Application component analysis method and related device

Abstract

The invention provides an application component analysis method and a related device. In response to fault alarm information of a service system, determining a first type of application components associated with the fault alarm information; based on an application component topology network, determining a second type of application components having a topology connection relationship with the first type of application components, forming a to-be-analyzed application component set of the service system by the first type of application components and the second type of application components, determining component operation indexes corresponding to a preset detection strategy, and sending the to-be-analyzed application component set to the service system, according to the component operation indexes and the exception judgment standard of the component operation indexes, performing exception judgment on the value change condition of the component operation indexes of the to-be-analyzed application component based on the exception judgment standard to obtain a judgment result of the to-be-analyzed application component. By adopting the embodiment of the invention, the analysis accuracy and the analysis efficiency can be improved.

Description

Technical Field

[0001] Multiple embodiments of the present specification relate to the field of information technology, and more particularly, to an analysis method for application components and related devices. Background Art

[0002] An application component can be understood as a program component, which is the basic functional unit that the business system relies on to run. Sometimes, a business system fails, and it is necessary to locate the application component that caused the failure (that is, the abnormal application component) in time for repair. Based on this, a more efficient application component analysis method is needed. Summary of the invention

[0003] According to a first aspect of multiple embodiments of this specification, a method for analyzing an application component is provided, comprising:

[0004] In response to fault alarm information of the business system, determining a first type of application component associated with the fault alarm information;

[0005] Based on the application component topology network, determine a second type of application component that has a topological connectivity relationship with the first type of application component, and form a set of application components to be analyzed of the business system with the first type of application component and the second type of application component;

[0006] Determine the component operation indicators corresponding to the preset detection strategy, and the abnormality judgment criteria of the component operation indicators;

[0007] Based on the abnormality judgment standard, an abnormality judgment is performed on the value change of the component operation indicator of the application component to be analyzed to obtain a judgment result of the application component to be analyzed.

[0008] According to a second aspect of multiple embodiments of this specification, an analysis device for an application component is provided, comprising:

[0009] A determination module, configured to determine, in response to the fault alarm information of the business system, a first type of application component associated with the fault alarm information;

[0010] The determination module is used to determine, based on the application component topology network, a second type of application component that has a topological connectivity relationship with the first type of application component, and form a set of application components to be analyzed of the business system with the first type of application component and the second type of application component;

[0011] The determination module is further used to determine the component operation index corresponding to the preset detection strategy, and the abnormality judgment standard of the component operation index;

[0012] The judgment module is used to make an abnormal judgment on the value change of the component operation indicator of the application component to be analyzed based on the abnormal judgment standard, and obtain the judgment result of the application component to be analyzed.

[0013] According to a third aspect of multiple embodiments of this specification, a computer program product is proposed, which implements the method described in the first aspect when running.

[0014] According to a fourth aspect of multiple embodiments of the present specification, a computing device is proposed, including a memory and a processor; the memory is used to store computer instructions that can be executed on the processor, and the processor is used to implement the method described in the first aspect when executing the computer instructions.

[0015] According to a fifth aspect of multiple embodiments of the present specification, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method described in the first aspect is implemented.

[0016] In the technical solution provided in the present disclosure, a technical solution for analyzing application components is provided that does not rely on manual work. Specifically, a detection strategy (i.e., a preset detection strategy) is set in advance, and component operation indicators and abnormality judgment criteria corresponding to the component operation indicators are set corresponding to the preset detection strategy. If a fault alarm information of a business system appears, a first-category application component associated with the fault alarm information and at least one second-category application component topologically connected to the first-category application component can be determined, and the first-category application component and the second-category application component form a set of application components to be analyzed. For each application component to be analyzed, according to the abnormality judgment criteria corresponding to the component operation indicators of the application component to be analyzed, an abnormality judgment is performed on the value change of the component operation indicator of the application component to be analyzed, and a judgment result of the application component to be analyzed is obtained. The judgment result can be used to indicate whether there is an abnormality or no abnormality in the component operation indicator of the application component to be analyzed.

[0017] Through the above technical solution, when a fault alarm occurs in the business system, the component operation indicators of the application component associated with the fault alarm and the application component topologically connected to the application component can be automatically analyzed to determine the application component that caused the fault alarm in the business system. On the one hand, the efficiency of the analysis method of the application component to be analyzed is improved, and on the other hand, since the judgment result of the application component to be analyzed is not the result of manual experience judgment, but a relatively more accurate automatic analysis result, the accuracy of the analysis method of the application component is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of an analysis method for an application component is exemplarily provided.

