Cloud native application fault self-recovery method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a cloud native application fault self-recovery method and device, electronic equipment and a storage medium, and belongs to the technical field of artificial intelligence. The method comprises the steps of obtaining a source alarm event in a current time period, and performing data cleaning on the source alarm event to obtain a to-be-processed alarm event; performing alarm root cause analysis on the to-be-processed alarm event to obtain alarm root cause information; matching a corresponding fault self-healing strategy according to the alarm root cause information, and generating a fault self-healing task according to the alarm root cause information and the fault self-healing strategy; and performing fault self-healing processing on the cloud native system according to the fault self-healing task. According to the embodiment of the invention, the processing efficiency of the cloud native application fault can be improved, and the high availability and stability of a service system are guaranteed.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a cloud-native application fault self-healing method and device, an electronic device, and a storage medium. Background Art

[0002] With the continuous expansion of business and the popularization of cloud-native technology, most of the business applications of many enterprises have been migrated to cloud-native k8s clusters. Although cloud-native technology can help enterprises quickly build, deploy and expand applications, as the complexity and scale of applications increase, it also brings severe challenges in stable operation, operation and maintenance efficiency, and security assurance.

[0003] At present, traditional fault handling in the cloud-native context has some defects and shortcomings, as follows:

[0004] 1) Low efficiency in manual root cause location: Traditional root cause analysis and location of abnormalities are done by manually checking various monitoring systems after receiving an alarm and then logging into the server for troubleshooting. Since the Kubernetes cloud-native application pod will automatically destroy and rebuild a new pod container upon detecting an abnormality, it is impossible for humans to analyze and locate the root cause of the application abnormality in a timely manner, resulting in misjudgment and missed judgments.

[0005] 2) Traditional fault handling and recovery takes a long time: Traditional exception handling requires manual consultation of relevant fault handling manuals, and then obtaining relevant fault resources through monitoring alarms, and then logging into the corresponding operation and maintenance platform to perform operations such as restart, expansion, and rollback. Manual fault repair takes a long time and affects business availability.

[0006] 3) Application failures cannot be prevented in advance: Traditional fault prevention methods are to conduct continuous manual inspections of large quantities of related resources after receiving monitoring alarms and to judge whether to take measures such as capacity expansion based on personal experience. This method consumes a lot of manpower costs and is crude and inefficient, and cannot prevent application failures in advance.

[0007] The above problems need to be solved urgently. Summary of the invention

[0008] The main purpose of the embodiments of the present application is to propose a cloud-native application fault self-healing method and device, an electronic device and a storage medium, aiming to improve the processing efficiency of cloud-native application faults and ensure the high availability and stability of the business system.

[0009] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a cloud native application fault self-healing method, the method comprising:

[0010] Acquire source alarm events in the current time period, perform data cleaning on the source alarm events, and obtain alarm events to be processed;

[0011] Performing alarm root cause analysis on the alarm event to be processed to obtain alarm root cause information;

[0012] Matching a corresponding fault self-healing strategy according to the alarm root cause information, and generating a fault self-healing task according to the alarm root cause information and the fault self-healing strategy;

[0013] Perform fault self-healing processing on the cloud native system according to the fault self-healing task.

[0014] In some embodiments, the step of performing data cleaning on the source alarm event to obtain the alarm event to be processed includes:

[0015] Determine the alarm field information of the source alarm event, and determine the application name, alarm type and alarm time corresponding to the source alarm event according to the alarm field information;

[0016] Filter the source alarm event according to a preset alarm filtering rule, the application name, and the alarm type to obtain a first alarm event;

[0017] Classifying the first alarm event according to the application name to obtain second alarm events corresponding to multiple target applications, and deduplicating the second alarm event according to the alarm type and the alarm time to obtain third alarm events corresponding to multiple target applications;

[0018] Field standardization is performed on the third alarm event to obtain the to-be-processed alarm events corresponding to multiple target applications.

[0019] In some embodiments, the step of performing alarm root cause analysis on the alarm event to be processed to obtain alarm root cause information includes:

[0020] Determine the alarm node and alarm time of each of the alarm events to be processed, and determine the node call relationship between the alarm nodes;

[0021] Determine the event association relationship between the to-be-processed alarm events according to the alarm time, the alarm node and the node calling relationship;

[0022] Generate an alarm event map according to the alarm event to be processed and the event association relationship, and extract alarm event time series feature data according to the alarm event map;

[0023] The alarm event time series feature data is input into a pre-trained alarm root cause identification model to obtain the alarm root cause information.

[0024] In some embodiments, generating an alarm event graph according to the alarm event to be processed and the event association relationship, and extracting alarm event time series feature data according to the alarm event graph includes:

[0025] Taking the to-be-processed alarm event as an event node, determining the directed edges between the event nodes according to the event association relationship, and obtaining the alarm event graph;

[0026] Determine the number of associated nodes of each of the event nodes in the alarm event graph, and determine a plurality of key event nodes according to the number of associated nodes;

[0027] Performing a path search on the alarm event graph according to the key event nodes to obtain the shortest path including all the key event nodes;

[0028] A plurality of target alarm events corresponding to the shortest path are determined, and the target alarm events are sorted according to the shortest path to obtain the alarm event time series feature data.

