Intelligent fault positioning system and method based on knowledge graph

Abstract

The invention discloses an intelligent fault positioning system and method based on a knowledge graph. The system comprises an incidence relation management module, a knowledge graph generation module, an intelligent fault positioning module and a fault report generation module. Wherein the association relationship management module is used for storing and managing imported resource nodes and association relationships among the resource nodes, and uploading the stored resource nodes and the association relationships to the knowledge graph generation module. And the knowledge graph generation module is used for generating a knowledge graph with a blood relationship according to the association relationship among the resource nodes in the association relationship management module. And the intelligent fault positioning module is used for calling the knowledge graph generated by the knowledge graph generation module to position and mark abnormal resource nodes with faults. And the fault report generation module is used for automatically generating a corresponding fault report according to the abnormal resource node with the fault and sending the fault report to a user.

Description

Technical Field

[0001] The present invention relates to the field of fault analysis, and in particular to an intelligent fault location system and method based on a knowledge graph. Background Art

[0002] With the development of information technology, artificial intelligence has played an important role in various fields. In the field of IT operation and maintenance, AIOps (artificial intelligence operation and maintenance) is gradually becoming a new research hotspot. Among them, being able to quickly diagnose and locate the root cause of production failures is a core capability for Internet companies to ensure system stability.

[0003] To ensure rapid fault handling, high system observability is the first and most important step. System observability refers to the ability to timely and accurately perceive service status, especially the occurrence of anomalies or failures, determine the impact range and fault points, and assist operation and maintenance personnel in making decisions in a complex distributed system.

[0004] The Knowledge Graph was first proposed by Google in 2012 and is also known as knowledge domain visualization or knowledge domain mapping map. It is a method of structuring, organizing and representing knowledge, using a graphical model to represent the relationships and attributes between things. The knowledge graph divides data into points in a graph, and the relationship between data and data is described in the form of edges, which mostly represents the relationship between entities. The knowledge graph can store data in rows and columns through a relational database, and build associations through foreign keys between tables. However, this method requires a large number of connection operations when querying, and it is easy to crash. Another way is to use a graph database to build a knowledge graph.

[0005] Although many companies currently have a relatively complete monitoring, alarm, emergency and corresponding plan system and have achieved a high level of SRE, some pain points are still exposed in the process of practice:

[0006] (1) It takes a long time to locate the fault. Currently, it is not possible to quickly locate the problematic application or system based on the alarm. If too many alarms are configured, when a large-scale fault occurs, an alarm storm will be generated, and it will be impossible to quickly find effective alarms in the complex information; if too few alarms are configured, it is likely that the fault point will not be reflected. Generally speaking, in order to ensure coverage, more alarm information will be configured. When encountering a systemic fault, a large number of alarms will be reported in various dimensions of the business and system, which requires professional personnel from multiple departments such as business, development, system and SRE to analyze and investigate. The current practice is usually to collect all possible related parties together for processing, investigate and confirm each related system one by one, and after confirming the status of various related resources, it is necessary to effectively integrate this information, which will result in a lot of time waste.

[0007] (2) The accuracy of fault location is low. As mentioned above, when relevant personnel from different roles work together to troubleshoot problems, each role has its own limitations, which can easily lead to missing or contradictory messages. Moreover, when a problem occurs in an application along an entire link, it is difficult to determine which application is the root cause of the problem, resulting in inaccurate problem location.

[0008] The above pain points are caused by two problems: 1. Poor observability within and between systems. Application information and alarm information are isolated, and the fault point cannot be quickly located; 2. Too much reliance on human experience to handle faults. However, people have cognitive boundaries, so it is easy to make inaccurate and untimely judgments. Summary of the invention

[0009] A brief summary of one or more aspects is given below to provide a basic understanding of these aspects. This summary is not an exhaustive overview of all conceived aspects, and is neither intended to identify the key or critical elements of all aspects nor to define the scope of any or all aspects. Its only purpose is to give some concepts of one or more aspects in a simplified form as a prelude to a more detailed description that will be given later.

[0010] The purpose of the present invention is to solve the above-mentioned problems and provide an intelligent fault location system based on knowledge graph. Development and operation and maintenance personnel can quickly locate abnormal resource nodes where faults occur through the multi-dimensional scenario topology view and link prediction algorithm in the knowledge graph, thereby realizing self-monitoring and location of operation and maintenance faults, saving operation and maintenance human resources, improving troubleshooting efficiency, and thus improving the stability of enterprise system operations.

