Fault warning and analysis method, device, electronic equipment and storage medium

Abstract

The present application provides a fault alarm and analysis method, device, electronic device and storage medium, including: in the process of application running, obtaining the time series data of the application, inputting the time series data into a pre-generated fault alarm model, obtaining the predicted call path of the application, determining whether to issue a fault alarm based on the predicted call path and the pre-acquired actual call path, and in the case of a fault alarm, determining the cause of the fault based on the predicted call path and the pre-acquired causal key-value pair. The present application improves the efficiency of fault alarm by predicting the time series data according to a pre-generated fault alarm model to obtain a predicted call path, and further determining whether to issue a fault alarm based on the predicted call path and the actual call path. In addition, the present application improves the efficiency of fault analysis by determining the cause of the fault based on the predicted call path and the causal key-value pair.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of testing technology, and in particular to a fault alarm and analysis method, device, electronic device and storage medium. Background Art

[0002] Traditional monitoring and troubleshooting methods can no longer meet the needs of modern systems. Therefore, AIOps (Artificial Intelligence for IT Operations) technology based on artificial intelligence and machine learning has emerged. AIOps helps operation and maintenance personnel quickly locate and solve faults and performance problems in the system through automation and intelligent means, thereby improving the stability and reliability of the system.

[0003] However, in the process of using AIOps, operation and maintenance personnel are unable to predict faults in advance and issue fault alarms, which results in the inability of operation and maintenance personnel to promptly discover and handle potential faults, increasing risks and operation and maintenance costs. In addition, there is often a problem of large data delays, which results in the inability of operation and maintenance personnel to obtain the required data in a timely manner, thus affecting the efficiency of fault analysis. Therefore, related technologies have the problems of low fault alarm efficiency and low fault analysis efficiency. Summary of the invention

[0004] In view of the above problems, a fault warning and analysis method, device, electronic device and storage medium are proposed to overcome the above problems or at least partially solve the above problems, including:

[0005] In a first aspect, an embodiment of the present application provides a fault alarm and analysis method, the method comprising:

[0006] During the running of the application, obtaining time series data of the application;

[0007] Inputting the time series data into a pre-generated fault alarm model to obtain a predicted call path of the application program;

[0008] Determining whether to issue a fault alarm according to the predicted call path and the actual call path obtained in advance;

[0009] In the case of a fault alarm, the cause of the fault is determined based on the predicted call path and the pre-acquired causal key-value pairs.

[0010] Optionally, before the step of acquiring the time series data of the application during the running of the application, the method includes:

[0011] Acquire a training sample data set, wherein the training sample data set includes a plurality of sample time series data and a call path corresponding to each of the sample time series data;

[0012] The sample time series data is used as the input of a preset initial model, the call path is used as the output of the initial model, and the initial model is trained using the training sample data set to obtain a fault alarm model.

[0013] Optionally, the determining whether to issue a fault alarm according to the predicted call path and the pre-acquired actual call path includes:

[0014] Determining a call path deviation value according to the predicted call path and the actual call path obtained in advance;

[0015] Comparing the call path deviation value with a preset threshold;

[0016] If the call path deviation value is greater than the preset threshold, a fault alarm is issued;

[0017] If the calling path deviation value is less than or equal to the preset threshold, the fault alarm is stopped.

[0018] Optionally, before the step of determining the cause of the fault according to the predicted call path and the pre-acquired causal relationship key-value pair, the method includes:

[0019] Obtain a target node and log data corresponding to the target node;

[0020] The log data is input into a pre-acquired causal model to obtain causal relationship key-value pairs.

[0021] Optionally, the call path includes a node;

[0022] The acquiring of the target node comprises:

[0023] Obtaining an abnormal call path and the frequency of the abnormal call path;

[0024] Determine a target abnormal call path from the abnormal call paths according to the frequency;

[0025] Extracting the node from the target exception call path;

[0026] Obtaining the frequency of the node;

[0027] A target node is determined from the nodes according to the frequency.