[0029] In some embodiments, the alarm root cause identification model is trained by the following steps:

[0030] Acquire a plurality of preset alarm event time series sample data, and determine the alarm root cause label corresponding to each of the alarm event time series sample data through manual labeling;

[0031] Inputting the alarm event time series sample data into a pre-built long short-term memory network to obtain an alarm root cause identification result;

[0032] Determine a loss value according to the alarm root cause identification result and the alarm root cause label;

[0033] The parameters of the long short-term memory network are updated according to the loss value to obtain the trained alarm root cause identification model.

[0034] In some embodiments, matching a corresponding fault self-healing strategy according to the alarm root cause information, and generating a fault self-healing task according to the alarm root cause information and the fault self-healing strategy, includes:

[0035] Matching the alarm root cause information in a preset self-healing strategy library to obtain the corresponding fault self-healing strategy;

[0036] Alarm parameters are determined according to the alarm root cause information, and a self-healing script template is determined according to the fault self-healing strategy. Then, the self-healing script template is parameterized and instantiated according to the alarm parameters by a template engine to obtain the fault self-healing task.

[0037] In some embodiments, performing fault self-healing processing on the cloud native system according to the fault self-healing task includes:

[0038] Adding the fault self-healing task to a preset first message queue;

[0039] Asynchronously consuming the first message queue, and executing the fault self-healing task through an operation and maintenance orchestration tool to obtain a fault self-healing processing result;

[0040] The fault self-healing processing result is pushed to a preset alarm recipient.

[0041] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a cloud native application fault self-healing device, the device comprising:

[0042] The alarm event cleaning module is used to obtain the source alarm events in the current time period, perform data cleaning on the source alarm events, and obtain the alarm events to be processed;

[0043] An alarm root cause analysis module is used to analyze the alarm root cause of the alarm event to be processed to obtain alarm root cause information;

[0044] A self-healing task generation module, used to match the corresponding fault self-healing strategy according to the alarm root cause information, and generate a fault self-healing task according to the alarm root cause information and the fault self-healing strategy;

[0045] The fault self-healing processing module is used to perform fault self-healing processing on the cloud native system according to the fault self-healing task.

[0046] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored on the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the cloud-native application fault self-healing method as described in the first aspect above is realized.

[0047] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the cloud-native application fault self-healing method as described in the first aspect above.

[0048] The cloud native application fault self-healing method and device, electronic device and storage medium proposed in the present application obtain the source alarm event of the current time period, perform data cleaning on the source alarm event to obtain the alarm event to be processed, perform alarm root cause analysis on the alarm event to be processed to obtain alarm root cause information, match the corresponding fault self-healing strategy according to the alarm root cause information, generate a fault self-healing task according to the alarm root cause information and the fault self-healing strategy, and perform fault self-healing processing on the cloud native system according to the fault self-healing task. The embodiment of the present application performs data cleaning on the source alarm event to obtain the alarm event to be processed, performs alarm root cause analysis on the alarm event to be processed to obtain alarm root cause information, matches the fault self-healing strategy according to the alarm root cause information and generates a fault self-healing task, and implements fault self-healing processing of the cloud native system according to the fault self-healing task, thereby improving the processing efficiency of cloud native application faults and ensuring the high availability and stability of the business system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a flow chart of a cloud native application fault self-healing method provided in an embodiment of the present application;

[0050] Figure 2 yes Figure 1 A flow chart of step S101 in FIG.

[0051] Figure 3 yes Figure 1 A flow chart of step S102 in FIG.

[0052] Figure 4 yes Figure 3 A flow chart of step S1023 in FIG.

[0053] Figure 5 It is a flow chart of a training alarm root cause identification model provided in an embodiment of the present application;

[0054] Figure 6 yes Figure 1 A flow chart of step S103 in FIG.

[0055] Figure 7 yes Figure 1 A flow chart of step S104 in FIG.

[0056] Figure 8 It is a structural diagram of a cloud native application fault self-healing device provided in an embodiment of the present application;

[0057] Fig. 9 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0058] Fig.10 It is a schematic diagram of the structure of the storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0062] First, some nouns involved in this application are analyzed:

[0063] Artificial intelligence (AI) is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence. AI is a branch of computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing and expert systems. AI can simulate the information process of human consciousness and thinking. AI is also a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0064] Cloud native: A software approach to building, deploying, and managing modern applications in a cloud computing environment. Modern businesses want to build highly scalable, flexible, and resilient applications that can be quickly updated to meet customer needs. To do this, they use modern tools and technologies that inherently support application development on cloud infrastructure. These cloud native technologies enable rapid and frequent changes to applications without affecting service delivery, giving adopters an innovative competitive advantage.

[0065] Root cause analysis: Root cause analysis is a systematic approach that aims to find the root cause of a problem rather than just addressing the symptoms. It is done by deeply analyzing data and related information to identify the key factors and drivers that lead to the problem.

[0066] Long Short-Term Memory (LSTM): A time-recurrent neural network designed to solve the long-term dependency problem of general RNNs (recurrent neural networks). All RNNs have a chain form of repeated neural network modules. In standard RNNs, this repeated structural module has only a very simple structure, such as a tanh layer.