[0011] The technical solution of the present invention is:

[0012] The present invention provides an intelligent fault location system based on knowledge graph, comprising: an association management module, a knowledge graph generation module, an intelligent fault location module and a fault report generation module; wherein,

[0013] The association management module is used to store and manage the imported resource nodes and the associations between the resource nodes, and upload the stored resource nodes and associations to the knowledge graph generation module;

[0014] The knowledge graph generation module is used to generate a knowledge graph with blood relationship according to the association relationship between each resource node in the association relationship management module;

[0015] The intelligent fault location module is used to call the knowledge graph generated by the knowledge graph generation module to locate and mark the abnormal resource node where the fault occurs;

[0016] The fault report generation module is used to automatically generate a corresponding fault report according to the abnormal resource node where the fault occurs and send it to the user.

[0017] According to an embodiment of the knowledge graph-based intelligent fault location system of the present invention, the association management module includes a graph database for storing and managing imported resource nodes and the associations between the resource nodes; wherein, when the knowledge graph-based intelligent fault location system imports resource nodes into the association management module, the business resources to be monitored are uniformly abstracted as resource nodes, and then the abstracted resource nodes and the associations between the resource nodes are imported into the graph database of the association management module for storage and management.

[0018] According to an embodiment of the knowledge graph-based intelligent fault location system of the present invention, business resources include application infrastructure, clusters, deployments, databases, middleware, applications and corresponding business instances; wherein, the knowledge graph-based intelligent fault location system abstracts each business resource into a resource node and imports it into a graph database for storage, and then uploads the stored resource nodes and association relationships to a knowledge graph generation module, and the knowledge graph generation module constructs a knowledge graph with blood relationships based on the resource nodes stored in the association management module and the association relationships between the resource nodes.

[0019] According to an embodiment of the knowledge graph-based intelligent fault location system of the present invention, the association relationship between resource nodes is divided into release association, dependency association and deployment association; wherein,

[0020] If two or more deployments are published by the same application, a publishing association is formed between the deployments published by the same application.

[0021] If two or more applications depend on the same Redis instance, a dependency relationship is formed between the applications that depend on the same Redis instance;

[0022] If two or more Pods are deployed on the same node of the cluster, a deployment association is formed between the Pods deployed on the same node.

[0023] According to an embodiment of the knowledge graph-based intelligent fault location system of the present invention, the knowledge graph generation module uses a multi-dimensional business scenario topology view to display the generated knowledge graph; wherein the business scenario topology view includes an association relationship topology view and a call link topology view, and the intelligent fault location module locates and marks the abnormal resource nodes where the fault occurs according to the business scenario topology view in the knowledge graph.

[0024] According to an embodiment of the intelligent fault location system based on the knowledge graph of the present invention, the knowledge graph generation module also sets corresponding weights for the association relationships between different resource nodes, so as to quantify the association relationships between different resource nodes; wherein, when a resource node abnormality occurs, the intelligent fault location module calculates and locates the abnormal resource node where the fault occurs according to the association relationships between the resource nodes in the knowledge graph and the weights of the association relationships between different resource nodes, thereby calibrating the abnormal resource node where the fault occurs.

[0025] The present invention provides an intelligent fault location method based on knowledge graph, comprising the following steps:

[0026] Step S1: abstract the business resources to be monitored into resource nodes, and import the abstracted resource nodes and the associations between the resource nodes into the graph database for storage;

[0027] Step S2: Generate a knowledge graph with blood relationship based on the resource nodes stored in the graph database and the association relationship between the resource nodes;

[0028] Step S3: Call the generated knowledge graph to locate and mark the abnormal resource nodes where the failure occurs;

[0029] Step S4: Automatically generate a corresponding fault report based on the abnormal resource node where the fault occurs and send it to the user.

[0030] According to an embodiment of the knowledge graph-based intelligent fault location method of the present invention, business resources include application infrastructure, clusters, deployments, databases, middleware, applications and corresponding business instances; wherein the knowledge graph-based intelligent fault location method abstracts each business resource into a resource node and imports it into a graph database for storage, and then constructs a knowledge graph with a blood relationship based on the stored resource nodes and the association relationship between the resource nodes.

[0031] According to an embodiment of the knowledge graph-based intelligent fault location method of the present invention, the association relationship between resource nodes is divided into release association, dependency association and deployment association; wherein,

[0032] If two or more deployments are published by the same application, a publishing association is formed between the deployments published by the same application.

[0033] If two or more applications depend on the same Redis instance, a dependency relationship is formed between the applications that depend on the same Redis instance;

[0034] If two or more Pods are deployed on the same node of the cluster, a deployment association is formed between the Pods deployed on the same node.