[0028] Optionally, determining the cause of the fault according to the predicted call path and the pre-acquired causal relationship key-value pair includes:

[0029] Extracting the node from the predicted call path to obtain the node of the predicted call path;

[0030] Determine whether a node of the predicted call path hits the causal relationship key-value pair;

[0031] In the case where a node of the predicted call path hits one of the causal relationship key-value pairs, acquiring the causal relationship key-value pair;

[0032] The cause of the failure of the application is determined according to the causal relationship key-value pair.

[0033] Optionally, determining the cause of the fault according to the predicted call path and the pre-acquired causal relationship key-value pair includes:

[0034] Obtaining the frequency of the target node;

[0035] Assigning a weight value to the target node according to the frequency;

[0036] In the case where a node of the predicted call path hits at least two of the causal relationship key-value pairs, obtaining the causal relationship key-value pair of a preset value according to the weight value of the target node;

[0037] The cause of the failure of the application is determined according to the causal key-value pair with a preset value.

[0038] In a second aspect, an embodiment of the present application provides a fault alarm and analysis device, the device comprising:

[0039] A time series data acquisition module is used to acquire the time series data of the application during the running of the application;

[0040] A call path prediction module, used to input the time series data into a pre-generated fault alarm model to obtain a predicted call path of the application;

[0041] A fault alarm module, used to determine whether to issue a fault alarm based on the predicted call path and the actual call path obtained in advance;

[0042] The fault analysis module is used to determine the cause of the fault according to the predicted call path and the pre-acquired causal key-value pairs when a fault alarm is issued.

[0043] Optionally, the device comprises:

[0044] A training sample data set acquisition module, used to acquire a training sample data set, wherein the training sample data set includes a plurality of sample time series data and a call path corresponding to each of the sample time series data;

[0045] The fault alarm model training module is used to use the sample time series data as the input of a preset initial model, use the call path as the output of the initial model, and use the training sample data set to train the initial model to obtain a fault alarm model.

[0046] Optionally, the fault alarm module includes:

[0047] A call path deviation value determination submodule, used to determine a call path deviation value according to the predicted call path and the actual call path obtained in advance;

[0048] A calling path deviation value comparison submodule, used to compare the calling path deviation value with a preset threshold;

[0049] A fault alarm submodule, used for issuing a fault alarm if the call path deviation value is greater than the preset threshold value;

[0050] The stop fault alarm submodule is used to stop the fault alarm if the call path deviation value is less than or equal to the preset threshold value.

[0051] Optionally, the device comprises:

[0052] A log data acquisition module, used to acquire a target node and log data corresponding to the target node;

[0053] The root cause analysis module is used to input the log data into a pre-acquired causal model to obtain a causal relationship key-value pair.

[0054] Optionally, the call path includes a node;

[0055] The log data acquisition module includes:

[0056] The abnormal call path frequency acquisition submodule is used to acquire the abnormal call path and the frequency of the abnormal call path;

[0057] An abnormal call path sorting submodule, used to determine a target abnormal call path from the abnormal call paths according to the frequency;

[0058] A first node extraction submodule, used to extract the node from the target abnormal call path;

[0059] A first node frequency acquisition submodule, used to acquire the frequency of the node;

[0060] The target node determination submodule is used to determine the target node from the nodes according to the frequency.

[0061] Optionally, the fault analysis module includes:

[0062] A second node extraction submodule is used to extract the node from the predicted call path to obtain the node of the predicted call path;

[0063] A node judgment submodule, used to judge whether the node of the predicted call path hits the causal relationship key-value pair;

[0064] A first causal relationship key-value pair acquisition submodule, configured to acquire the causal relationship key-value pair when a node of the predicted call path hits one of the causal relationship key-value pairs;

[0065] The first fault analysis submodule is used to determine the cause of the fault of the application program according to the causal relationship key-value pair.