[0067] With the continuous expansion of business and the popularization of cloud-native technology, most of the business applications of many enterprises have been migrated to cloud-native k8s clusters. Although cloud-native technology can help enterprises quickly build, deploy and expand applications, as the complexity and scale of applications increase, it also brings severe challenges in stable operation, operation and maintenance efficiency, and security assurance.

[0068] At present, traditional fault handling in the cloud-native context has some defects and shortcomings, as follows:

[0069] 1) Low efficiency in manual root cause location: Traditional root cause analysis and location of abnormalities are done by manually checking various monitoring systems after receiving an alarm and then logging into the server for troubleshooting. Since the Kubernetes cloud-native application pod will automatically destroy and rebuild a new pod container upon detecting an abnormality, it is impossible for humans to analyze and locate the root cause of the application abnormality in a timely manner, resulting in misjudgment and missed judgments.

[0070] 2) Traditional fault handling and recovery takes a long time: Traditional exception handling requires manual consultation of relevant fault handling manuals, and then obtaining relevant fault resources through monitoring alarms, and then logging into the corresponding operation and maintenance platform to perform operations such as restart, expansion, and rollback. Manual fault repair takes a long time and affects business availability.

[0071] 3) Application failures cannot be prevented in advance: Traditional fault prevention methods are to conduct continuous manual inspections of large quantities of related resources after receiving monitoring alarms and to judge whether to take measures such as capacity expansion based on personal experience. This method consumes a lot of manpower costs and is crude and inefficient, and cannot prevent application failures in advance.

[0072] Based on this, the embodiments of the present application provide a cloud-native application fault self-healing method and device, an electronic device and a storage medium, aiming to improve the processing efficiency of cloud-native application faults and ensure the high availability and stability of the business system.

[0073] The cloud-native application fault self-healing method and device, electronic device and storage medium provided in the embodiments of the present application are specifically illustrated by the following embodiments. First, the cloud-native application fault self-healing method in the embodiments of the present application is described.

[0074] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0075] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0076] The cloud-native application fault self-healing method provided in the embodiment of the present application relates to the field of artificial intelligence technology. The cloud-native application fault self-healing method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or it can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the cloud-native application fault self-healing method, etc., but is not limited to the above forms.

[0077] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0078] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0079] Figure 1 is an optional flowchart of the cloud native application fault self-healing method provided in an embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S104.

[0080] Step S101, obtaining source alarm events in the current time period, performing data cleaning on the source alarm events, and obtaining alarm events to be processed;

[0081] Step S102, analyzing the root cause of the alarm event to be processed to obtain the root cause information of the alarm;

[0082] Step S103, matching a corresponding fault self-healing strategy according to the alarm root cause information, and generating a fault self-healing task according to the alarm root cause information and the fault self-healing strategy;

[0083] Step S104: perform fault self-healing processing on the cloud native system according to the fault self-healing task.

[0084] Steps S101 to S104 shown in the embodiment of the present application obtain the source alarm events of the current time period, perform data cleaning on the source alarm events to obtain the alarm events to be processed, perform alarm root cause analysis on the alarm events to be processed to obtain alarm root cause information, match the corresponding fault self-healing strategy according to the alarm root cause information, generate a fault self-healing task according to the alarm root cause information and the fault self-healing strategy, and perform fault self-healing processing on the cloud native system according to the fault self-healing task. The embodiment of the present application performs data cleaning on the source alarm events to obtain the alarm events to be processed, performs alarm root cause analysis on the alarm events to be processed to obtain alarm root cause information, matches the fault self-healing strategy according to the alarm root cause information and generates a fault self-healing task, and implements fault self-healing processing of the cloud native system according to the fault self-healing task, thereby improving the processing efficiency of cloud native application faults and ensuring the high availability and stability of the business system.

[0085] See also Figure 2 In some embodiments, step S101 may include but is not limited to steps S1011 to S1014:

[0086] Step S1011, determining the alarm field information of the source alarm event, and determining the application name, alarm type and alarm time corresponding to the source alarm event according to the alarm field information;

[0087] Step S1012, filtering the source alarm event according to the preset alarm filtering rule, application name and alarm type to obtain the first alarm event;

[0088] Step S1013, classifying the first alarm event according to the application name to obtain second alarm events corresponding to multiple target applications, and deduplicating the second alarm event according to the alarm type and the alarm time to obtain third alarm events corresponding to multiple target applications;

[0089] Step S1014: perform field standardization processing on the third alarm event to obtain alarm events to be processed corresponding to multiple target applications.

[0090] In some embodiments, by connecting to the wiseapm alarm center, different types of source alarm events such as pks application pod-level cpu, memory, number of threads, and host-level cpu, memory, disk, etc. are pushed to the message queue of the self-healing platform in real time.

[0091] In some embodiments, the cleaning rules configured in the self-healing platform are used to clean the received source alarm events, such as filtering non-standard alarm data, converging and deduplicating alarm data of the same application, and standardizing fields. Finally, the cleaned alarm data is stored in the database of the self-healing platform and the subsequent root cause analysis process is triggered.