[0019] Figure 2 An exemplary implementation framework diagram of the technical solution provided by the present disclosure is provided.

[0020] Figure 3 A schematic structural diagram of an analysis device for an application component is exemplarily provided.

[0021] Figure 4 It is a structural schematic diagram of a computing device provided by the present disclosure.

[0022] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. The number of any element in the drawings is for example rather than limitation, and any naming is only for distinction and does not have any limiting meaning. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0024] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0025] The application component described in the present disclosure can be understood as a program component, which is a basic functional unit on which the business system depends. For example, the basic functional units such as application modules, middleware, and databases on which the business system depends can all be the above-mentioned application components. The application components that the business system depends on will form an application component topology network, and several application components with topological connectivity can cooperate with each other to realize a certain business function.

[0026] If one or more application components have abnormal conditions (such as code bugs), it may cause the business system to fail. In order to troubleshoot the business system, it is necessary to locate the abnormal application components that cause the business system to fail and repair them.

[0027] When the monitoring module of the business system finds a business system failure, it will output a fault alarm message, and the fault alarm message is usually associated with one or more application components, which are usually the core application components that the business functions currently being implemented by the business system rely on. For the convenience of description, this article refers to the application components associated with the fault alarm message as first-class application components. It is easy to understand that the first-class application components are not necessarily the application components that actually cause the business system failure. The application components that cause the business system failure may also be other application components that are topologically connected to the first-class application components (for the convenience of description, this article refers to them as second-class application components). Therefore, for a fault alarm of the business system, the corresponding first-class application components and second-class application components constitute the application components to be analyzed that need to be analyzed for abnormality.

[0028] In some implementations, based on business experience, human beings perform abnormal analysis on application components in the application components to be analyzed one by one to determine abnormal application components in the application components to be analyzed. However, this approach is inefficient, and because it relies on human business experience, its accuracy cannot be guaranteed, and it is easy for an application component to be misjudged as an abnormal application component, or for a truly abnormal application component to be missed.

[0029] The present disclosure provides a method for analyzing application components automatically (not relying on manual work), which may specifically include: presetting a detection strategy (i.e., a preset detection strategy), setting component operation indicators and abnormality judgment criteria corresponding to the component operation indicators corresponding to the preset detection strategy. If a fault alarm information of a business system appears, a first-category application component associated with the fault alarm information and at least one second-category application component topologically connected to the first-category application component can be determined, and the first-category application component and the second-category application component form a set of application components to be analyzed. For each application component to be analyzed, according to the abnormality judgment criteria corresponding to the component operation indicators of the application component to be analyzed, an abnormality judgment is performed on the value change of the component operation indicators of the application component to be analyzed, and a judgment result of the application component to be analyzed is obtained. The judgment result indicates whether there is an abnormality or no abnormality in the operation indicator of the application component to be analyzed.

[0030] Through the above method, when a fault alarm occurs in the business system, the component operation indicators of the application component associated with the fault alarm and the application component topologically connected to the application component can be automatically analyzed to facilitate the determination of the application component that causes the fault alarm in the business system. On the one hand, it does not rely on manual analysis of the application components, but rather automatic analysis, and narrows the scope of application components that need to be analyzed. It is not all application components, but is limited to the first application component associated with the fault alarm information and the second application component topologically connected to the first application component. Therefore, the efficiency of the analysis method of the application component to be analyzed is improved. On the other hand, since the judgment result of the application component to be analyzed is not the result of manual experience judgment, but a relatively more accurate automatic analysis result, the accuracy of the analysis method of the application component is improved.

[0031] The following describes in detail the application component analysis method provided by the present disclosure in conjunction with the accompanying drawings.

[0032] Figure 1 An exemplary flow chart of an analysis method for an application component is provided, comprising the following steps:

[0033] S100: In response to fault alarm information of a business system, determine a first type of application component associated with the fault alarm information.

[0034] The one or more first-category application components associated with the fault alarm information are usually core application components that the business functions currently being implemented by the business system rely on.

[0035] S102: Based on the application component topology network, determine a second type of application component that has a topological connectivity relationship with the first type of application component.

[0036] It should be noted that the number of the second type of application components having a topological connectivity relationship with the first type of application components can be one or more.

[0037] S104: The first type of application components and the second type of application components form a set of application components to be analyzed of the business system.