[0035] According to an embodiment of the knowledge graph-based intelligent fault location method of the present invention, the knowledge graph-based intelligent fault location system adopts multi-dimensional business scenario topology views to display the generated knowledge graph; wherein the business scenario topology view includes an association relationship topology view and a call link topology view, and the knowledge graph-based intelligent fault location system locates and marks the abnormal resource nodes where faults occur according to the business scenario topology view in the knowledge graph.

[0036] According to an embodiment of the knowledge graph-based intelligent fault location method of the present invention, the knowledge graph-based intelligent fault location system sets corresponding weights for the association relationships between different resource nodes, which are used to quantify the association relationships between different resource nodes; wherein, when a resource node abnormality occurs, the knowledge graph-based intelligent fault location system calculates and locates the abnormal resource node where the fault occurs according to the association relationships between the resource nodes in the knowledge graph and the weights of the association relationships between different resource nodes, thereby calibrating the abnormal resource node where the fault occurs.

[0037] The present invention also provides a computer readable medium storing a computer program code, wherein the computer program code implements the method as described above when executed by a processor.

[0038] The present invention also provides an intelligent fault location device based on knowledge graph, comprising:

[0039] a memory for storing instructions executable by a processor; and

[0040] A processor is used to execute the instructions to implement the method as described above.

[0041] Compared with the prior art, the present invention has the following beneficial effects: the present invention aims at fault diagnosis in the field of operation and maintenance, and uses knowledge graphs to build an auxiliary platform with high observability, and abstracts the infrastructure, Kubernetes clusters, databases, middleware and business instances of the business itself used by the enterprise into resource nodes, and then imports the resource nodes and the associations between the nodes into the graph database to form a knowledge graph. By converting the monitoring abnormality indicators and alarm information into a specific resource type, when an abnormality occurs, the resource nodes in the knowledge graph can be quickly marked, so as to explicitly display the abnormal resource nodes with faults. Through the present invention, development and operation and maintenance personnel can quickly locate the abnormal resource nodes with faults through the multi-dimensional scenario topology view and link prediction algorithm in the knowledge graph, realize the self-defined monitoring and positioning of operation and maintenance faults, save operation and maintenance human resources, improve troubleshooting efficiency, and thus improve the stability of enterprise system operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above features and advantages of the present invention can be better understood after reading the detailed description of the embodiments of the present disclosure in conjunction with the following drawings. In the drawings, the components are not necessarily drawn to scale, and components with similar related properties or features may have the same or similar reference numerals.

[0043] Figure 1 It is a system architecture diagram showing an embodiment of an intelligent fault location system based on knowledge graph of the present invention.

[0044] Figure 2 It is a schematic diagram showing an embodiment of the association relationship between resource nodes of the present invention.

[0045] Figure 3 The topological view of the association relationship of the present invention is shown in FIG. Figure 1 Schematic diagram of an embodiment.

[0046] Figure 4 The call link topology diagram of the present invention is shown in FIG. Figure 1 Schematic diagram of an embodiment.

[0047] Figure 5 It is a flowchart showing the steps of an embodiment of an intelligent fault location method based on knowledge graph of the present invention. DETAILED DESCRIPTION

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for the description of the embodiments. Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. Unless it is obvious from the language environment or otherwise explained, the same reference numerals in the figures represent the same structure or operation.

[0049] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0050] Unless otherwise specifically stated, the relative arrangement, numerical expressions and numerical values ​​of the parts and steps set forth in these embodiments do not limit the scope of the present application. At the same time, it should be understood that, for ease of description, the sizes of the various parts shown in the accompanying drawings are not drawn according to the actual proportional relationship. The technology, method and equipment known to those of ordinary skill in the relevant field may not be discussed in detail, but in appropriate cases, the technology, method and equipment should be considered as a part of the authorization specification. In all examples shown and discussed here, any specific value should be interpreted as being merely exemplary, rather than as a limitation. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so that once a certain item is defined in an accompanying drawing, it does not need to be further discussed in subsequent drawings.

[0051] When describing the embodiments of the present invention in detail, for the sake of convenience, the cross-sectional views showing the device structure will not be partially enlarged according to the general scale, and the schematic views are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0052] In the description of the present application, it should be understood that the directions or positional relationships indicated by directional words such as "front, back, up, down, left, right", "lateral, vertical, perpendicular, horizontal" and "top, bottom" are usually based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present application and simplifying the description. Unless otherwise specified, these directional words do not indicate or imply that the device or element referred to must have a specific direction or be constructed and operated in a specific direction, and therefore cannot be understood as limiting the scope of protection of the present application; the directional words "inside and outside" refer to the inside and outside relative to the contours of each component itself.

