Abnormity positioning method, system and device of distributed micro-service system and medium

Abstract

The invention relates to the technical field of computers, and discloses an anomaly positioning method, system and device for a distributed micro-service system, and a medium, and the method comprises the steps: obtaining load monitoring data of the distributed micro-service system, determining a sampling rate according to the load monitoring data so as to collect abnormal data in the distributed micro-service system to obtain real-time link data; screening the real-time link data to obtain target link data, and inputting the target link data into a pre-constructed machine learning model for processing to obtain an anomaly positioning result; according to the load monitoring data, the sampling rate is dynamically adjusted to specifically collect abnormal data in the distributed micro-service system, resource utilization optimization is facilitated, and the collected target link data is positioned by using a pre-constructed machine learning model. And by adopting a distributed micro-service architecture and a machine learning technology, the accuracy of abnormal positioning is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an abnormality locating method, system, device and medium for a distributed microservice system. Background Art

[0002] Since distributed microservice systems allow the use of different technology stacks to build each service and can split applications into multiple independent services, their application scope is becoming more and more extensive. However, the abnormal location of distributed microservice systems is currently achieved by manually checking system logs and load conditions, which is time-consuming and inefficient.

[0003] It can be seen that how to improve the efficiency of abnormal location of distributed microservice systems has become a technical problem that technical personnel in this field need to solve urgently. Summary of the invention

[0004] The present invention provides a method, system, device and medium for locating anomalies in a distributed microservice system, which solve the problem of how to improve the efficiency of locating anomalies in a distributed microservice system.

[0005] In order to solve the above technical problems, the first aspect of the present invention provides an abnormality location method of a distributed microservice system, comprising:

[0006] Obtaining load monitoring data of a distributed microservice system, and determining a sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data;

[0007] The real-time link data is screened to obtain target link data, and the target link data is input into a pre-built machine learning model for processing to obtain an abnormality positioning result.

[0008] As one of the preferred solutions, the load monitoring data includes CPU utilization and memory usage.

[0009] As one of the preferred solutions, the method of determining a sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data includes:

[0010] Determine an adaptive sampling rate according to the CPU utilization rate and the memory utilization rate, and determine a gain sampling rate according to data request statistical data;

[0011] Performing anomaly detection on the distributed microservice system to obtain anomaly detection results;

[0012] According to the abnormality detection result, the data in the distributed microservice system is collected by using the adaptive sampling rate and the gain sampling rate to obtain the first link data and the second link data, and the data are merged to obtain the real-time link data.

[0013] As one of the preferred solutions, the adaptive sampling rate is expressed by the following formula:

[0014]

[0015] L=w1*L1+w2*L2

[0016] Wherein, S is the adaptive sampling rate; K is the steepness factor; L is the total load of the distributed microservice system; T is the threshold parameter; L1 and L2 are CPU utilization and memory usage, respectively; w1 and w2 are weight factors, respectively.

[0017] As one of the preferred solutions, the data in the distributed microservice system is collected by the adaptive sampling rate and the gain sampling rate according to the abnormality detection result to obtain the first link data and the second link data and fuse them to obtain the real-time link data, including:

[0018] When it is detected that there is no abnormality in the distributed microservice system, data in the distributed microservice system is collected by using the adaptive sampling rate to obtain the first link data;

[0019] When an abnormality is detected in the distributed microservice system, abnormal data in the distributed microservice system is collected by using the gain sampling rate to obtain abnormal link data as the second link data;

[0020] The pre-abnormal link data and the post-abnormal link data are respectively extracted from the first link data to be merged with the second link data to obtain the real-time link data.

[0021] As one preferred solution, the screening of the real-time link data to obtain the target link data includes:

[0022] The duration of a single link span in the real-time link data is compared with a preset time threshold, and the real-time link data whose duration of a single link span exceeds the preset time threshold is used as the target link data.

[0023] As one of the preferred solutions, the target link data is input into a pre-built machine learning model for processing to obtain an abnormality positioning result, including:

[0024] The load monitoring data and the target link data are constructed into a data set to be processed, and feature extraction is performed on the data set to be processed to obtain an abnormal feature set;

[0025] The abnormal feature set is input into a pre-built machine learning model for processing to obtain an abnormality location result.