[0066] Optionally, the fault analysis module includes:

[0067] A second node frequency acquisition submodule, used to acquire the frequency of the target node;

[0068] A weight value assigning submodule, used for assigning a weight value to the target node according to the frequency;

[0069] A second causal relationship key-value pair acquisition submodule is used to acquire the causal relationship key-value pair of preset value according to the weight value of the target node when the node of the predicted call path hits at least two of the causal relationship key-value pairs;

[0070] The second fault analysis submodule is used to determine the cause of the failure of the application program according to the causal relationship key-value pair with a preset value.

[0071] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any of the fault alarm and analysis methods described above.

[0072] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the fault alarm and analysis methods described above.

[0073] In an embodiment of the present application, during the operation of the application, the time series data of the application is obtained, and the time series data is input into a pre-generated fault alarm model to obtain the predicted call path of the application. According to the predicted call path and the pre-acquired actual call path, it is determined whether to issue a fault alarm. In the case of a fault alarm, the cause of the fault is determined according to the predicted call path and the pre-acquired causal key-value pair. The present application predicts the time series data according to the pre-generated fault alarm model. It only needs to input the time series data into the fault alarm model, and the fault alarm model can automatically output the predicted call path corresponding to the time series data. Further, it is determined whether to issue a fault alarm according to the predicted call path and the actual call path, so that the fault alarm that may occur in the future can be predicted in advance, and the efficiency of the fault alarm is improved. In addition, since the pre-acquired causal key-value pair represents a known causal relationship, the present application determines the cause of the fault according to the predicted call path and the pre-acquired causal key-value pair, and can quickly locate the cause event that causes the fault, help operation and maintenance personnel to diagnose and handle the fault, and improve the efficiency of fault analysis.

[0074] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0076] Figure 1 This is one of the step flow charts of a fault alarm and analysis method provided in an embodiment of the present application;

[0077] Figure 2 This is the second step flow chart of a fault alarm and analysis method provided in an embodiment of the present application;

[0078] Figure 3 This is the third step flow chart of a fault alarm and analysis method provided in an embodiment of the present application;

[0079] Figure 4 This is the fourth step flow chart of a fault alarm and analysis method provided in an embodiment of the present application;

[0080] Figure 5This is the fifth step flow chart of a fault alarm and analysis method provided in an embodiment of the present application;

[0081] Figure 6 This is the sixth step flow chart of a fault alarm and analysis method provided in an embodiment of the present application;

[0082] Figure 7 This is the seventh step flow chart of a fault alarm and analysis method provided in an embodiment of the present application;

[0083] Figure 8 is a device block diagram of a fault alarm and analysis device provided in an embodiment of the present application;

[0084] Fig. 9 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0086] In conjunction with the accompanying drawings, a fault alarm and analysis method, device, storage medium and vehicle provided in an embodiment of the present application are described in detail through specific embodiments and their application scenarios.

[0087] Figure 1 is a flowchart of a fault alarm and analysis method provided by an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0088] Step 101, during the running of the application, obtaining time series data of the application.

[0089] It should be noted that in the embodiment of the present application, in order to capture and record the execution process of the application, that is, the time series data of the application, the time series data of the application can be monitored through the open source observability framework (OpenTelemetry). Specifically, the SDK (Software Development Kit) provided by OpenTelemetry is integrated into the application, and the time series data of the application is captured and recorded through the SDK, and the acquired time series data of the application is stored in the log service.

[0090] Step 102: input the time series data into a pre-generated fault alarm model to obtain a predicted call path of the application.

[0091] It should be noted that in the embodiment of the present application, the fault alarm model is a prediction model that can predict the time series data of the application and determine the predicted call path of the application, wherein the call path may include timestamps, event sequences, and other related features.

[0092] The acquired time series data of the application is used as the input of the pre-generated fault alarm model, and is input into the fault alarm model. The fault alarm model can automatically output the predicted call path of the application.

[0093] In addition, before inputting the time series data into the pre-generated fault alarm model, in order to solve the problem of large data delay and incomplete data in the same time window, the real-time data stream processing technology Flink is used for low-latency continuous stream processing. Specifically, repeated time series data are denoised and deduplicated, incomplete time series data in the window are cleaned and filled, and missing time series data are interpolated and filled with average values ​​to ensure the integrity of the time series data.

