thereby determining the dependency relationship.

[0096] Finally, the system generates a detailed alarm analysis report based on the results of thread name clustering analysis, thread stack clustering analysis, and blocked thread dependency analysis. This report clearly shows the reasons for excessive threads, program blocking points, and resource competition issues, providing a powerful troubleshooting tool for operation and maintenance personnel.

[0097] The present embodiment provides a file analysis method, which obtains a thread dump file in response to system alarm information; performs structured analysis on the thread dump file to obtain a thread analysis table; performs thread analysis on the thread dump file based on the thread analysis table to obtain an alarm analysis result. The thread dump file is automatically structured analyzed through the above scheme to obtain a thread analysis table containing various key information of the thread, and then automatic thread analysis is performed based on the thread analysis table to quickly troubleshoot problems such as too many threads, program congestion, and resource competition, thereby lowering the threshold for fault location and improving the efficiency and accuracy of fault troubleshooting.

[0098] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 , step S3100 of the file analysis method further includes steps S3110 to S3140:

[0099] Step S3110: traverse the thread resolution table and obtain the target thread name according to the thread key field information;

[0100] Step S3120: removing the thread program number of the target thread name by using a preset regular expression to obtain a thread name prefix;

[0101] Step S3130: performing thread name prefix association based on the thread name prefix to obtain a thread-prefix correspondence list, wherein the thread-prefix correspondence list includes the number of prefix-associated threads;

[0102] Step S3140: If the number of threads associated with the prefix is ​​greater than a preset first number threshold, the thread name prefix corresponding to the number of threads associated with the prefix is ​​determined as the target thread name prefix to obtain a thread name clustering analysis result.

[0103] It should be noted that the key to thread name clustering analysis is to identify thread names with the same prefix, which is mainly achieved by traversing the thread resolution table. The thread resolution table is a structured data format generated by the system based on the thread dump file, which contains thread information such as thread ID, thread name, thread state, held locks and waiting locks, and stack information. The system uses regular expressions to remove the sequence number in the thread name and extract the prefix of the thread name in order to classify threads with the same function into one category, thereby analyzing the problem of excessive thread creation.

[0104] In addition, it should be noted that the system can associate the extracted thread name prefixes, generate a thread-prefix correspondence list, and count the number of threads associated with each prefix. The purpose of this step is to identify which thread prefixes correspond to an abnormally large number of threads, which may indicate problems with excessive thread creation or resource competition. When the number of threads associated with a prefix exceeds a preset first quantity threshold, the system outputs this prefix and its associated number of threads as analysis results, which provides important clues for further troubleshooting.

[0105] The system first responds to the alarm information generated by the monitoring component, triggers the file collection process, and generates a file collection trigger signal and a thread dump command. After receiving the trigger signal, the thread dump collector executes the jstack command to generate a thread dump file. Then, the system performs structured parsing on these files, extracts key fields such as thread ID, thread name, thread status, held locks, waiting locks, and stack information, and forms a thread parsing table.

[0106] On this basis, the system performs a cluster analysis of thread names, removes the serial numbers in the thread names through regular expressions, obtains thread name prefixes, and clusters based on these prefixes. The system creates a thread-prefix correspondence list and counts the number of threads associated with each prefix. If the number of threads associated with a prefix exceeds the preset first quantity threshold, such as more than 10, the system uses this prefix and the number of threads associated with it as the result of the thread name cluster analysis. This helps operation and maintenance personnel quickly identify possible problems of excessive thread creation, so that they can take appropriate measures to optimize or repair them.

[0107] In addition, the system will also perform thread stack clustering analysis and blocked thread dependency analysis, and generate a detailed alarm analysis report by combining these analysis results. This report clearly shows the reasons for excessive threads, program blocking points, and resource competition issues, providing a powerful troubleshooting tool for operation and maintenance personnel. In this way, the system can automatically extract valuable information from thread dump files and present it in a structured manner, greatly improving the efficiency and accuracy of troubleshooting.