[0026] A second aspect of the present invention provides an abnormality location system for a distributed microservice system, comprising:

[0027] A data acquisition module, used to acquire load monitoring data of a distributed microservice system, and determine a sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data;

[0028] The anomaly locating module is used to screen the real-time link data to obtain target link data, and input the target link data into a pre-built machine learning model for processing to obtain an anomaly locating result.

[0029] A third aspect of the present invention provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for locating anomalies in a distributed microservice system as described above is implemented.

[0030] A fourth aspect of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the abnormality location method of the distributed microservice system as described above is implemented.

[0031] Compared with the prior art, the embodiments of the present invention have the following advantages:

[0032] (1) By determining the sampling rate based on the load monitoring data of the distributed microservice system, abnormal data in the system can be collected in a targeted manner, and link data that may have problems can be screened out more efficiently, thereby reducing the amount of invalid data to be processed and improving the efficiency of abnormal location. Dynamically adjusting the sampling rate based on the load monitoring data can ensure that abnormal data is effectively collected while avoiding excessive burden on system resources, helping to optimize the overall performance of the system and ensuring that other normal business operations are not affected while abnormal data is collected.

[0033] (2) Link data is collected and screened in real time. After the target link data is obtained, it is immediately input into the pre-built machine learning model for positioning processing. This helps to timely discover and locate abnormal problems in the system, so that corresponding measures can be taken quickly to solve them, avoid further expansion of the problem or affect the normal operation of other services, and improve the accuracy of abnormal location. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the implementation mode will be briefly introduced below. Obviously, the drawings described below are only some implementation modes of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 This is a flow chart of a method for locating anomalies in a distributed microservice system provided by an embodiment of the present invention;

[0036] Figure 2 It is a structural diagram of an abnormality location system of a distributed microservice system provided by a certain embodiment of the present invention;

[0037] Figure 3 It is a structural diagram of an electronic device provided by a certain embodiment of the present invention. DETAILED DESCRIPTION

[0038] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings and embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] In the description of this application, the terms "first", "second", "third", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the feature. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0040] In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two components. The terms "vertical", "horizontal", "left", "right", "upper", "lower" and similar expressions used herein are for illustrative purposes only, and do not indicate or imply that the system or component referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0041] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in the present invention have the same meaning as those commonly understood by those skilled in the art. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0042] In one embodiment, if Figure 1 As shown, the first aspect of the present invention provides an abnormality locating method for a distributed microservice system, comprising:

[0043] S1. Obtain the load monitoring data of the distributed microservice system, and determine the sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data; wherein, the distributed microservice system can also be called a distributed microservice architecture system, which is an architecture system that constructs an application as a group of small, autonomous microservices, which communicate with each other to complete the entire business process, each microservice runs in its independent process, and they can be deployed and expanded independently, and different microservices can be developed using different programming languages, frameworks and technology stacks, with technology stack flexibility, etc. The present invention tracks the load monitoring data of the distributed microservice system to adjust the sampling rate in real time and then collect link data in the system, and locates abnormalities through the collected data; wherein, the load monitoring data includes CPU utilization (i.e., the percentage of CPU usage of the distributed microsystem at the current moment) and memory utilization (i.e., the memory occupancy ratio of the distributed microsystem at the current moment).

[0044] In one embodiment, determining a sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data includes:

[0045] Determine an adaptive sampling rate according to the CPU utilization rate and the memory utilization rate, and determine a gain sampling rate according to data request statistics;

[0046] Performing anomaly detection on the distributed microservice system to obtain anomaly detection results;

[0047] According to the abnormality detection result, the data in the distributed microservice system is collected by using the adaptive sampling rate and the gain sampling rate to obtain the first link data and the second link data, and the data are merged to obtain the real-time link data.

[0048] Specifically, the adaptive sampling rate is expressed by the following formula:

[0049]

[0050] L=w1*L1+w2*L2

[0051] Wherein, S is the adaptive sampling rate; K is the steepness factor, preferably 0.2; L is the total load of the distributed microservice system; T is a threshold parameter used to define the sensitive point of the load, preferably 60; L1 and L2 are CPU utilization and memory usage, respectively; w1 and w2 are weight factors, respectively.