[0092] In some embodiments, the application name, alarm type and alarm event of the original alarm event are first determined based on the alarm field information of the source alarm event; the preset alarm filtering rules are set with the application name and alarm type that need to be filtered out, and the source alarm event is filtered by the alarm filtering rules to preliminarily screen out the first alarm event; the first alarm event is classified according to the application name to obtain the second alarm event corresponding to different applications, and for the second alarm event of the same application, it is determined whether the same alarm recurs within a short period of time based on the alarm type and alarm event. If so, the repeated identical alarms are deduplicated (the first alarm is retained) to obtain a third alarm event; the alarm field of the third alarm event is subjected to field standardization processing to obtain the alarm event to be processed.

[0093] See also Figure 3 In some embodiments, step S102 may include but is not limited to steps S1021 to S1024:

[0094] Step S1021, determining the alarm node and alarm time of each alarm event to be processed, and determining the node call relationship between each alarm node;

[0095] Step S1022, determining the event association relationship between the alarm events to be processed according to the alarm time, the alarm node and the node calling relationship;

[0096] Step S1023, generating an alarm event map according to the alarm events to be processed and the event association relationship, and extracting the alarm event time series feature data according to the alarm event map;

[0097] Step S1024, input the alarm event time series feature data into a pre-trained alarm root cause identification model to obtain alarm root cause information.

[0098] In some embodiments, the alarms generated by financial business platforms or systems such as insurance and financial management are used as examples for explanation. It is understandable that usually a financial insurance or financial management platform, system or APP provides diversified financial products or insurance products and diversified business services to a large number of users. Business processing events such as the buying and selling of user products, the refreshing of product prices, the increase and decrease of user income, data synchronization refresh events, etc. will occur at every moment. The architecture of the corresponding financial business platform or system will involve transaction calls, data synchronization and other operations between multiple modules. Once a problem occurs in a transaction call or a data synchronization error, it may cause a cascade reaction between businesses and trigger business alarms.

[0099] In some embodiments, the key fields of each alarm event to be processed are obtained, the key fields are matched with the preset alarm node field library, and the alarm node corresponding to the matched alarm node field is used as the alarm node of the key field. It should be noted that the key field can be the field that appears most frequently in each alarm message, and the key field is matched with the preset alarm node field library to obtain the corresponding alarm node. The alarm node of each alarm message in the alarm information set is determined by the alarm node, which can quickly locate the alarm source of the alarm information, facilitating the subsequent alarm root cause analysis.

[0100] In some embodiments, since the alarms of operation and maintenance often involve multiple levels or multiple business logics, multiple associated alarm nodes are formed, and the call relationship between each alarm node is determined through the associated alarm nodes. Specifically, the execution data of each alarm node in the alarm node set is obtained, the associated alarm node is determined from the execution data, and the call relationship between each alarm node in the alarm node set is determined based on the associated alarm node. It should be noted that the execution data can be the log data of each alarm node, and the associated nodes with the call relationship during the execution process are obtained from the log data, so as to determine the call relationship of each alarm node.

[0101] In some embodiments, the event association relationship between the pending alarm events is determined based on the node calling relationship between the alarm nodes of the pending alarm events and the front-end association between the alarm events. For example, the alarm node a of the pending alarm event A and the alarm node b of the pending alarm event B have an a-calls-b relationship, the alarm time of the pending alarm event A is after the alarm time of the pending alarm event B or both are simultaneous, and the alarm time difference between the two does not exceed a preset time threshold, then it can be determined that there is an event association relationship B→A between the pending alarm event A and the pending alarm event B.

[0102] In some embodiments, an alarm event map is generated based on the alarm events to be processed and the event association relationships, and the alarm event time series feature data is extracted based on the alarm event map. The alarm event time series feature data is then input into a pre-trained alarm root cause identification model to obtain the alarm root cause information.

[0103] See also Figure 4 In some embodiments, step S1023 may include but is not limited to steps S10231 to S10234:

[0104] Step S10231, taking the alarm event to be processed as an event node, determining the directed edges between the event nodes according to the event association relationship, and obtaining an alarm event graph;

[0105] Step S10232, determining the number of associated nodes of each event node in the alarm event graph, and determining a plurality of key event nodes according to the number of associated nodes;

[0106] Step S10233, performing path search on the alarm event graph according to the key event nodes to obtain the shortest path including all the key event nodes;

[0107] Step S10234, determining multiple target alarm events corresponding to the shortest path, and sorting the target alarm events according to the shortest path to obtain alarm event time series feature data.

[0108] In some embodiments, each pending alarm event is taken as an event node, and the directed edges between the event nodes are determined according to the event association relationship, so that an alarm event graph can be constructed. It should be noted that the alarm event graph is obtained by directing the call relationship between each pending alarm event, and the direction of the connection edge obtained by the directed connection is used to indicate the possible logical relationship between the pending alarm events. By constructing an alarm event graph between the pending alarm events, the possible logical relationship between the pending alarm events can be dynamically displayed, which is convenient for extracting the timing characteristics of the pending alarm events.

[0109] In some embodiments, for each event node in the alarm event graph, other event nodes with directed edges (event association relationships) are used as associated nodes, the number of associated nodes of each event node is counted, and multiple event nodes whose number of associated nodes exceeds a certain threshold or are ranked high are selected as key event nodes.