[0108] For example, in a feasible implementation, when the system performs thread name clustering analysis, it first traverses each thread in the thread list to obtain the thread name, where the thread name is composed of a prefix + a serial number, uses a regular expression to remove the serial number part, retains only the prefix, and then uses a dictionary to save the correspondence between the prefix and the thread. For the dictionary saving scheme, first, create an empty dictionary to store the correspondence between the prefix and the thread list, then input the extracted thread name prefix, and determine whether there is a key matching the input prefix in the dictionary. If the prefix exists, update the thread list and add the input thread to the thread list corresponding to the prefix. If the prefix does not exist, create a new key-value pair in which the key is the prefix and the value is a list containing the input threads. Finally, return the updated dictionary.

[0109] After that, perform clustering result analysis, traverse the updated dictionary, obtain the prefix and the corresponding thread list, the number of threads in the thread list is the number of threads corresponding to the prefix, sort by the number of threads corresponding to the prefix, sort by the number of threads in descending order, and take the TOP5 results for display. The displayed fields include: thread prefix name and thread number.

[0110] In a feasible implementation manner, step S3200 may include steps S3210 to S3260:

[0111] Step S3210: extracting the stack information array in the thread parsing table;

[0112] Step S3220: performing splicing and standardization processing based on a preset number of stack frames in the stack information array to obtain a stack character string;

[0113] Step S3230: performing feature sorting on the target threads in the thread parsing table based on the stack character string to obtain a sorted thread list;

[0114] Step S3240: traverse the sorted thread list and calculate the feature similarity of adjacent stacks using the Levenshtein distance algorithm;

[0115] Step S3250: if the feature similarity is greater than a preset similarity threshold, determining the threads corresponding to the adjacent stacks as threads of the same type of clustering;

[0116] Step S3260: If the number of the same-type clustering threads is greater than a preset second number threshold, the same-type clustering threads are determined as target same-type clustering threads to obtain a thread stack clustering analysis result.

[0117] It should be noted that the purpose of thread stack clustering analysis is to identify threads running on the same code path, which may be blocked because they are waiting for the same resources or due to the same bottleneck problem. By extracting the stack information array in the thread resolution table, the system can obtain the call path of each thread at a certain moment. A preset number of stack frames are selected and spliced ​​to form a stack string. This step is to capture the critical path of thread execution. Standardization ensures that the stack information of different threads can be accurately compared, eliminating interference caused by dynamic code generation or anonymous classes.

[0118] In addition, it should be noted that the system sorts threads according to stack strings so that similar stack information is clustered together. This sorting process lays the foundation for subsequent similarity calculations. The Levenshtein distance algorithm is used to calculate the feature similarity of adjacent stacks, which can quantify the difference between two strings and thus determine their degree of similarity. When the feature similarity exceeds a preset threshold, it indicates that these threads may face the same problem, such as a common resource contention point or execution bottleneck.

[0119] For example, in a feasible implementation, the system triggers the file collection process in response to the alarm information generated by the monitoring component, and generates a file collection trigger signal and a thread dump command. After receiving the trigger signal, the thread dump collector executes the jstack command to generate a thread dump file. The system performs structured analysis on these files, extracts key information of the thread, including thread ID, thread name, thread state, held locks, waiting locks and stack information, etc., to form a thread analysis table.

[0120] When performing thread stack clustering analysis, the system extracts the stack information array in the thread parsing table, and selects the first 10 stack frames in the array for splicing and standardization to form a stack string. Then, the system sorts the threads according to the stack string to obtain a sorted thread list. The system traverses this list and calculates the feature similarity of adjacent stacks using the Levenshtein distance algorithm. If the similarity exceeds the preset 90% threshold, the threads are clustered into one category. If the number of threads in the same cluster exceeds the preset second number threshold, such as more than 5, the system determines these threads as target threads in the same cluster and obtains the thread stack clustering analysis results.

[0121] These analysis results provide maintenance personnel with detailed information about program blockage points, helping them quickly locate and resolve potential performance issues. In this way, the system can automatically extract valuable information from thread dump files and present it in a structured manner, greatly improving the efficiency and accuracy of troubleshooting.

[0122] In a feasible implementation manner, step S3300 may include steps S3310 to S3330:

[0123] Step S3310: determining a thread whose thread lock state is blocked or waiting in the thread lock information as a target blocked thread;

[0124] Step S3310: Obtain the waiting lock ID corresponding to the target blocked thread;

[0125] Step S3310: traverse the thread resolution table, determine the thread in the thread resolution table that holds the same lock ID as the waiting lock ID as the target dependent thread, and obtain the blocking thread dependency analysis result.