[0052] The present invention evaluates the current resource load in real time by monitoring the CPU utilization and memory usage of the distributed microservice system: when the resource load is high, the adaptive sampling rate is lowered to reduce the occupation of distributed microservice system resources and ensure the stable operation of the core business; when the resource load is low, the adaptive sampling rate is increased to collect more data and provide more comprehensive information for performance analysis and troubleshooting. Usually, before collecting data, a data request signal is sent to the object to be collected. After obtaining the response of the object to be collected, the data collector can collect the relevant data of the object to be collected. Based on this, the present invention determines the gain sampling rate through the preset rules corresponding to the data request statistical data. The preset rules can be configured in the gateway as follows:

[0053] exception_times: a / / Number of data requests

[0054] request_cost: b / / Data request time, unit: seconds

[0055] count_duration: c / / Statistical duration, unit: minutes

[0056] exception_sample:d % / / Gain sampling rate

[0057] That is to say, within a minute, if the number of data requests exceeding b seconds reaches c times, the gain sampling rate is determined to be d%, preferably 100%. The above is only a manifestation of the preset rule. The specific value can be limited according to actual needs or experience, and will not be elaborated here. This configuration rule can also be considered as when an abnormal situation occurs in the distributed microservice system, the sampling rate can be temporarily increased to collect more detailed information when the abnormality occurs, so as to facilitate rapid location of the problem.

[0058] By performing anomaly detection on the distributed microservice system, it can be achieved by the number of requests received by the system within a preset time exceeding the preset number of requests, or the system's response time to a data request exceeding the preset response time, so that potential problems can be discovered and reported in a timely manner, which helps to reduce the downtime and business losses of the distributed microservice system. At the same time, according to the anomaly detection results, adaptive sampling rate and gain sampling rate are used to collect data in the distributed microservice system, so as to ensure that the data collection can reflect the overall performance of the distributed microservice system and pay attention to hot data and potential problems. The present invention integrates the first link data and the second link data to obtain more comprehensive and accurate real-time link data, so as to provide rich information, thereby realizing rapid problem location, analyzing performance bottlenecks, and taking corresponding optimization measures, thereby improving the monitoring efficiency and accuracy of the distributed microservice system, reducing operation and maintenance costs, and by dynamically adjusting the sampling rate and responding to anomalies in a timely manner, the continuity and stability of the business can be better guaranteed.

[0059] In one embodiment, the data in the distributed microservice system is collected by the adaptive sampling rate and the gain sampling rate according to the abnormality detection result to obtain the first link data and the second link data and fuse them to obtain the real-time link data, including:

[0060] When it is detected that there is no abnormality in the distributed microservice system, data in the distributed microservice system is collected by using the adaptive sampling rate to obtain the first link data;

[0061] When an abnormality is detected in the distributed microservice system, abnormal data in the distributed microservice system is collected by using the gain sampling rate to obtain abnormal link data as the second link data;

[0062] The pre-abnormal link data and the post-abnormal link data are respectively extracted from the first link data to be merged with the second link data to obtain the real-time link data.

[0063] Specifically, when there is no abnormality in the distributed microservice system, normal data in the distributed microservice system, that is, the first link data, is collected through an adaptive sampling rate. The sampling frequency can be dynamically adjusted according to the actual load and resource usage of the distributed microservice system, thereby minimizing the occupation of distributed microservice system resources while ensuring data quality. It can effectively reduce the overhead of data sampling and processing without sacrificing detection accuracy, thereby improving operational efficiency.

[0064] When an exception occurs in a distributed microservice system, the abnormal data in the distributed microservice system, namely the second link data, is collected at a gain sampling rate, which can quickly focus on the key links where the exception occurs, capture more exception details and context information, and provide strong data support for subsequent exception analysis and processing; the targeted gain sampling rate enables the distributed microservice system to respond quickly when an exception occurs, thereby improving the accuracy and timeliness of anomaly detection.

[0065] That is to say, the data collection of the distributed micro-server system is carried out alternately by adaptive sampling rate and gain sampling rate, and the two are switched according to the abnormal detection results obtained in real time. Finally, according to the timestamp, the first link data before the preset period of the second link data and the first link data after the preset period of the second link data are used as the link data before the abnormality and the link data after the abnormality, respectively. Since these data can show the state and behavior pattern of the distributed micro-service system before and after the abnormality occurs, it provides an important reference basis for analyzing the cause of the abnormality and formulating solutions, thereby improving the accuracy and depth of the abnormality analysis; so it is fused with the real-time link data obtained by the second link data to show the complete chain before and after the abnormality occurs. The present invention adopts the link data sampling method combined with "adaptive sampling + gain sampling", while reducing network transmission, trying to ensure the coverage of the collection, so as to accurately locate the specific location and scope of influence of the abnormality, and provide strong support for rapid response and problem solving.