[0110] In some embodiments, the start node and the end node are determined according to the alarm time sequence of each key event node (if there are key event nodes with the same alarm time, the order is determined according to the event association relationship between the two), and the alarm event map is searched for a path according to the determined start node and end node, and the path is constrained to pass through all key event nodes to obtain the shortest path. It should be noted that the path search algorithm can adopt a path search algorithm known in the art, and the embodiments of the present invention will not be described in detail here.

[0111] In some embodiments, the target alarm events corresponding to each event node in the shortest path are determined, and the target alarm events are sorted according to the sequence of the event nodes in the shortest path to obtain alarm event time series feature data.

[0112] See also Figure 5 In some embodiments, the steps of training the alarm root cause identification model may include but are not limited to steps S201 to S204:

[0113] Step S201, obtaining a plurality of preset alarm event time series sample data, and determining the alarm root cause label corresponding to each alarm event time series sample data through manual labeling;

[0114] Step S202, inputting the alarm event time series sample data into the pre-built long short-term memory network to obtain the alarm root cause identification result;

[0115] Step S203, determining the loss value according to the alarm root cause identification result and the alarm root cause label;

[0116] Step S204, updating the parameters of the long short-term memory network according to the loss value to obtain a trained alarm root cause identification model.

[0117] Specifically, the Long Short Term Memory Network (LSTM) is an improved recurrent neural network. In the LSTM network, conventional storage units are replaced by storage units, each of which is composed of an input gate, an output gate, a unit state, etc. The Long Short Term Memory Network used in the embodiment of the present invention is described below.

[0118] At time t, LSTM has three inputs: the input value X of the network at the current time t , the output value X of LSTM at the previous moment t-1 , and the unit state C at the previous moment t-1 ; LSTM has two outputs: the current LSTM output value h t , and the current cell state C t .

[0119] For the control of the long-term state c, three gate control switches are used for measurement. It is necessary to consider the influence of the output of the previous storage unit, the influence of the current input value, and the influence of the current storage unit on subsequent transmission. Therefore, the rational use of the three gate control switches becomes an important link in signal transmission and parameter update.

[0120] In the process of the storage unit transmitting information over time, three control switches are used to measure the state unit c. The first switch is responsible for controlling the continued preservation of the long-term state c, measuring the influence of the previous storage unit on the current storage unit, and determining the influence of the memory experience on the current time point; the second switch is responsible for controlling the input of the immediate state into the long-term state c. The input signal does not have to be fully input into the model, only the measurement value that needs to be considered can be input; the third switch is responsible for controlling whether the long-term state c is used as the output of the current LSTM. It is worth mentioning that the gate switch used here is only a gate definition in terms of its function. Its value is a vector value between 0-1, which is calculated using the weight measurement method, rather than simply being identified as a gate switch of 0 or 1.

[0121] The gate switch is actually a fully connected layer. The input is a vector and the output is a real vector between 0 and 1. When in use, the output vector of the gate switch is multiplied by the vector to be controlled element by element as the output vector. The output of the gate is a real vector between 0 and 1. When the gate output is 0, any vector multiplied with it will result in a 0 vector, which is equivalent to nothing passing through; when the output is 1, any vector multiplied with it will not change anything, which is equivalent to everything passing through. The Sigmoid function implements the normalization operation of the output quantity, making the output value a probability value between 0 and 1.

[0122] In some embodiments, the alarm event time series sample data is used as the input data of the LSTM model to train the network. This process can perform feature learning and mapping on the data layer by layer, and then send the deep time-frequency feature signal features to the Softmax classifier for training. The LSTM is then initialized using the trained weights, and the constructed LSTM network model is optimized using the back propagation algorithm, so that the LSTM network model converges to the global optimum, ultimately achieving the purpose of fault identification.

[0123] In some embodiments, initial parameters of the long short-term memory network are determined, the initial parameters including the number of storage units, the number of network layers, the number of training times, the forget gate weight matrix, the input gate weight matrix, the output gate weight matrix, the unit state weight matrix, the forget gate bias term, the input gate bias term, the output gate bias term and the unit state bias term; the forget gate function, the input gate function, the output gate function and the unit state function are determined according to the initial parameters.

[0124] The forget gate function is:

[0125] f t =σ(W f [h t-1 ,x t ]+b f )

[0126] Among them, f t represents the forget gate, W f represents the forget gate weight matrix, [h t-1 ,x t ] represents the input signal of the previous layer output and the current layer input as a whole, b f represents the forget gate bias term, σ represents the sigmoid function;

[0127] The input gate function is: i t =σ(W i [h t-1 ,x t ]+b i )

[0128] Among them, i t represents the input gate, W i represents the input gate weight matrix, [h t-1 ,x t ] represents the input signal of the previous layer output and the current layer input as a whole, b i represents the input gate bias term, σ represents the sigmoid function;

[0129] The output gate function is:

[0130] o t =σ(W o .[h t-1 ,x t ]+b o )

[0131] Among them, t represents the output gate, W o represents the output gate weight matrix, [h t-1 ,x t ] represents the input signal of the previous layer output and the current layer input as a whole, b o represents the output gate bias term, σ represents the sigmoid function;

[0132] The cell state function is:

[0133] C t =f t *C t-1 +i t *C′ t

[0134] C′ t =tanh(W c .[h t-1 ,x t ]+b c )

[0135] Among them, C t represents the current unit state, f t represents the forget gate, C t-1 Indicates the unit state at the previous moment, i t represents the input gate, C′ t represents the current input unit state, tanh represents the tanh function, W c represents the unit state weight matrix, [h t-1 ,x t ] represents the input signal of the previous layer output and the current layer input as a whole, b c Represents the unit state bias term.