[0038] In the application component topology network, some application components may have a topological connectivity relationship. It should be noted that if two application components are adjacent in the topological connectivity network, or the two application components can be connected through at least one other application component, then the two application components can be considered to have a topological connectivity relationship.

[0039] In an application component topology network, multiple application components having a topological connectivity relationship can form an application component link, and the application component link can realize a certain business function.

[0040] It is easy to understand that the failure of the business system is not necessarily caused by the first-class application component associated with the fault alarm information, but may also be caused by other application components (second-class application components) that are topologically connected to the first-class application component. Therefore, it is necessary to form a set of application components to be analyzed by combining the first-class application components of the business system and the second-class application components that are topologically connected to the first-class application components, that is, the set of application components to be analyzed is a set of first-class application components and second-class application components corresponding to the business system to be analyzed, and perform abnormal analysis on each application component to be analyzed in the set of application components to be analyzed. It can be understood that the second-class application component can be an application component that is only related to the current business system, or it can be an application component that exists in multiple business systems. In different business systems, the functions implemented or the effects provided by the second-class application component can be different. There is a corresponding relationship between the second-class application component and each business system. When any business system calls the second-class application component, the second-class application component can know what function to implement or what operation to perform based on the corresponding relationship.

[0041] S106: Determine a component operation indicator corresponding to a preset detection strategy, and an abnormality judgment standard corresponding to the component operation indicator.

[0042] In order to realize automatic abnormal analysis of the application component to be analyzed, a detection strategy needs to be preset. As an example, the preset detection strategy can set one or more component operation indicators and set the abnormal judgment standard corresponding to each component operation indicator.

[0043] As an example, the component operation indicator includes at least one of the following: service request and response time; service request and response time; service query rate QPS; error rate; resource utilization; CPU occupancy; memory occupancy; disk input and output I / O; traffic.

[0044] In addition, in addition to the above indicators, component operation indicators can also include component operation indicators customized according to the business characteristics of the business system. For example, when the business system is a financial business system, the customized component operation indicator can be the amount of funds processed, etc.

[0045] The abnormality judgment standard corresponding to the component operation index is used to judge whether the value change of the component operation index (usually the value change within a unit time window) is abnormal. The value change of the component operation index can be a continuous value or multiple discrete values.

[0046] S108: Based on the abnormality judgment standard, perform abnormality judgment on the value change of the component operation indicator of the application component to be analyzed, and obtain the judgment result of the application component to be analyzed.

[0047] The judgment result may indicate whether the application component to be analyzed is abnormal or normal in terms of component operation indicators. It is easy to understand that the value changes of component operation indicators of the same component in different sets of application components to be analyzed are not necessarily the same, that is, different business systems may have the same components, and the values ​​of component operation indicators of these same components in different business systems may be different. For each application component to be analyzed, based on the abnormal judgment standard corresponding to the component operation indicator of the application component to be analyzed, an abnormal judgment is made on the value changes of the component operation indicator of the application component to be analyzed.

[0048] After obtaining the judgment result corresponding to the value change of the component operation index of the application component to be analyzed, the prompt information corresponding to the application component to be analyzed can be further determined according to the judgment result of the application component to be analyzed. The prompt information here is used to prompt whether a component operation index of the application component to be analyzed is abnormal or normal.

[0049] As an example, the number of component operation indicators can be multiple, and whether the application component to be analyzed is abnormal can be judged based on the number of abnormal component operation indicators corresponding to the application component to be analyzed, that is, the more the number of corresponding component operation indicator abnormalities, the greater the possibility that the application component to be analyzed is abnormal.

[0050] It should also be noted that after determining the prompt information corresponding to the application components to be analyzed in all sets based on the judgment results, the technical personnel responsible for troubleshooting the business system can narrow the scope of abnormal application components that need to be located based on the prompt information corresponding to the application components to be analyzed. For some application components with obviously lower abnormal possibilities, manual analysis is not performed, thereby improving the efficiency and accuracy of manual abnormal analysis of application components.

[0051] In some embodiments, before making an abnormality judgment on the value of each component operation indicator of the application component to be analyzed, the technical operation data of the business system corresponding to the application component (the application component includes the above-mentioned application component to be analyzed and the application component not to be analyzed, or the application component only includes the application component to be analyzed, that is, before performing the abnormality analysis, only some data of the application component to be analyzed can be collected for subsequent analysis; or before performing the abnormality analysis, the data of all application components of the business system can be collected and stored. After the application component to be analyzed is determined, the data of the application component to be analyzed is read from the storage for analysis) is collected, and the business operation data of the business system is collected using a custom plug-in. Based on the technical operation data, the business operation data and the performance-related data of the application component, the value changes of the component operation indicators of the application component are determined. The value changes of the component operation indicators of each application component are stored in the distributed full-text search engine ES.