[0053] Disclosed herein is an embodiment of an intelligent fault location system based on a knowledge graph (hereinafter sometimes referred to as an intelligent fault location system). Figure 1 1 is a system architecture diagram showing an embodiment of an intelligent fault location system based on a knowledge graph of the present invention. Figure 1 As shown, in this embodiment, the intelligent fault location system includes an association management module, a knowledge graph generation module, an intelligent fault location module and a fault report generation module. Among them, the association management module is used to store and manage the imported resource nodes and the associations between the resource nodes, and upload the stored resource nodes and the associations to the knowledge graph generation module. The knowledge graph generation module is used to generate a knowledge graph with blood relationship according to the associations between the resource nodes in the association management module. The intelligent fault location module is used to call the knowledge graph generated by the knowledge graph generation module to locate and mark the fault. The fault report generation module is used to automatically generate a corresponding fault report according to the abnormal resource node where the fault occurs and send it to the user.

[0054] Specifically, in this embodiment, alarm information and status information are collected for four levels: infrastructure, K8S, middleware, and business, covering all aspects from the bottom layer to the business layer. Among them, the second layer uses a variety of solutions such as Prometheus and Zabbix to collect monitoring indicators and organize and store them, and collects changes, which are the core factors affecting online stability. The third layer is the key module of the present invention. The meta-information, database information, and call information related to K8S are composed into a knowledge graph, and then the indicators collected by the upper layer are cleaned and calculated and feature extracted to form alarm information and change information, which are matched to the knowledge graph, and the association relationship in the knowledge graph is used in combination with various graph algorithms to analyze the root cause of the fault. The fourth layer is used to analyze the root cause of the fault, perform manual fault handling or automatic fault self-healing processing according to the rules, and then archive the relevant information to facilitate fault replay.

[0055] In addition, in this embodiment, the association management module includes a graph database for storing and managing imported resource nodes and the associations between the resource nodes. The graph database is a data management system designed with efficient storage and query of graph data as the design principle, with points and edges as the basic storage units. In the graph database, even if the relationship between data is very far, the query speed can be maintained at milliseconds, which is a good storage medium. When using a graph database as an association management module to store resource nodes and the associations between resource nodes, the business resources that need to be monitored, including but not limited to application infrastructure, clusters, deployments, databases, middleware, applications and corresponding business instances, etc., are first abstracted as resource nodes, and then the abstracted resource nodes and the associations between resource nodes are imported into the graph database of the association management module for storage and management.

[0056] Among them, the association relationship is divided into release association, dependency association and deployment association. Among them, if two or more deployments are published by the same application, a release association relationship is formed between the deployments published by the same application. If two or more applications depend on the same instance of Redis, a dependency association is formed between the applications that depend on the same instance of Redis. If two or more Pods are deployed on the same node of the cluster, a deployment association is formed between the Pods deployed on the same node. Figure 2 This is a schematic diagram showing an embodiment of the association relationship between resource nodes of the present invention. Figure 2 , further examples are given.

[0057] like Figure 2 As shown in the figure, both DeploymentA and DeploymentE are published by application A, so they form a publishing association. Application B and application C rely on the same Redis instance, so they form a dependency association. PodE and PodC are both deployed on NodeC of the Kubernetes cluster, so they form a deployment association.

[0058] In this embodiment, after the resource nodes to be monitored and the association relationships between the resource nodes are imported into the graph database through the association management module, the stored resource nodes and the association relationships are uploaded to the knowledge graph generation module. The knowledge graph generation module constructs a knowledge graph with blood relationships based on the resource nodes stored in the association management module and the association relationships between the resource nodes.

[0059] Among them, when constructing a visual knowledge graph, the knowledge graph generation module uses multi-dimensional business scenario topology views to display the generated knowledge graph, including association relationship topology views, call link topology views, etc. The intelligent fault location module locates and marks abnormal resource nodes where faults occur based on the business scenario topology views in the knowledge graph.

[0060] Figure 3 The topological view of the association relationship of the present invention is shown in FIG. Figure 1 Schematic diagram of an embodiment. Figure 3 As shown, the association relationship topology view will apply the database it depends on and Kubernetes' Deployment (Deployment provides declarative updates for Pods. You only need to describe the target state you want in Deployment, and Deployment will help change the actual state of Pods to the target state. For example, if you create a Deployment with 2 replicas, 2 Pods will be generated accordingly), Pod (Pod is the smallest unit that can be created (deployed) and managed in the K8s system. Pod can contain multiple containers (multiple instances) and is a collection of containers), Node (Node is the working node of the cluster, usually a server or virtual machine, responsible for running the container of the application. Pod can be considered to be running on a specific Node), Cluster, etc., and a knowledge graph with blood relationship is formed through the three association relationships mentioned above. Through this knowledge graph, any dimension can be associated with other related information. In the figure, PodA, PodB, PodC, and PodD are all deployed on NodeA, among which A, B, and D have alarms (light red). At this time, through the multi-dimensional scenario topology view and link prediction algorithm in the knowledge graph, it can be concluded that NodeA may have a failure, causing most of the Pods deployed on it to become abnormal, and the root cause is confirmed to be NodeA.