[0094] Step 103: Determine whether to issue a fault alarm based on the predicted call path and the actual call path obtained in advance.

[0095] Step 104, in the case of a fault alarm, determine the cause of the fault according to the predicted call path and the pre-acquired causal key-value pairs.

[0096] It should be noted that, in the embodiment of the present application, the actual call path refers to the actual call path corresponding to the existing time series data.

[0097] When the predicted call path of the application is obtained through the fault alarm model, it can be determined whether to issue a fault alarm based on the predicted call path and the actual call path obtained in advance.

[0098] In the case of a fault alarm, the cause of the fault, that is, the fault reason, is determined based on the predicted call path and the pre-acquired causal key-value pairs.

[0099] This application predicts the time series data according to the pre-generated fault alarm model. It only needs to input the time series data into the fault alarm model, and the fault alarm model can automatically output the predicted call path corresponding to the time series data, and further determine whether to perform a fault alarm based on the predicted call path and the actual call path, so as to achieve the prediction of possible future fault alarms in advance and improve the efficiency of fault alarms. In addition, since the pre-acquired causal relationship key-value pairs represent known causal relationships, this application determines the cause of the fault according to the predicted call path and the pre-acquired causal relationship key-value pairs, and can quickly locate the cause event that causes the fault, help operation and maintenance personnel to diagnose and handle the fault, and improve the efficiency of fault analysis. In addition, before inputting the time series data into the pre-generated fault alarm model, this application reduces noise and de-duplicates the repeated time series data, cleans and fills the incomplete time series data, and performs average value interpolation filling processing on the missing time series data, so as to ensure the integrity of the time series data, and further improve the accuracy of the fault alarm model prediction.

[0100] Further, in the embodiments of the present application, Figure 2 As shown, before step 101, the following steps may also be included:

[0101] Step 201 : obtaining a training sample data set, wherein the training sample data set includes a plurality of sample time series data and a call path corresponding to each sample time series data.

[0102] Step 202: taking the sample time series data as the input of a preset initial model, taking the call path as the output of the initial model, and using the training sample data set to train the initial model to obtain a fault alarm model.

[0103] It should be noted that in the embodiment of the present application, a training sample data set is obtained in advance, and the training sample data set includes multiple sample time series data and a call path corresponding to each sample time series data. By obtaining the training sample data set, it is convenient to train the preset initial model later.

[0104] The sample time series data in the training sample data set is used as the input of the preset initial model, and the call path in the training sample data set is used as the output target of the initial model. The preset initial model is trained using the training sample data set, so that the preset initial model has the ability to predict the time series data of the application and obtain the predicted call path of the application. The trained initial model is the fault alarm model.

[0105] Among them, the preset initial model can be an LSTM (Long Short-Term Memory, long short-term memory network) model.

[0106] Furthermore, the LSTM model includes an LSTM layer, a Dropout (random inactivation) layer, a fully connected layer, etc., wherein the Dropout layer can be used to prevent overfitting. In order to ensure that the LSTM model can achieve the best performance, the number of LSTM layers, Dropout layers, fully connected layers, etc. included in the LSTM model can be adjusted.

[0107] This application obtains a training sample data set and uses the training sample data set to train a preset initial model, thereby ensuring that the fault alarm model has the ability to predict the time series data of the application and obtain the predicted call path of the application. In actual applications, the fault alarm model can accurately and reliably perform predictions.

[0108] Further, in the embodiments of the present application, Figure 3 As shown, step 103 may further include the following steps:

[0109] Step 301, determining a call path deviation value according to the predicted call path and the actual call path obtained in advance.

[0110] Step 302: compare the call path deviation value with a preset threshold.

[0111] Step 303: If the calling path deviation value is greater than a preset threshold, a fault alarm is issued.

[0112] Step 304: If the calling path deviation value is less than or equal to a preset threshold, the fault alarm is stopped.

[0113] It should be noted that, in the embodiment of the present application, the preset threshold is a pre-set value used to determine whether the call path deviation value exceeds an acceptable range.