[0126] It should be noted that the purpose of blocking thread dependency analysis is to identify the dependencies between threads caused by lock waiting and holding. In the Java virtual machine, a thread may enter a blocked state because it is waiting to acquire a lock, while another thread may hold the lock. By analyzing the lock holding and waiting relationship, potential deadlocks, resource contention or performance bottlenecks in the program can be revealed.

[0127] Blocked threads are threads that cannot continue to execute because they are waiting to acquire a lock. The thread lock information records in detail the locks held by each thread and the locks it is waiting for. The system traverses the thread resolution table, identifies all threads in a blocked or waiting state, and marks them as target blocked threads. For each target blocked thread, the system obtains its corresponding waiting lock ID, which is a key step in implementing blocked thread dependency analysis.

[0128] In addition, it should be noted that the system continues to traverse the thread resolution table, looking for threads holding the same lock ID as the waiting lock. If a thread holds a lock ID that matches the waiting lock ID of the target blocked thread, then this thread is considered to be the target dependent thread. In this way, the system can build a dependency graph that clearly shows which threads are dependent on each other because of waiting and holding locks.

[0129] For example, in a feasible implementation, the system first responds to the alarm information generated by the monitoring component, triggers the file collection process, and generates a file collection trigger signal and a thread dump command. After receiving the trigger signal, the thread dump collector executes the jstack command to generate a thread dump file. The system performs structured parsing on these files, extracts key fields such as thread ID, thread name, thread status, held locks, waiting locks, and stack information, and forms a thread parsing table.

[0130] In the blocking thread dependency analysis phase, the system identifies all threads in the blocked or waiting state and obtains their corresponding waiting lock IDs. Then, the system traverses the thread resolution table and, for each thread holding a lock, checks whether its lock ID matches the waiting lock ID of any target blocked thread. If a matching lock ID is found, the system identifies these threads as target dependent threads and records the dependency relationship between them.

[0131] Through this method, the system can automatically analyze thread dump files and identify thread dependencies that cause program blockages, thereby helping developers quickly locate and resolve potential deadlock and resource contention issues. This automated analysis method not only improves the efficiency of troubleshooting, but also reduces reliance on analyst experience, making fault location faster and more accurate. Ultimately, the system integrates these analysis results to generate a detailed alarm analysis report, providing operations and maintenance personnel with a powerful troubleshooting tool.

[0132] For example, to help understand the implementation process of the file analysis method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 3 , Figure 3 A brief flowchart of a file analysis method is provided, specifically:

[0133] …

[0134] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the document analysis method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0135] Please refer to Figure 4 The present application also provides a file analysis device, the file analysis device comprising:

[0136] An acquisition module 41 is used to acquire a thread dump file in response to a system alarm message;

[0137] The parsing module 42 is used to perform structural parsing on the thread dump file to obtain a thread parsing table;

[0138] The analysis module 43 is used to perform thread analysis on the thread dump file based on the thread parsing table to obtain an alarm analysis result.

[0139] The file analysis device provided by the present application adopts the file analysis method in the above embodiment to solve the technical problem of file analysis. Compared with the prior art, the beneficial effects of the file analysis device provided by the present application are the same as the beneficial effects of the file analysis method provided by the above embodiment, and other technical features in the file analysis device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0140] The present application provides a file analysis device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the file analysis method in the above-mentioned embodiment 1.

[0141] Reference below Figure 5 , which shows a schematic diagram of the structure of a file analysis device suitable for implementing an embodiment of the present application. The file analysis device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The file analysis device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0142] like Figure 5 As shown, the file analysis device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the file analysis device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the file analysis device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a file analysis device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0143] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0144] The file analysis device provided in the present application adopts the file analysis method in the above-mentioned embodiment. Compared with the prior art, the beneficial effects of the file analysis device provided in the present application are the same as the beneficial effects of the file analysis method provided in the above-mentioned embodiment, and other technical features in the file analysis device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0145] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0146] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0147] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the file analysis method in the above-mentioned embodiment.

[0148] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0149] The computer-readable storage medium may be included in the file analysis device; or may exist independently without being assembled into the file analysis device.

[0150] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0151] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0152] The modules involved in the embodiments described in the present application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0153] The readable storage medium provided in the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned file analysis method, and can solve the technical problems of file analysis. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the present application are the same as the beneficial effects of the file analysis method provided in the above-mentioned embodiment, and will not be elaborated here.