[0136] In the forward transmission process, the signal transmission process is controlled by controlling the gate control switch between adjacent storage units, which can be mainly divided into three categories, as follows:

[0137] 1) Forget gate: determines the cell state C at the previous moment t-1 How much information is still retained at the current time C t In the process, memory update of data is realized.

[0138] 2) Input gate: determines the input X of the network at the current moment t How much is saved to the cell state C t , to achieve the screening of input data and reduce the purpose of data input.

[0139] 3) Output gate: controls the cell state C t How many outputs are there to the current output value h of the LSTM t , reducing data output.

[0140] The forget gate can save information from a long time ago, normalize the output value through the σ function, and use the influence of the original information as an important reference to determine the propagation process of the current value, thereby achieving the purpose of memory updating.

[0141] The input gate can filter the current input data to prevent currently irrelevant content from entering the storage unit.

[0142] The unit state of the current input is calculated based on the previous output and this input; the unit state C at the current moment t Calculation: Based on the last cell state C t-1 Multiply the forget gate f element-wise t , and then use the current input unit state C t Element-wise multiplication of the input gate i t , and then add the two products: In this way, the current memory C t and long-term memory C t-1 Combined together, a new unit state C is formed t Due to the control of the forget gate, it can save information from a long time ago, and due to the control of the input gate, it can prevent currently irrelevant content from entering the storage unit.

[0143] The main function of the output gate is to control the influence of long-term memory on the current output. The output value h of the output gate t as follows:

[0144] h t =o t *tanh(C t )

[0145] In some embodiments, the alarm event time series sample data is input into a pre-built long short-term memory network to obtain an alarm root cause identification result, a loss value is determined based on the alarm root cause identification result and the alarm root cause label, and the parameters of the long short-term memory network are updated based on the loss value to obtain a trained alarm root cause identification model.

[0146] In some embodiments, the parameters of the long short-term memory network are optimized using a back propagation algorithm, including: forward calculation of the forget gate, input gate, output gate, and unit state of each storage unit; reverse calculation of the error term value of each storage unit based on the forget gate, input gate, output gate, and unit state; determining the first gradient of the forget gate weight matrix, the second gradient of the input gate weight matrix, the third gradient of the output gate weight matrix, and the fourth gradient of the unit state weight matrix based on the error term value; gradient updating the first gradient, the second gradient, the third gradient, and the fourth gradient, thereby optimizing the forget gate weight matrix, the input gate weight matrix, the output gate weight matrix, the unit state weight matrix, the forget gate bias term, the input gate bias term, the output gate bias term, and the unit state bias term. Specifically as follows:

[0147] 1) Determine the parameters: forward calculate the output value of each storage unit, a total of 4 variables (f t 、i t 、c' t , o t ), and the calculation method is shown in the above specific formula.

[0148] 2) Error calculation: Reversely calculate the error term value of each storage unit. Like RNN, the back propagation of LSTM error terms also includes two directions: one is the back propagation along time, that is, starting from the current time t, calculating the error term at each moment; the other is to propagate the error term to the upper layer.

[0149] 3) Gradient update: Calculate the gradient of each weight based on the corresponding error term.

[0150]

[0151] σ′(z)=y(1-y)

[0152] The activation function of the gate switch is defined as the sigmoid function, and the output activation function is the tanh function, and the derivatives are:

[0153]

[0154] tanh′(z)=1-y 2

[0155] The goal of network optimization is to learn 8 groups of parameters, including the weight matrix and bias term of the forget gate, the weight matrix and bias term of the input gate, the weight matrix and bias term of the output gate, and the weight matrix and bias term of the unit state.

[0156] The weight matrix W is composed of two matrices. The two parts use different formulas in back propagation. In the subsequent derivation, the weight matrix should also be written as two separate matrices [w fh ,w fx ].

[0157] In the reverse propagation of the error term along time, the error term at time t-1 is calculated as follows:

[0158]

[0159] Using h t and C t The definition of and the total derivative formula can give the formula for passing the error term forward to any k moment:

[0160]

[0161] In some embodiments, the back propagation algorithm is used to optimize and update the parameters of the long short-term memory network, and a trained alarm root cause identification model can be obtained after several iterations. The specific number of iterations can be preset, or the training is considered complete when the test set meets the accuracy requirement.

[0162] See also Figure 6 In some embodiments, step S103 may include but is not limited to steps S1031 to S1032:

[0163] Step S1031, matching the alarm root cause information in a preset self-healing strategy library to obtain a corresponding fault self-healing strategy;

[0164] Step S1032, determining alarm parameters according to the alarm root cause information, and determining a self-healing script template according to the fault self-healing strategy, and then parameterizing and instantiating the self-healing script template according to the alarm parameters through the template engine to obtain a fault self-healing task.