[0114] The specific implementation process of determining whether to issue a fault alarm based on the predicted call path and the actual call path obtained in advance can be: calculating the difference between the predicted call path and the actual call path to obtain a call path deviation value. Comparing the call path deviation value with a preset threshold value to determine whether the call path deviation value is greater than the preset threshold value.

[0115] If the call path deviation value is greater than the preset threshold, a fault alarm will be triggered, indicating that the application is running abnormally and the operation and maintenance personnel need to be notified for inspection and processing. If the call path deviation value is less than or equal to the preset threshold, no fault alarm will be triggered, indicating that the application is running normally.

[0116] This application compares the predicted call path and the actual call path, calculates the call path deviation value, and compares it with the preset threshold to determine whether to issue a fault alarm. It can quickly and accurately determine whether there is a fault or abnormal situation, thereby improving the accuracy and response speed of the fault alarm. It not only helps operation and maintenance personnel to promptly discover and handle faults or abnormal situations, and improve the stability and reliability of the system, but also through real-time monitoring and rapid response, it can effectively reduce the impact of faults on the system and improve the observability and operation and maintenance efficiency of the system.

[0117] Further, in the embodiments of the present application, Figure 4 As shown, before the step of "determining the cause of the fault according to the predicted call path and the pre-acquired causal relationship key-value pair" in step 104, the following steps may also be included:

[0118] Step 401, obtaining a target node and log data corresponding to the target node.

[0119] Step 402: input the log data into the pre-acquired causal model to obtain causal relationship key-value pairs.

[0120] It should be noted that in the embodiment of the present application, the target node and the log data corresponding to the target node are obtained. The log data corresponding to the target node is input into the causal model to obtain the causal relationship between the events in the log data, that is, the causal relationship key-value pair, wherein the causal relationship key-value pair may include the cause event: the event that causes the problem, anomaly, failure, etc. to occur. The result event: the problem, anomaly, failure, etc. caused by the cause event.

[0121] In addition, before inputting the log data into the causal model, in order to improve the efficiency of data processing, the log data can also be sampled for importance to obtain key log data. The types of key log data may include CPU (Central Processing Unit), memory, network, SQL (Structured Query Language) query, error, key node services, and indicators.

[0122] Furthermore, in order to reduce the amount of calculation for root cause analysis of the causal model, before inputting the log data into the causal model, the log data can be classified by the k-means clustering algorithm to obtain the classification results of the log data, and the log data can be filtered from the classification results of the log data. The filtered log data is input into the causal model, and the causal model is used to perform root cause analysis on the filtered log data.

[0123] This application uses a causal model to perform causal analysis on log data to obtain causal key-value pairs, so that operation and maintenance personnel can quickly and accurately locate the cause of the failure based on the causal key-value pairs, thereby improving the accuracy and efficiency of fault analysis.

[0124] Further, in the embodiments of the present application, Figure 5 As shown, step 401 may further include the following steps:

[0125] Step 501, obtaining abnormal call paths and the frequencies of abnormal call paths.

[0126] Step 502: determine a target abnormal call path from the abnormal call paths according to the frequency.

[0127] Step 503: extract nodes from the target exception call path.

[0128] Step 504, obtaining the frequency of the node.

[0129] Step 505, determining a target node from the nodes according to the frequency.

[0130] It should be noted that in the embodiments of the present application, an abnormal call path refers to a call path that is different from a normal path due to some reasons (such as errors, exceptions, performance bottlenecks, etc.) during the operation of the application, and refers to a historical or existing abnormal call path. The frequency of the abnormal call path refers to the frequency or number of times the abnormal call path occurs during the operation of the application.

[0131] Get the abnormal call path and the frequency of the abnormal call path. Sort the abnormal call paths by frequency, with the abnormal call paths with high frequency in front and the abnormal call paths with low frequency in the back. At the same time, take the abnormal call path with high frequency as the target abnormal call path.

[0132] The call path contains several nodes, where a node refers to a key component or service in the call path, which can be a service name, etc. The frequency of a node refers to the number of times or frequency that a node appears in the call path.