[0061] Figure 4 The call link topology diagram of the present invention is shown in FIG. Figure 1 Schematic diagram of an embodiment. Figure 4 As shown in the figure, the call link topology view divides the business resources to be monitored, that is, the resource nodes, by type and field to improve observability. When an application E fails, other applications that strongly depend on E will also generate alarms. At this time, the light red application in the figure represents an alarm. At this time, the topology view in the knowledge graph and the link prediction algorithm can quickly determine that the E application is dependent on other applications, thereby concluding that the E application is the root cause of the failure.

[0062] In addition, in this embodiment, it is also necessary to combine and connect the above-mentioned diagnostic processes in series to form a complete fault location. Fault diagnosis is carried out in three stages. The first and second stages are unitized rule executions. Each rule will score the potential faulty nodes. The third stage will merge and calculate the scoring results of the rules and sort them to give the final diagnostic results. In the first stage, in the knowledge graph, according to metadata and alarm information, the call link root cause drill-down, resource association common neighbors, call link common neighbors, centrality calculation (fault segmentation), etc. are performed; in the second stage, because the calculation of the first stage will expand the scope of fault troubleshooting, it is necessary to query a larger range of real-time operating status based on its diagnostic results to assist in diagnosis; in the third stage, the unitized rule diagnosis results of the first and second stages will be combined, and the results will be weighted and sorted according to factors such as rule weights, node weights, and rule scoring values, and finally generate diagnostic results.

[0063] In this embodiment, the knowledge graph generation module also sets corresponding weights for the associations between different resource nodes, which is used to quantify the associations between different resource nodes. When a resource node is abnormal, the intelligent fault location module calculates and locates the abnormal resource node that has failed based on the associations between the resource nodes in the knowledge graph and the weights of the associations between different resource nodes, thereby calibrating the abnormal resource node that has failed.

[0064] In addition, in this embodiment, when locating abnormal resource nodes, the intelligent fault location module can also use the link prediction algorithm of the graph database to automatically analyze the cause of the fault. The link prediction algorithm includes a common neighbor algorithm and a community detection algorithm.

[0065] Specifically, in this embodiment, when any one or more resource nodes fail, the common neighbor algorithm can be used to calculate the dependency and closeness between resource nodes, so as to quickly identify the root cause node of the failure. For example, suppose that when the Node node "192.168.24.111" fails, most of the Pods on it will also generate corresponding exceptions and alarms. If there is no knowledge graph formed by the resource-associated topology view, it is difficult to associate the alarms generated by these Pods with this abnormal Node, and it is often necessary to check each item one by one, which is extremely inefficient. With the resource-associated topology view, the intelligent fault location module will immediately locate this Node as the root cause of the failure based on the common neighbor algorithm. Even through the resource-associated topology view, the root cause of the failure can be seen at a glance manually, and the failure can be recovered by quickly processing the Node.

[0066] At the same time, since large companies usually have a large number of alarms in a short period of time, there may be simultaneous failures. At this time, the community detection (K-Core Decomposition) algorithm can be used to automatically distinguish unrelated failures and then handle them separately.

[0067] In this embodiment, after locating the abnormal resource node where the fault occurs through the above steps, a corresponding fault report can be automatically generated based on the IP and other information of the abnormal resource node where the fault occurs and the cause of the fault, and sent to the user. The user can quickly solve the fault problem based on the received fault report.

[0068] This specification also discloses an embodiment of an intelligent fault location system based on a knowledge graph. Figure 5 is a flowchart showing the steps of an embodiment of the intelligent fault location method based on knowledge graph of the present invention. Figure 5 ,The following is a detailed description of each step of the ,intelligent fault location method based on knowledge graph.

[0069] This specification also provides a computer-readable medium storing a computer program code, which, when executed by a processor, implements the knowledge graph-based intelligent fault location system as described above.

[0070] Step S1: The business resources to be monitored are uniformly abstracted into resource nodes, and the abstracted resource nodes and the associations between the resource nodes are imported into the graph database for storage.