[0165] In some embodiments, the self-healing platform needs to configure the fault self-healing strategies corresponding to various alarm root causes in advance to form a self-healing strategy library; the alarm root cause information obtained according to the above steps is matched in the self-healing strategy library to obtain the corresponding fault self-healing strategy; the alarm parameters are determined according to the alarm root cause information, and the self-healing script template is determined according to the fault self-healing strategy. The self-healing script template is parameterized and instantiated according to the alarm parameters through the template engine to obtain the fault self-healing task.

[0166] See also Figure 7In some embodiments, step S104 may include but is not limited to steps S1041 to S1043:

[0167] Step S1041, adding the fault self-healing task to a preset first message queue;

[0168] Step S1042, asynchronously consuming the first message queue, and executing the fault self-healing task through the operation and maintenance orchestration tool to obtain the fault self-healing processing result;

[0169] Step S1043: Push the fault self-healing processing result to the preset alarm recipient.

[0170] In some embodiments, the message after the fault self-healing task is added to the Kafka queue, and the self-healing platform will consume the fault self-healing tasks in the Kafka queue in real time and asynchronously. For example, a critical alarm occurs in the pod memory of a system application, and the corresponding fault self-healing task is to expand the capacity of the alarm object. The fault self-healing task can be executed in real time by asynchronously consuming the Kafka queue, thereby realizing fault self-healing of cloud native applications.

[0171] In some embodiments, after the self-healing schedule is triggered, a corresponding self-healing task record will be generated, and a self-healing notification will be sent to the email address of the associated alarm recipient. The self-healing process can also be viewed in real time through the mobile official account.

[0172] It can be recognized that the embodiment of the present application performs data cleansing on the source alarm event to obtain the alarm event to be processed, performs alarm root cause analysis on the alarm event to be processed to obtain alarm root cause information, matches the fault self-healing strategy according to the alarm root cause information and generates a fault self-healing task, and implements the fault self-healing processing of the cloud native system according to the fault self-healing task, thereby improving the processing efficiency of cloud native application faults and ensuring the high availability and stability of the business system.

[0173] Compared with the prior art, the embodiments of the present application also have the following advantages:

[0174] 1) It can help operation and maintenance personnel improve efficiency in locating the root cause of application failures. Due to the automatic destruction of pod containers, operation and maintenance personnel cannot quickly analyze and locate the root cause. The fault self-healing system can match the associated self-healing package as soon as it receives an abnormal alarm from a cloud-native application to quickly analyze the abnormality and locate the root cause.

[0175] 2) Rapid recovery of application failures can be achieved to ensure business stability. By standardizing, streamlining, and scripting the handling solutions of operation and maintenance experts’ experience and abnormal emergency manuals, and arranging them into relevant self-healing packages, business can be quickly restored through self-healing processing when system abnormal alarms are triggered, greatly reducing the impact of failures and minimizing the company’s losses.

[0176] 3) It can improve the stability and reliability of business, improve the efficiency and quality of operation and maintenance work, and shorten the time for troubleshooting.

[0177] See also Figure 8 The embodiment of the present application also provides a cloud native application fault self-healing device, which can realize the above-mentioned cloud native application fault self-healing, and the cloud native application fault self-healing device includes:

[0178] The alarm event cleaning module is used to obtain the source alarm events in the current time period, perform data cleaning on the source alarm events, and obtain the alarm events to be processed;

[0179] The alarm root cause analysis module is used to analyze the alarm root cause of the alarm event to be processed and obtain the alarm root cause information;

[0180] A self-healing task generation module is used to match the corresponding fault self-healing strategy according to the alarm root cause information, and generate a fault self-healing task according to the alarm root cause information and the fault self-healing strategy;

[0181] The fault self-healing processing module is used to perform fault self-healing processing on the cloud native system according to the fault self-healing tasks.

[0182] The specific implementation of the cloud-native application fault self-healing device is basically the same as the specific implementation of the above-mentioned cloud-native application fault self-healing method, and will not be repeated here.

[0183] The embodiment of the present application also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned cloud native application fault self-healing method. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0184] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0185] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0186] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the cloud native application fault self-healing method of the embodiment of this application;

[0187] Input / output interface 903, used to implement information input and output;

[0188] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0189] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0190] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0191] See also Fig.10 , an embodiment of the present application also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs 1001, and the one or more programs 1001 can be executed by one or more processors to implement the above-mentioned cloud-native application fault self-healing method.

[0192] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0193] The cloud native application fault self-healing method and device, electronic device and storage medium provided in the embodiments of the present application obtain the source alarm event of the current time period, perform data cleaning on the source alarm event to obtain the alarm event to be processed, perform alarm root cause analysis on the alarm event to be processed to obtain alarm root cause information, match the corresponding fault self-healing strategy according to the alarm root cause information, generate a fault self-healing task according to the alarm root cause information and the fault self-healing strategy, and perform fault self-healing processing on the cloud native system according to the fault self-healing task. The embodiment of the present application performs data cleaning on the source alarm event to obtain the alarm event to be processed, performs alarm root cause analysis on the alarm event to be processed to obtain alarm root cause information, matches the fault self-healing strategy according to the alarm root cause information and generates a fault self-healing task, and implements fault self-healing processing of the cloud native system according to the fault self-healing task, thereby improving the processing efficiency of cloud native application faults and ensuring the high availability and stability of the business system.