[0133] After obtaining the target abnormal call path, nodes can be extracted from the target abnormal call path, the frequencies of these nodes can be obtained, and the nodes can be sorted according to the frequencies, with nodes with high frequencies in front and nodes with low frequencies in the back. The higher the frequency of a node, the higher the priority of the node. At the same time, the node with high frequency is used as the target node.

[0134] This application uses the abnormal call path with high frequency as the target abnormal call path, which can quickly narrow the scope of investigation to the abnormal call path that is most likely to have problems. In the case of numerous abnormal call paths, high-frequency abnormal call paths are often hot spots in the system where potential risks or problems exist. This can avoid aimless investigations in numerous abnormal call paths and improve the efficiency of fault diagnosis and problem solving. In addition, this application further extracts nodes from the target abnormal call path and uses the nodes with high frequency as the target nodes. The target nodes further focus on the key to the fault. These high-frequency nodes play an important role in the abnormal call path. Determining the target node helps to accurately locate the root cause of the fault, such as whether the parameters of a function are set incorrectly, or whether a database query operation always fails under certain conditions.

[0135] Further, in the embodiments of the present application, Figure 6 As shown, step 104 may also include the following steps:

[0136] Step 601, extracting nodes from the predicted call path to obtain nodes of the predicted call path.

[0137] Step 602, determine whether the node of the predicted call path hits the causal key-value pair.

[0138] Step 603: When a node of the predicted call path hits a causal key-value pair, the causal key-value pair is obtained.

[0139] Step 604: determine the cause of the application failure based on the causal key-value pair.

[0140] It should be noted that in the embodiment of the present application, when it is determined to perform a fault alarm, a node is extracted from the predicted call trajectory to obtain a node of the predicted call path. The node of the predicted call path is matched with the causal key-value pair obtained in advance to determine whether the node of the predicted call path hits the causal key value. If the node of the predicted call path hits a causal key-value pair, the hit causal key-value pair is obtained, and the cause of the application failure is output according to the hit causal key-value pair.

[0141] If the node of the predicted call path does not hit the causal key-value pair, a prediction error is returned and the predicted call trace is added to the abnormal call path.

[0142] This application can accurately locate the cause of the fault by matching the nodes of the predicted call path with the causal key-value pairs. When the node hits the causal key-value pair, the cause of the application fault can be directly determined based on this key-value pair. This method avoids directionless troubleshooting and improves the accuracy of fault location. In addition, this application can return a prediction error when the node of the predicted call path does not hit the causal key-value pair, and supplement the predicted call trajectory to the abnormal call path, which can provide more data for subsequent fault analysis. These supplementary data help to conduct a more comprehensive fault analysis.

[0143] Further, in the embodiments of the present application, Figure 7 As shown, step 104 may also include the following steps:

[0144] Step 701, obtaining the frequency of the target node.

[0145] Step 702: assign a weight value to the target node according to the frequency.

[0146] Step 703: When the node of the predicted call path hits at least two causal key-value pairs, a causal key-value pair of a preset value is obtained according to the weight value of the target node.

[0147] Step 704: determine the cause of the application failure based on the causal key-value pair with the preset value.

[0148] It should be noted that in the embodiment of the present application, when the target node is determined, the frequency of the target node is obtained, and for any target node, a weight value is assigned to the target node according to the frequency.

[0149] If the node of the predicted call path hits at least two causal key-value pairs, all the hit causal key-value pairs are obtained, and the failure cause of the application is output according to all the hit causal key-value pairs.

[0150] This application obtains the frequency of target nodes and assigns weight values, which can quantify the importance of different target nodes. In the complex calling relationship of the application, some nodes may have special significance due to their frequent appearance when a fault occurs. After assigning weight values ​​to the target nodes, the contribution of different nodes to the judgment of the cause of the fault can be more accurately distinguished, thereby improving the accuracy of fault location. In addition, when the node of the predicted call path hits at least two causal key-value pairs, the application obtains a causal key-value pair with a preset value according to the weight value of the target node, so as to avoid the analysis of a large number of irrelevant causal key-value pairs, and focus on the causal key-value pairs that are related to the weight and are more likely to cause faults. Through this targeted screening, the possibility of misjudgment can be reduced, and the accuracy of determining the cause of the fault can be further improved.