[0052] As an example, you can use netedata to collect technical and business operation data of business systems (servers or virtual machines). Use custom plug-ins to collect performance-related data for each application component to be analyzed in the business system. It should be noted that Netdata is a real-time performance monitoring tool for Linux. Netdata is a real-time performance monitoring tool for Linux systems that provides an interface perspective of the web interface. In this way, you can clearly understand the current status of the system and applications. Netdata works by monitoring the performance of the server through agents running on the server. These agents collect the performance data of the server and send it to the netdata application for analysis.

[0053] When deploying the application components of the business system, you can start the pinpoint agent and access pinpoint through the agent to collect performance-related data of the application components. Pinpoint is an APM monitoring tool and a full-link analysis tool open source on GitHub, providing non-intrusive call chain monitoring, method execution details viewing, application status information monitoring and other functions. The basic data structures are: Span: The basic unit of RPC tracing, which represents the work processed when the RPC arrives and contains tracing data. Span marks the child items with SpanEvent as a data structure, and each Span contains a TraceId. Trace: A series of spans composed of related RPCs (Spans). Spans in the same trace share the same TransactionId. Trace is sorted into a hierarchical tree structure by SpanIds and ParentSpanIds. TraceId: A key set consisting of TransactionId, SpanId, and ParentSpanId. TransactionId represents the message id, and SpanId and ParentSpanId represent the RPC parent-child relationship. Pinpoint collector is a data collection module.

[0054] The business system's message channel MQ can output the above technical operation data, business operation data, and performance-related data of each application component through Kafka. Kafka is an open source stream processing platform developed by the Apache Software Foundation. Kafka is a high-throughput distributed publish-subscribe messaging system that can process all action stream data of consumers on the website.

[0055] Flink can add source operators to consume data transmitted by Kafka. Specifically, the value change of each component operation indicator of each application component can be determined based on the technical operation data, the business operation data and the performance-related data of each application component. Usually, a unit time window (such as one minute) is set, and the value change of each component operation indicator of each application component in the unit time window is determined based on the technical operation data, the business operation data and the performance-related data of each application component in the unit time window.

[0056] Flink can be used to store the value changes of each component's operating indicators in ES. ES is an open source, highly available, and highly scalable distributed full-text search engine that can provide PB-level near-real-time data storage and retrieval capabilities. It is based on Lucene as its core processing component and is encapsulated on top of it. It provides multi-language APIs and Resutful APIs to hide the complexity of Lucene. It is currently the most popular enterprise-level search engine.

[0057] In some embodiments, the preset detection strategy is also used to set the ES query configuration. In this way, based on the ES query configuration, the value change of each component operation indicator of the application component to be analyzed can be obtained from the ES. The ES query configuration here can specifically include setting the ES cluster, indicator index, indicator name metric, adding filtering conditions, setting the query time range, specifying the aggregation method, etc.

[0058] In addition, in some embodiments provided by the present disclosure, the abnormality level corresponding to the application component to be analyzed can be determined according to the prompt information corresponding to the application component to be analyzed, and different display styles can be associated with different abnormality levels. A schematic diagram of the application topology network can also be displayed, and the display style associated with the abnormality level corresponding to the application component to be analyzed can be used in the schematic diagram to display the identification shape corresponding to the application component to be analyzed.

[0059] For example, different colors may be associated with different abnormality levels. A schematic diagram of the application topology network may be presented to a user (e.g., a technician). In the schematic diagram, the identification shape corresponding to the application component to be analyzed is painted with the color associated with the abnormality level corresponding to the application component to be analyzed.

[0060] The present disclosure does not specifically limit the method for determining whether the value change of the component operation indicator is abnormal. Here, two determination methods are provided as examples:

[0061] Method 1: Perform a separate judgment on a single application component to be analyzed in the set of application components to be analyzed.