[0194] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0195] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0196] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0197] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0198] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0199] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0200] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0201] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0202] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0203] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0204] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A cloud native application fault self-healing method, characterized in that: The method comprises: Acquire source alarm events in the current time period, perform data cleaning on the source alarm events, and obtain alarm events to be processed; Performing alarm root cause analysis on the alarm event to be processed to obtain alarm root cause information; Matching a corresponding fault self-healing strategy according to the alarm root cause information, and generating a fault self-healing task according to the alarm root cause information and the fault self-healing strategy; Perform fault self-healing processing on the cloud native system according to the fault self-healing task.

2. The cloud native application fault self-healing method according to claim 1, characterized in that: The step of performing data cleaning on the source alarm event to obtain the alarm event to be processed includes: Determine the alarm field information of the source alarm event, and determine the application name, alarm type and alarm time corresponding to the source alarm event according to the alarm field information; Filter the source alarm event according to a preset alarm filtering rule, the application name, and the alarm type to obtain a first alarm event; Classifying the first alarm event according to the application name to obtain second alarm events corresponding to multiple target applications, and deduplicating the second alarm event according to the alarm type and the alarm time to obtain third alarm events corresponding to multiple target applications; Field standardization is performed on the third alarm event to obtain the to-be-processed alarm events corresponding to multiple target applications.

3. The cloud native application fault self-healing method according to claim 1, characterized in that: The step of analyzing the root cause of the alarm event to be processed to obtain the root cause information of the alarm includes: Determine the alarm node and alarm time of each of the alarm events to be processed, and determine the node call relationship between the alarm nodes; Determine the event association relationship between the to-be-processed alarm events according to the alarm time, the alarm node and the node calling relationship; Generate an alarm event map according to the alarm event to be processed and the event association relationship, and extract alarm event time series feature data according to the alarm event map; The alarm event time series feature data is input into a pre-trained alarm root cause identification model to obtain the alarm root cause information.

4. The cloud native application fault self-healing method according to claim 3 is characterized in that: The generating an alarm event graph according to the alarm event to be processed and the event association relationship, and extracting alarm event time series feature data according to the alarm event graph, includes: Taking the to-be-processed alarm event as an event node, determining the directed edges between the event nodes according to the event association relationship, and obtaining the alarm event graph; Determine the number of associated nodes of each of the event nodes in the alarm event graph, and determine a plurality of key event nodes according to the number of associated nodes; Performing a path search on the alarm event graph according to the key event nodes to obtain the shortest path including all the key event nodes; A plurality of target alarm events corresponding to the shortest path are determined, and the target alarm events are sorted according to the shortest path to obtain the alarm event time series feature data.

5. The cloud native application fault self-healing method according to claim 3, characterized in that: The alarm root cause identification model is trained by the following steps: Acquire a plurality of preset alarm event time series sample data, and determine the alarm root cause label corresponding to each of the alarm event time series sample data through manual labeling; Inputting the alarm event time series sample data into a pre-built long short-term memory network to obtain an alarm root cause identification result; Determine a loss value according to the alarm root cause identification result and the alarm root cause label; The parameters of the long short-term memory network are updated according to the loss value to obtain the trained alarm root cause identification model.

6. The cloud native application fault self-healing method according to claim 1, characterized in that: The matching of the corresponding fault self-healing strategy according to the alarm root cause information, and generating a fault self-healing task according to the alarm root cause information and the fault self-healing strategy, includes: Matching the alarm root cause information in a preset self-healing strategy library to obtain the corresponding fault self-healing strategy; Alarm parameters are determined according to the alarm root cause information, and a self-healing script template is determined according to the fault self-healing strategy. Then, the self-healing script template is parameterized and instantiated according to the alarm parameters by a template engine to obtain the fault self-healing task.

7. The cloud native application fault self-healing method according to any one of claims 1 to 6, characterized in that: The performing fault self-healing processing on the cloud native system according to the fault self-healing task includes: Adding the fault self-healing task to a preset first message queue; Asynchronously consuming the first message queue, and executing the fault self-healing task through an operation and maintenance orchestration tool to obtain a fault self-healing processing result; The fault self-healing processing result is pushed to a preset alarm recipient.

8. A cloud native application fault self-healing device, characterized in that: The device comprises: The alarm event cleaning module is used to obtain the source alarm events in the current time period, perform data cleaning on the source alarm events, and obtain the alarm events to be processed; An alarm root cause analysis module is used to analyze the alarm root cause of the alarm event to be processed to obtain alarm root cause information; A self-healing task generation module, used to match the corresponding fault self-healing strategy according to the alarm root cause information, and generate a fault self-healing task according to the alarm root cause information and the fault self-healing strategy; The fault self-healing processing module is used to perform fault self-healing processing on the cloud native system according to the fault self-healing task.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the cloud-native application fault self-healing method as described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the cloud-native application fault self-healing method as described in any one of claims 1 to 7.

Images