[0151] Corresponding to the method provided in the above-mentioned fault alarm and analysis method embodiment of the present application, see Figure 8 The present application also provides a device block diagram of a fault alarm and analysis device. In this embodiment, the device includes:

[0152] The time series data acquisition module 801 is used to acquire the time series data of the application while the application is running;

[0153] The call path prediction module 802 is used to input the time series data into a pre-generated fault alarm model to obtain a predicted call path of the application program;

[0154] A fault alarm module 803 is used to determine whether to issue a fault alarm based on the predicted call path and the actual call path obtained in advance;

[0155] The fault analysis module 804 is used to determine the cause of the fault according to the predicted call path and the pre-acquired causal key-value pairs when a fault alarm is issued.

[0156] Optionally, the device comprises:

[0157] A training sample data set acquisition module is used to acquire a training sample data set, wherein the training sample data set includes a plurality of sample time series data and a call path corresponding to each sample time series data;

[0158] The fault alarm model training module is used to take the sample time series data as the input of the preset initial model, take the call path as the output of the initial model, use the training sample data set to train the initial model, and obtain the fault alarm model.

[0159] Optionally, the fault alarm module 803 includes:

[0160] A call path deviation value determination submodule, used to determine the call path deviation value according to the predicted call path and the actual call path obtained in advance;

[0161] A call path deviation value comparison submodule is used to compare the call path deviation value with a preset threshold value;

[0162] A fault alarm submodule is used to issue a fault alarm if the call path deviation value is greater than a preset threshold;

[0163] The stop fault alarm submodule is used to stop the fault alarm if the calling path deviation value is less than or equal to a preset threshold.

[0164] Optionally, the device comprises:

[0165] The log data acquisition module is used to obtain the target node and the log data corresponding to the target node;

[0166] The root cause analysis module is used to input log data into a pre-acquired causal model to obtain causal key-value pairs.

[0167] Optionally, the call path includes a node;

[0168] The log data acquisition module includes:

[0169] The abnormal call path frequency acquisition submodule is used to obtain the abnormal call path and the frequency of the abnormal call path;

[0170] The abnormal call path sorting submodule is used to determine the target abnormal call path from the abnormal call paths according to the frequency;

[0171] A first node extraction submodule is used to extract nodes from a target abnormal call path;

[0172] The first node frequency acquisition submodule is used to acquire the frequency of the node;

[0173] The target node determination submodule is used to determine the target node from the nodes according to the frequency.

[0174] Optionally, the fault analysis module 804 includes:

[0175] The second node extraction submodule is used to extract nodes from the predicted call path to obtain nodes of the predicted call path;

[0176] The node judgment submodule is used to judge whether the node of the predicted call path hits the causal key-value pair;

[0177] A first causal relationship key-value pair acquisition submodule is used to acquire a causal relationship key-value pair when a node of the predicted call path hits a causal relationship key-value pair;

[0178] The first fault analysis submodule is used to determine the cause of the application fault according to the causal key-value pair.

[0179] Optionally, the fault analysis module 804 includes:

[0180] The second node frequency acquisition submodule is used to acquire the frequency of the target node;

[0181] The weight value assignment submodule is used to assign weight values ​​to target nodes according to the frequency;

[0182] A second causal relationship key-value pair acquisition submodule is used to acquire a causal relationship key-value pair of preset value according to the weight value of the target node when the node of the predicted call path hits at least two causal relationship key-value pairs;

[0183] The second fault analysis submodule is used to determine the cause of the application failure based on the causal key-value pair of preset values.