[0062] Assume that the number of component operation indicators is N, where N is an integer greater than 1; the abnormal judgment criteria include whether the value of the component operation indicator is within the normal variation range. An application component to be analyzed and the value variation of each component operation indicator are respectively composed of an analysis pair, and a total of N analysis pairs are generated for one application component. According to whether the value of the component operation indicator in the analysis pair is within the normal variation range of the component operation indicator of the analysis pair, determine whether the analysis pair is an abnormal analysis pair or a normal analysis pair, that is, if the component operation indicator in the analysis pair is within the normal variation range, the analysis pair is a normal analysis pair, otherwise it is an abnormal analysis pair. The judgment result of the target application component to be analyzed is generated based on the abnormal analysis pair and the normal analysis pair.

[0063] For the abnormal analysis pair, the abnormal degree of the component operation indicator in the abnormal analysis pair is determined according to the relationship between the actual value of the component operation indicator in the abnormal analysis pair and the preset normal change interval, and the preset normal change interval refers to the preset normal change interval of the component operation indicator in the abnormal analysis pair. According to the abnormal degree of the component operation indicator in the abnormal analysis pair and the number of the abnormal analysis pairs, the prompt information of the abnormal operation indicator of the component in the abnormal analysis pair is determined.

[0064] For the normal analysis pair, a prompt message is generated indicating that the component operation index in the normal analysis pair is normal. The prompt message of the application component to be analyzed includes the prompt message of the component operation index in the corresponding abnormal analysis pair and the normal analysis pair.

[0065] It can be understood that if there are Y application components in the set of application components to be analyzed, N times Y analysis pairs are generated. An abnormality judgment is performed on the value changes of the component operation indicators in the analysis pairs of each application component to be analyzed to obtain the judgment result of the application component to be analyzed.

[0066] In some implementations, the value change of each component operation indicator of the application component to be analyzed may also be analyzed. It is determined whether each component operation indicator of the application component to be analyzed is within the normal change interval of the corresponding component operation indicator. For abnormal component operation indicators that are not within the normal change interval, the abnormal degree of the abnormal component operation indicator is determined based on the relative relationship between the abnormal component operation indicator and the normal change interval. Then, the prompt information of the application component to be analyzed is determined based on the abnormal degree of the abnormal component operation indicator in the application component to be analyzed and the number of abnormal component operation indicators of the application component to be analyzed.

[0067] For example, suppose there are three application components A, B, and C to be analyzed, and three component operation indicators 1, 2, and 3. Then, A-1, A-2, A-3, B-1, B-2, B-3, C-1, C-2, and C-3 need to be analyzed. The normal change interval corresponding to the component operation indicator can be a 3-sigma interval determined based on the historical value changes of the component operation indicator. The abnormal degree corresponding to the abnormal component operation indicator can be determined based on the degree to which the abnormal operation indicator exceeds the 3-sigma interval. The greater the degree of excess, the greater the degree of abnormality.

[0068] In some embodiments, the number of abnormal component operation indicators of each application component to be analyzed is determined, and the number is multiplied by the abnormal degree of each abnormal component operation indicator of the corresponding application component to be analyzed (to achieve an amplification effect) to obtain the amplified abnormal degree of each abnormal component operation indicator of the application component to be analyzed. The amplified abnormal degrees of the abnormal component operation indicators of all application components to be analyzed are sorted. If the amplified abnormal degrees corresponding to the operation indicators of two components are the same, the abnormal component operation indicator collected earlier is sorted first. In this way, the prompt information corresponding to each application component to be analyzed can be determined based on this sorting result.

[0069] For example, if we sort by large to small, the result is A-1, B-1, A-2, C-1, C-2, A-3, B-2, B-3, C-3. Then, we can determine that A has the highest probability of being an abnormality, B has the lowest probability, and C has a probability of being an abnormality between A and B.

[0070] Method 2: Comprehensively judge multiple topologically connected application components to be analyzed in the set of application components to be analyzed.

[0071] The abnormal judgment standard of the component operation index includes whether there is an application component to be analyzed that is outlier from the application component link. According to the upstream and downstream relationship of the application component to be analyzed in the application component set in the application component topology network, at least one application component link is determined; wherein each application component link is composed of several application components with upstream and downstream relationships. The feature vector of each application component in the application component set to be analyzed is determined according to the value change of the corresponding component operation index. Outlier analysis is performed on the feature vector of the application component to be analyzed in the application component link to determine the outlier feature vector, and the application component to be analyzed corresponding to the outlier feature vector is determined as the outlier application component. According to the outlier application components in the application component link, the judgment result of each application component to be analyzed in the application component link is generated. In an application component link, once the outlier application component is determined, the non-outlier application components in the application component link are also determined, so that the judgment result of each application component to be analyzed in the application component link can be generated according to the outlier application component and non-outlier application component information.