[0071] In this embodiment, a graph database is used to store and manage imported resource nodes and the relationships between resource nodes. A graph database is a data management system designed with efficient storage and query of graph data as the design principle, with points and edges as the basic storage units. In a graph database, even if the relationship between data is very far, the query speed can be maintained at milliseconds, which is a very good storage medium. When a graph database is used to store resource nodes and the relationships between resource nodes, the business resources that need to be monitored, including but not limited to application infrastructure, clusters, deployments, databases, middleware, applications and corresponding business instances, etc., are first abstracted as resource nodes, and then the abstracted resource nodes and the relationships between resource nodes are imported into the graph database for storage and management.

[0072] Step S2: Generate a knowledge graph with blood relationship based on the resource nodes stored in the graph database and the association relationship between the resource nodes.

[0073] Associations are divided into release associations, dependency associations, and deployment associations. If two or more deployments are released by the same application, a release association is formed between the deployments released by the same application. If two or more applications depend on the same instance of Redis, a dependency association is formed between the applications that depend on the same instance of Redis. If two or more Pods are deployed on the same node of the cluster, a deployment association is formed between the Pods deployed on the same node. Figure 2 This is a schematic diagram showing an embodiment of the association relationship between resource nodes of the present invention. Figure 2 , further examples are given.

[0074] like Figure 2 As shown in the figure, both DeploymentA and DeploymentE are published by application A, so they form a publishing association. Application B and application C rely on the same Redis instance, so they form a dependency association. PodE and PodC are both deployed on NodeC of the Kubernetes cluster, so they form a deployment association.

[0075] In this embodiment, after the resource nodes to be monitored and the association relationships between the resource nodes are imported into the graph database through the above steps, a knowledge graph with blood relationships is constructed based on the stored resource nodes and the association relationships between the resource nodes.

[0076] Among them, when constructing a visual knowledge graph, multi-dimensional business scenario topology views are used to display the generated knowledge graph, including association relationship topology view and call link topology view, and then the abnormal resource nodes where faults occur are located and marked according to the business scenario topology view in the knowledge graph.

[0077] Figure 3 The topological view of the association relationship of the present invention is shown in FIG. Figure 1 Schematic diagram of an embodiment. Figure 3As shown, the association relationship topology view will apply the database it depends on and Kubernetes' Deployment (Deployment provides declarative updates for Pods. You only need to describe the target state you want in Deployment, and Deployment will help change the actual state of Pods to the target state. For example, if you create a Deployment with 2 replicas, 2 Pods will be generated accordingly), Pod (Pod is the smallest unit that can be created (deployed) and managed in the K8s system. Pod can contain multiple containers (multiple instances) and is a collection of containers), Node (Node is the working node of the cluster, usually a server or virtual machine, responsible for running the container of the application. Pod can be considered to be running on a specific Node), Cluster, etc., and a knowledge graph with blood relationship is formed through the three association relationships mentioned above. Through this knowledge graph, any dimension can be associated with other related information.

[0078] Figure 4 The call link topology diagram of the present invention is shown in FIG. Figure 1 Schematic diagram of an embodiment. Figure 4 As shown in the figure, the call link topology view divides the business resources to be monitored, that is, the resource nodes, by type and field to improve observability. When an application A fails, other applications that strongly depend on A will also generate alarms. At this time, the multi-dimensional scenario topology view and link prediction algorithm in the knowledge graph can quickly determine that application A is dependent on other applications, thereby concluding that application A is the root cause of the failure.

[0079] Specifically, in this embodiment, the gateway entry link constructs associations between domain names, gateway clusters, gateway deployment machine instances, secondary paths, applications, etc. through a graph database to form a knowledge graph. The API gateway is a window for Internet companies to communicate with the outside world, providing important functions such as reverse proxy and load balancing. External calls to internal company services must be uniformly managed and monitored through the gateway service. Common gateway products include Nginx, SpringCloud Gateway, and Ingress of the Kubernetes system. In actual business, for performance and stability considerations, general enterprises will set up more than two sets of gateway clusters. In addition, the internal microservice model is used in the enterprise. A domain name often corresponds to many microservice applications, and each microservice has many interfaces, which leads to the generation of many secondary paths (such as / api / *, / order / *, etc.). Usually, enterprises will also group and divide different businesses to form multiple virtual domains or VDomains. This results in that if a domain name appears online, such as 4xx or 5xx alarms, it is often difficult to quickly determine which microservice has caused an exception or failure. Even if the business microservice applications are all in normal state, since the gateway cluster itself is also deployed on each machine instance, it may also fail for various reasons. Therefore, through the gateway entry link constructed in this embodiment, when a domain name fails to be accessed, the user can automatically obtain the associated domain name, gateway cluster, gateway machine, virtual domain, secondary path and the association relationship between the application after entering the domain name and the secondary path, and then quickly infer the faulty application in combination with the alarm information.