[0184] Fig. 9 This is a structural diagram of an electronic device M00 provided in an embodiment of the present application. In the figure, the electronic device M00 includes a processor M01 and a memory M02. The memory M02 stores programs or instructions that can be run on the processor M01. When the program or instructions are executed by the processor M01, the various steps of the above-mentioned fault alarm and analysis method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0185] In an embodiment of the present application, the memory M02 may be used to store software programs and various data. The memory M02 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory M02 may include a volatile memory or a non-volatile memory, or the memory M02 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory M02 in the embodiment of the present application includes but is not limited to these and any other suitable types of memories.

[0186] The processor M01 may include one or more processing units; optionally, the processor M01 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor M01.

[0187] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned fault alarm and analysis method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0188] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0189] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned fault alarm and analysis method embodiments, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0190] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0191] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A fault alarm and analysis method, characterized in that: The method comprises: During the running of the application, obtaining time series data of the application; Inputting the time series data into a pre-generated fault alarm model to obtain a predicted call path of the application program; Determining whether to issue a fault alarm according to the predicted call path and the actual call path obtained in advance; In the case of a fault alarm, the cause of the fault is determined based on the predicted call path and the pre-acquired causal key-value pairs.

2. The method according to claim 1, characterized in that Before the step of obtaining the time series data of the application during the running of the application, the method includes: Acquire a training sample data set, wherein the training sample data set includes a plurality of sample time series data and a call path corresponding to each of the sample time series data; The sample time series data is used as the input of a preset initial model, the call path is used as the output of the initial model, and the initial model is trained using the training sample data set to obtain a fault alarm model.

3. The method according to claim 1, characterized in that The determining whether to issue a fault alarm according to the predicted call path and the actual call path obtained in advance includes: Determining a call path deviation value according to the predicted call path and the actual call path obtained in advance; Comparing the call path deviation value with a preset threshold; If the call path deviation value is greater than the preset threshold, a fault alarm is issued; If the calling path deviation value is less than or equal to the preset threshold, the fault alarm is stopped.

4. The method according to claim 1, characterized in that: Before the step of determining the cause of the fault according to the predicted call path and the pre-acquired causal relationship key-value pair, the method includes: Obtain a target node and log data corresponding to the target node; The log data is input into a pre-acquired causal model to obtain causal relationship key-value pairs.

5. The method according to claim 4, characterized in that The call path includes nodes; The acquiring of the target node comprises: Obtaining an abnormal call path and the frequency of the abnormal call path; Determine a target abnormal call path from the abnormal call paths according to the frequency; Extracting the node from the target exception call path; Obtaining the frequency of the node; A target node is determined from the nodes according to the frequency.

6. The method according to claim 5, characterized in that Determining the cause of the fault according to the predicted call path and the pre-acquired causal relationship key-value pair includes: Extracting the node from the predicted call path to obtain the node of the predicted call path; Determine whether a node of the predicted call path hits the causal relationship key-value pair; In the case where a node of the predicted call path hits one of the causal relationship key-value pairs, acquiring the causal relationship key-value pair; The cause of the failure of the application is determined according to the causal relationship key-value pair.

7. The method according to claim 6, characterized in that Determining the cause of the fault according to the predicted call path and the pre-acquired causal relationship key-value pair includes: Obtaining the frequency of the target node; Assigning a weight value to the target node according to the frequency; In the case where a node of the predicted call path hits at least two of the causal relationship key-value pairs, obtaining the causal relationship key-value pair of a preset value according to the weight value of the target node; The cause of the failure of the application is determined according to the causal key-value pair with a preset value.

8. A fault alarm and analysis device, characterized in that: The device comprises: A time series data acquisition module, used to acquire the time series data of the application during the running of the application; A call path prediction module, used to input the time series data into a pre-generated fault alarm model to obtain a predicted call path of the application; A fault alarm module, used to determine whether to issue a fault alarm based on the predicted call path and the actual call path obtained in advance; The fault analysis module is used to determine the cause of the fault according to the predicted call path and the pre-acquired causal key-value pairs when a fault alarm is issued.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the fault alarm and analysis method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the fault alarm and analysis method as described in any one of claims 1 to 7.

Images