[0072] It should be noted that the judgment result of an application component to be analyzed may include in which application component links the application component to be analyzed is judged to be an outlier application component, and in which application component links the application component to be analyzed is judged to be a normal application component. For example, an application component A to be analyzed may be in different application component links Ha, Hb, and Hc. The application component A to be analyzed is an outlier application component in the application component links Ha and Hb, and a normal application component in the application component link Hc. Then the judgment result of the application component A to be analyzed includes the judgment result that the application component A to be analyzed is judged to be an outlier in the application component links Ha and Hb, respectively, and the judgment result that the application component A to be analyzed is judged to be normal in the application component link Hc.

[0073] The number of times the application component to be analyzed is identified as an outlier can be counted according to the judgment result of the application component to be analyzed. According to the number of times the application component to be analyzed is identified as an outlier, the prompt information corresponding to the application component to be analyzed is determined, and the prompt information corresponding to each application component to be analyzed is positively correlated with the number of times the application component to be analyzed is identified as an outlier.

[0074] In addition, at least one application component link can also be determined based on the upstream and downstream relationship of the application component to be analyzed in the application component topology network; wherein the application component link is composed of several application components to be analyzed with upstream and downstream relationships, and any application component to be analyzed in the set of application components to be analyzed is included in at least one application component link.

[0075] For each application component link, perform the following steps:

[0076] For each component operation indicator, determine the characteristic vector corresponding to the value change of the component operation indicator of each application component to be analyzed in the application component link; perform outlier analysis on the characteristic vectors corresponding to the application components to be analyzed to determine the outlier characteristic vectors; identify the application components to be analyzed corresponding to the outlier characteristic vectors as outlier application components.

[0077] It should be noted here that the corresponding feature vector of the application component to be analyzed can be determined based on the frequency corresponding to the value change of the component operation indicator (based on FFT), the trend sequence after k-MA, the standard deviation after minmax-scaler, the kurtosis, etc.

[0078] According to the number of times the application component to be analyzed is identified as an outlier, the prompt information corresponding to the application component to be analyzed is determined. For example, the more times the application component to be analyzed is identified as an outlier, the greater the possibility of abnormality corresponding to the application component to be analyzed.

[0079] In addition, in some embodiments, at least one application component to be analyzed that meets the preset abnormality standard can be determined as an abnormal application component according to the prompt information corresponding to the application component to be analyzed; for the abnormal application component, all application components that are reachable to the abnormal application component with M (M is greater than or equal to 1) degrees in the application component topology network are determined as adjacent application components associated with the abnormal application component; based on the value change of each component operation indicator of each adjacent application component associated with the abnormal application component, the future value change of each component operation indicator of the abnormal application component is predicted. The prediction model used here can be a quadratic linear regression model.

[0080] It should be noted that if the number of all application components reachable by the abnormal application component with degree M in the application component topology network is too large (for example, more than 20), the PCA dimensionality reduction method can be used to reduce the amount of data that needs to be processed (the value change of each component operation indicator of each adjacent application component).

[0081] It should also be noted that the above-mentioned predicted future value changes usually refer to the value changes within a unit time length (such as 1 hour) in the future.

[0082] The predicted future value changes of each abnormal application component and performance indicator can be pushed to the technical staff of the business system for reference.

[0083] Figure 2 An exemplary implementation framework diagram of the technical solution provided by the present disclosure is provided. Figure 2As shown, the fault alarm information of the business system will trigger the automated analysis process. Read the first type of application components associated with the fault alarm information, and read the second type of application components that are topologically connected to the first type of application components, and form the first type of application components and the second type of application components into a set of application components to be analyzed. Traverse the application components in the set of application components to be analyzed, and make an abnormal judgment on the value changes of each component operating indicator of the application component to be analyzed based on the preset detection strategy. According to the judgment result corresponding to the value changes of each component operating indicator of the application component to be analyzed, determine the abnormal prompt information corresponding to the application component to be analyzed.