[0080] Step S3: Call the generated knowledge graph to locate and mark the abnormal resource nodes where the failure occurs.

[0081] In this embodiment, corresponding weights are also set for the associations between different resource nodes to quantify the associations between different resource nodes. When a resource node is abnormal, the abnormal resource node with a fault is calculated and located based on the associations between the resource nodes in the knowledge graph and the weights of the associations between different resource nodes, thereby calibrating the abnormal resource node with a fault.

[0082] In addition, in this embodiment, when locating abnormal resource nodes, a link prediction algorithm of a graph database may be used to automatically analyze the cause of the fault, wherein the link prediction algorithm includes a common neighbor algorithm and a community detection algorithm.

[0083] Specifically, in this embodiment, when any one or more resource nodes fail, the common neighbor algorithm can be used to calculate the dependency and closeness between resource nodes, so as to quickly identify the root cause node of the failure. For example, suppose that when the Node node "192.168.24.111" fails, most of the Pods on it will also generate corresponding exceptions and alarms. If there is no knowledge graph formed by the resource-associated topology view, it is difficult to associate the alarms generated by these Pods with this abnormal Node, and it is often necessary to check each item one by one, which is extremely inefficient. With the resource-associated topology view, the common neighbor algorithm will immediately locate that this Node is the root cause of the failure. Even through the resource-associated topology view, the root cause of the failure can be seen at a glance manually, and the failure can be recovered by quickly processing the Node.

[0084] At the same time, since large companies usually have a large number of alarms in a short period of time, there may be simultaneous failures. At this time, the community detection (K-Core Decomposition) algorithm can be used to automatically distinguish unrelated failures and then handle them separately.

[0085] Step S4: Automatically generate a corresponding fault report based on the abnormal resource node where the fault occurs and send it to the user.

[0086] In this embodiment, after locating the abnormal resource node where the fault occurs through the above steps, a corresponding fault report is automatically generated based on the IP and other information of the abnormal resource node where the fault occurs and the cause of the fault, and sent to the user. The user can quickly solve the fault problem based on the received fault report.

[0087] This specification also provides an intelligent fault location system based on a knowledge graph, including an instruction memory for storing instructions executable by a processor, and a processor for executing instructions in the instruction memory to implement the intelligent fault location system based on the knowledge graph as described above.

[0088] The previous description of the disclosure is provided to enable any person skilled in the art to make or use the disclosure. Various modifications to the disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of the disclosure. Thus, the disclosure is not intended to be limited to the examples and designs described herein, but should be granted the widest scope consistent with the principles and novel features disclosed herein.

[0089] Those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or a combination of the two. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps are generally described above in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. The technician may implement the described functionality in different ways for each specific application, but such implementation decisions should not be interpreted as resulting in a departure from the scope of the present invention.

[0090] The various illustrative logic blocks, modules, and circuits described in conjunction with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in cooperation with a DSP core, or any other such configuration.

[0091] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. The software module may reside in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read and write information from / to the storage medium. In an alternative, a storage medium may be integrated into a processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and the storage medium may reside in a user terminal as discrete components.

[0092] In one or more exemplary embodiments, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented as a computer program product in software, each function may be stored on or transmitted by a computer-readable medium as one or more instructions or codes. Computer-readable media include both computer storage media and communication media, including any medium that facilitates the transfer of a computer program from one place to another. Storage media may be any available medium that can be accessed by a computer. As an example and not limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer. Any connection is also properly referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwaves, the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwaves are included in the definition of the medium. Disk and disc as used herein include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, wherein disk often reproduces data magnetically, while disc reproduces data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.

Claims

1. An intelligent fault location system based on knowledge graph, characterized in that: include: Association management module, knowledge graph generation module, intelligent fault location module and fault report generation module; among them, The association management module is used to store and manage the imported resource nodes and the associations between the resource nodes, and upload the stored resource nodes and associations to the knowledge graph generation module; The knowledge graph generation module is used to generate a knowledge graph with blood relationship according to the association relationship between each resource node in the association relationship management module; The intelligent fault location module is used to call the knowledge graph generated by the knowledge graph generation module to locate and mark the abnormal resource node where the fault occurs; The fault report generation module is used to automatically generate a corresponding fault report according to the abnormal resource node where the fault occurs and send it to the user.

2. The intelligent fault location system based on knowledge graph according to claim 1 is characterized in that: The association management module includes a graph database for storing and managing imported resource nodes and the association relationships between the resource nodes; wherein, when the knowledge graph-based intelligent fault location system imports resource nodes into the association management module, the business resources to be monitored are uniformly abstracted as resource nodes, and then the abstracted resource nodes and the association relationships between the resource nodes are imported into the graph database of the association management module for storage and management.