[0154] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned file analysis method when executed by a processor.

[0155] The computer program product provided by the present application can solve the technical problem of file analysis. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the file analysis method provided by the above embodiment, which will not be repeated here.

[0156] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.< / timestamp> < / pid> < / timestamp> < / pid> < / timestamp> < / timestamp>

Claims

1. A file analysis method, characterized in that: The method comprises: In response to the system warning information, obtaining a thread dump file; Performing structured analysis on the thread dump file to obtain a thread analysis table; Thread analysis is performed on the thread dump file based on the thread parsing table to obtain an alarm analysis result.

2. The method according to claim 1, characterized in that The step of obtaining a thread dump file in response to the system alarm information includes: In response to the system alarm information, trigger the file collection process and generate a file collection trigger signal and a thread dump command; Acquire the target process ID according to the file acquisition trigger signal; According to the target process ID, a thread dump collector is called to execute the thread dump command to obtain a plurality of thread dump files corresponding to the target process.

3. The method according to claim 1, characterized in that The thread analysis table includes thread key field information, and the thread key field information includes thread lock information. The step of performing thread analysis on the thread dump file based on the thread analysis table to obtain an alarm analysis result includes: Performing thread name clustering analysis based on the thread parsing table to obtain thread name clustering analysis results; Performing thread stack clustering analysis based on a preset thread stack clustering analysis algorithm and the thread parsing table to obtain a thread stack clustering analysis result; Performing a blocked thread dependency analysis based on the thread parsing table and the thread lock information to obtain a blocked thread dependency analysis result; An alarm analysis result is generated based on the process name clustering analysis result, the thread stack clustering analysis result and the blocked thread dependency analysis result.

4. The method according to claim 3, characterized in that The step of performing thread name cluster analysis based on the thread parsing table to obtain thread name cluster analysis results also includes: Traversing the thread parsing table, and obtaining the target thread name according to the thread key field information; Removing the thread program number of the target thread name by using a preset regular expression to obtain a thread name prefix; Perform thread name prefix association based on the thread name prefix to obtain a thread-prefix correspondence list, wherein the thread-prefix correspondence list includes the number of prefix-associated threads; If the number of threads associated with the prefix is ​​greater than a preset first number threshold, the thread name prefix corresponding to the number of threads associated with the prefix is ​​determined as the target thread name prefix to obtain a thread name clustering analysis result.

5. The method according to claim 3, characterized in that The step of performing thread stack clustering analysis based on a preset thread stack clustering analysis algorithm and the thread parsing table to obtain a thread stack clustering analysis result comprises: Extracting the stack information array in the thread parsing table; Perform splicing and standardization processing based on a preset number of stack frames in the stack information array to obtain a stack character string; Based on the stack character string, feature sorting is performed on the target threads in the thread parsing table to obtain a sorted thread list; Traversing the sorted thread list, calculating feature similarities of adjacent stacks using a Levenshtein distance algorithm; If the feature similarity is greater than a preset similarity threshold, determining the threads corresponding to the adjacent stacks as threads of the same type of clustering; If the number of the same type of clustering threads is greater than a preset second number threshold, the same type of clustering threads are determined as target same type of clustering threads, and a thread stack clustering analysis result is obtained.

6. The method according to claim 3, characterized in that The step of performing blocked thread dependency analysis based on the thread parsing table and thread lock information to obtain a blocked thread dependency analysis result comprises: Determine a thread whose thread lock state is blocked or waiting in the thread lock information as a target blocked thread; Get the waiting lock ID corresponding to the target blocked thread; The thread resolution table is traversed, and threads in the thread resolution table holding a lock ID identical to the waiting lock ID are determined as target dependent threads, thereby obtaining a blocking thread dependency analysis result.

7. A file analysis device, characterized in that: The device comprises: An acquisition module, used for acquiring a thread dump file in response to a system alarm message; A parsing module, used for performing structured parsing on the thread dump file to obtain a thread parsing table; The analysis module is used to perform thread analysis on the thread dump file based on the thread parsing table to obtain an alarm analysis result.

8. A file analysis device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the file analysis method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the file analysis method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the file analysis method according to any one of claims 1 to 6 are implemented.

Images