[0084] The present disclosure also provides an analysis device for an application component, see Figure 3 As shown, the device comprises:

[0085] A determination module 301, configured to determine, in response to the fault alarm information of the business system, a first type of application component associated with the fault alarm information;

[0086] The determination module 301 is used to determine, based on the application component topology network, a second type of application component that has a topological connectivity relationship with the first type of application component, and form a set of application components to be analyzed of the business system with the first type of application component and the second type of application component;

[0087] The determination module 301 is further used to determine the component operation index corresponding to the preset detection strategy, and the abnormality judgment standard of the component operation index;

[0088] The judgment module 302 is used to make an abnormal judgment on the value change of the component operation indicator of the application component to be analyzed based on the abnormal judgment standard, and obtain the judgment result of the application component to be analyzed.

[0089] The present disclosure also provides a computer program product, which executes the method of the embodiment of the present disclosure when running.

[0090] The present disclosure also provides a computer-readable storage medium having a computer program stored thereon, and the program, when executed by a processor, implements the method of the embodiment of the present disclosure.

[0091] The present disclosure also provides a computing device, including a memory and a processor; the memory is used to store computer instructions that can be executed on the processor, and the processor is used to implement the method of the embodiment of the present disclosure when executing the computer instructions.

[0092] Figure 4 It is a structural diagram of a computing device provided by the present disclosure. The computing device 15 may include but is not limited to: a processor 151, a memory 152, and a bus 153 connecting different system components (including the memory 152 and the processor 151).

[0093] The memory 152 stores computer instructions, which can be executed by the processor 151, so that the processor 151 can execute the method of any embodiment of the present disclosure. The memory 152 may include a random access memory unit RAM 1521, a cache memory unit 1522 and / or a read-only memory unit ROM 1523. The memory 152 may also include: a program tool 1525 having a set of program modules 1524, the program modules 1524 include but are not limited to: an operating system, one or more application programs, other program modules and program data, and one or more combinations of these program modules may include the implementation of a network environment.

[0094] The bus 153 may include, for example, a data bus, an address bus, and a control bus. The computing device 150 may also communicate with an external device 155 through an I / O interface 154, and the external device 155 may be, for example, a keyboard, a Bluetooth device, etc. The computing device 150 may also communicate with one or more networks through a network adapter 156, for example, the network may be a local area network, a wide area network, a public network, etc. As shown in the figure, the network adapter 156 may also communicate with other modules of the computing device 15 through the bus 153.

[0095] In addition, although the operations of the disclosed method are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0096] Although the spirit and principle of the present disclosure have been described with reference to several specific embodiments, it should be understood that the present disclosure is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present disclosure is intended to cover various modifications and equivalent arrangements included in the spirit and scope of the attached claims.

[0097] The methods described in the above embodiments can be implemented by a computer chip or entity, or by a product with a certain function. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0098] For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing this specification, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0099] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0102] The terms used in the multiple embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit the multiple embodiments of this specification. The singular forms of "a", "said" and "the" used in the multiple embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0103] It should be understood that although the terms first, second, third, etc. may be used to describe various information in multiple embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of multiple embodiments of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0104] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the method embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The method embodiment described above is merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the functions of each module can be implemented in the same one or more software and / or hardware when implementing the embodiment scheme of this specification. It is also possible to select some or all of the modules according to actual needs to achieve the purpose of the embodiment scheme. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0105] The above description is only a preferred embodiment of the multiple embodiments of this specification and is not intended to limit the multiple embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the multiple embodiments of this specification should be included in the scope of protection of the multiple embodiments of this specification.

Claims

1. A method for analyzing an application component, characterized in that: include: In response to fault alarm information of the business system, determining a first type of application component associated with the fault alarm information; Based on the application component topology network, determine a second type of application component that has a topological connectivity relationship with the first type of application component, and form a set of application components to be analyzed of the business system with the first type of application component and the second type of application component; Determine the component operation indicators corresponding to the preset detection strategy, and the abnormality judgment criteria of the component operation indicators; Based on the abnormality judgment standard, an abnormality judgment is performed on the value change of the component operation indicator of the application component to be analyzed to obtain a judgment result of the application component to be analyzed.

2. The method according to claim 1, characterized in that: in, The component operation indicator includes at least one of the following: Service request and response time; service query rate; number of errors; resource utilization; CPU usage; memory usage; disk input and output; traffic.

3. The method according to claim 1, characterized in that The number of the component operation indicators is N, where N is a positive integer, and the abnormality judgment standard includes whether the value of the component operation indicator is within a normal variation range; Based on the abnormality judgment standard, abnormality judgment is performed on the value change of the component operation indicator of the application component to be analyzed, and the judgment result of the application component to be analyzed is obtained, including: For each application component to be analyzed, the application component to be analyzed and the value change of each component operation indicator respectively form an analysis pair, and N analysis pairs are obtained; For each analysis pair, the analysis pair is divided into an abnormal analysis pair or a normal analysis pair according to whether the value of the component operation indicator in the analysis pair matches the normal variation interval of the component operation indicator in the analysis pair; A judgment result of the application component to be analyzed is generated based on the obtained abnormal analysis pair and normal analysis pair.