3. The intelligent fault location system based on knowledge graph according to claim 2 is characterized in that: Business resources include application infrastructure, clusters, deployments, databases, middleware, applications and corresponding business instances; wherein the intelligent fault location system based on the knowledge graph abstracts each business resource into a resource node and imports it into the graph database for storage, and then uploads the stored resource nodes and association relationships to the knowledge graph generation module. The knowledge graph generation module constructs a knowledge graph with blood relationships based on the resource nodes stored in the association management module and the association relationships between the resource nodes.

4. The intelligent fault location system based on knowledge graph according to claim 3 is characterized in that: The relationship between resource nodes is divided into release relationship, dependency relationship and deployment relationship. If two or more deployments are published by the same application, a publishing association is formed between the deployments published by the same application. If two or more applications depend on the same Redis instance, a dependency relationship is formed between the applications that depend on the same Redis instance; If two or more Pods are deployed on the same node of the cluster, a deployment association is formed between the Pods deployed on the same node.

5. The intelligent fault location system based on knowledge graph according to claim 3 is characterized in that: The knowledge graph generation module uses multi-dimensional business scenario topology views to display the generated knowledge graph; among them, the business scenario topology view includes the association relationship topology view and the call link topology view, and the intelligent fault location module locates and marks the abnormal resource nodes where faults occur based on the business scenario topology view in the knowledge graph.

6. The intelligent fault location system based on knowledge graph according to claim 5 is characterized in that: The knowledge graph generation module also sets corresponding weights for the association relationships between different resource nodes, which is used to quantify the association relationships between different resource nodes; when a resource node abnormality occurs, the intelligent fault location module calculates and locates the abnormal resource node where the fault occurs based on the association relationships between the resource nodes in the knowledge graph and the weights of the association relationships between different resource nodes, thereby calibrating the abnormal resource node where the fault occurs.

7. An intelligent fault location method based on knowledge graph, characterized in that: The following steps are involved: Step S1: abstract the business resources to be monitored into resource nodes, and import the abstracted resource nodes and the associations between the resource nodes into the graph database for storage; Step S2: Generate a knowledge graph with blood relationship based on the resource nodes stored in the graph database and the association relationship between the resource nodes; Step S3: Call the generated knowledge graph to locate and mark the abnormal resource nodes where the failure occurs; Step S4: Automatically generate a corresponding fault report based on the abnormal resource node where the fault occurs and send it to the user.

8. The intelligent fault location system based on knowledge graph according to claim 7 is characterized in that: Business resources include application infrastructure, clusters, deployments, databases, middleware, applications and corresponding business instances; wherein the intelligent fault location method based on knowledge graph abstracts various business resources into resource nodes and imports them into the graph database for storage, and then constructs a knowledge graph with blood relationship based on the stored resource nodes and the association relationship between the resource nodes.

9. The intelligent fault location system based on knowledge graph according to claim 8, characterized in that: The relationship between resource nodes is divided into release relationship, dependency relationship and deployment relationship. If two or more deployments are published by the same application, a publishing association is formed between the deployments published by the same application. If two or more applications depend on the same Redis instance, a dependency relationship is formed between the applications that depend on the same Redis instance; If two or more Pods are deployed on the same node of the cluster, a deployment association is formed between the Pods deployed on the same node.

10. The intelligent fault location system based on knowledge graph according to claim 7, characterized in that: The intelligent fault location system based on the knowledge graph adopts multi-dimensional business scenario topology views to display the generated knowledge graph; wherein the business scenario topology view includes an association relationship topology view and a call link topology view, and the intelligent fault location system based on the knowledge graph locates and marks the abnormal resource nodes where faults occur according to the business scenario topology view in the knowledge graph.

11. The intelligent fault location system based on knowledge graph according to claim 10, characterized in that: The intelligent fault location system based on the knowledge graph sets corresponding weights for the association relationships between different resource nodes, so as to quantify the association relationships between different resource nodes. When a resource node abnormality occurs, the intelligent fault location system based on the knowledge graph calculates and locates the abnormal resource node where the fault occurs according to the association relationships between the resource nodes in the knowledge graph and the weights of the association relationships between different resource nodes, thereby calibrating the abnormal resource node where the fault occurs.

12. A computer readable medium storing computer program code, characterized in that: The computer program code implements the method according to any one of claims 7 to 11 when executed by a processor.

13. An attribute-based aircraft engine demand quality analysis device, characterized in that: include: a memory for storing instructions executable by a processor; as well as A processor, configured to execute the instructions to implement the method according to any one of claims 7 to 11.

Images