4. The method according to claim 3, characterized in that The method further includes: determining prompt information of the application component to be analyzed according to the judgment result of the application component to be analyzed; The step of determining prompt information of the application component to be analyzed according to the judgment result of the application component to be analyzed includes: For the abnormal analysis pair, determining the abnormal degree of the component operation indicator in the abnormal analysis pair according to the relationship between the value of the component operation indicator in the abnormal analysis pair and the preset normal variation interval; generating prompt information indicating that the component operation indicator in the abnormal analysis pair is abnormal according to the abnormal degree of the component operation indicator in the abnormal analysis pair and the number of the abnormal analysis pairs; For a normal analysis pair, a prompt message is generated indicating that the component operation indicators in the normal analysis pair are normal.

5. The method according to claim 1, characterized in that: The abnormality judgment criteria of the component operation index include whether the application component to be analyzed is an outlier application component in an application component link; The abnormality judgment is performed on the value change of the component operation indicator of the application component to be analyzed based on the abnormality judgment standard to obtain the judgment result of the application component to be analyzed, including: Determine at least one application component link according to the upstream and downstream relationship of the application component to be analyzed in the application component topology network; wherein each application component link is composed of a number of application components to be analyzed having an upstream and downstream relationship; Determining a feature vector of the application component to be analyzed based on a change in a value of a component operation indicator of the application component to be analyzed; For each application component link, perform outlier analysis on the feature vectors of the application component to be analyzed in the application component link, determine the outlier feature vectors, and determine the application component to be analyzed corresponding to the outlier feature vector as the outlier application component in the application component link; According to the outlier application components in the application component chain, a judgment result of each application component to be analyzed in the application component chain is generated.

6. The method according to claim 5, characterized in that The method further includes: determining prompt information corresponding to the application component to be analyzed according to the judgment result of the application component to be analyzed; The step of determining prompt information corresponding to the application component to be analyzed according to the judgment result of the application component to be analyzed includes: According to the judgment result of the application component to be analyzed, the number of times the application component to be analyzed is identified as an outlier application component is counted; According to the number of times the application component to be analyzed is identified as an outlier application component, prompt information corresponding to the application component to be analyzed is determined, and the prompt information corresponding to the application component to be analyzed is positively correlated with the number of times the application component to be analyzed is identified as an outlier.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: According to the prompt information of the application component to be analyzed, the application component to be analyzed that meets the preset abnormality standard is regarded as an abnormal application component; Taking the application components that are reachable by the abnormal application component at a degree M in the application component topology network as the adjacent application components associated with the abnormal application component; M≥1； According to the value changes of the component operation indicators of the adjacent application components, the future value changes of the component operation indicators of the abnormal application components are predicted.

8. The method according to claim 1, characterized in that: Also includes: According to the prompt information corresponding to the application component to be analyzed, determine the abnormality level corresponding to the application component to be analyzed, and associate different display styles according to different abnormality levels; A schematic diagram of the application topology network is displayed, and in the schematic diagram, a display style associated with the abnormality level corresponding to each application component to be analyzed is used to display the identification shape corresponding to each analysis application component.

9. An analysis device for an application component, characterized in that: include: A determination module, configured to determine, in response to the fault alarm information of the business system, a first type of application component associated with the fault alarm information; The determination module is used to determine, based on the application component topology network, a second type of application component that has a topological connectivity relationship with the first type of application component, and form a set of application components to be analyzed of the business system with the first type of application component and the second type of application component; The determination module is further used to determine the component operation index corresponding to the preset detection strategy, and the abnormality judgment standard of the component operation index; The judgment module is used to make an abnormal judgment on the value change of the component operation indicator of the application component to be analyzed based on the abnormal judgment standard, and obtain the judgment result of the application component to be analyzed.

10. A computer-readable storage medium, characterized in that: The medium stores a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 8.

11. A computing device, characterized in that: The method comprises a memory and a processor; the memory is used to store computer instructions executable on the processor, and the processor is used to implement the method described in any one of claims 1 to 8 when executing the computer instructions.

Images