[0066] S2. Screening the real-time link data to obtain target link data, and inputting the target link data into a pre-built machine learning model for processing to obtain an abnormality positioning result;

[0067] In one embodiment, the filtering of the real-time link data to obtain the target link data includes:

[0068] The duration of a single link span in the real-time link data is compared with a preset time threshold, and the real-time link data whose duration of a single link span exceeds the preset time threshold is used as the target link data.

[0069] Specifically, the target link data can also be considered as link data that can be directly used to locate the faulty microservice node. Link data is usually collected by the device Zipkin. Zipkin in a generated environment will store all collected link data in a specified database, such as mysql, ES, etc., and the limited database type support makes zipkin subject to certain restrictions in application and popularization, and the stored data is useless. Based on this, the present invention stores the collected real-time link data in a queue, and identifies the real-time link data with the collection time to determine whether the real-time link data has been collected. When it exceeds the preset time (such as 30s), it can be considered that the link data has been collected, and it is taken out of the queue for analysis. In the real-time link data, if the duration of a single link span exceeds the preset value (such as 5s), it can be determined that the real-time link data is the target link data.

[0070] By comparing the duration of a single link span in real-time link data with a preset time threshold, the present invention can accurately identify links that may have abnormalities or delays. Since these links last too long, they often indicate potential network problems or bottlenecks. Therefore, further analysis of them as target link data can more effectively locate and solve network problems.

[0071] In one embodiment, the inputting the target link data into a pre-built machine learning model for processing to obtain an abnormality positioning result includes:

[0072] The load monitoring data and the target link data are constructed into a data set to be processed, and feature extraction is performed on the data set to be processed to obtain an abnormal feature set;

[0073] The abnormal feature set is input into a pre-built machine learning model for processing to obtain an abnormality location result.

[0074] Specifically, the present invention combines the CPU usage rate and memory usage rate in the load monitoring data with the disk I / O, etc., and the request ID, service name, call time, response time, etc. corresponding to the target link data to construct a data set to be processed, and cleans it: remove invalid data such as missing values, abnormal values ​​and duplicate data, and format the data, that is, convert the data into a unified format suitable for machine learning algorithm processing, such as DataFrame; then extract the features in the data to be processed to obtain an abnormal feature set, which reflects the abnormal situation of network load and link status, as shown in the following table (only example):

[0075] Response time (in ms) CPU usage Memory usage Disk I / O 1000 50 20 10 203 100 80 50 56 150 50 30 10 200 90 70 11253 250 10 10

[0076] The isolation forest model is trained using historical anomaly feature data to enable it to identify and locate anomaly features in the network. The trained model is used as a pre-built machine learning model, and the anomaly feature set is input into the model for processing. The anomaly location results are output, including the link, time, type and other information where the anomaly occurred. The anomaly location results are post-processed, such as removing duplicates, merging similar anomalies, etc., to provide clearer anomaly information.

[0077] You can also train the isolation forest model using historical data or simulated data. During the training process, the isolation forest model will learn the normal distribution of the data and build a series of random trees to isolate anomalies, so that the model can be used to evaluate the anomaly score of new data after training. The higher the score, the more likely the data is an anomaly. Then use the trained isolation forest model to evaluate the data in the anomaly feature set to obtain the anomaly score of each data point, and calculate the CPU, memory, and disk I / O usage based on the anomaly score or direct data in the feature set (if the model directly outputs the usage). The usage can be calculated by dividing the current usage by the total capacity or threshold, depending on the data. The system calculates the format and source of the data; sets a threshold (for example, 60%), regards components with a utilization rate ≥ 60% as high utilization, traverses all calculated utilization data, and marks the CPU, memory, or disk I / O that meets the high utilization condition; counts the number of high utilizations, that is, calculates the number or proportion of each resource (CPU, memory, disk I / O) that meets the high utilization condition, finds the resource with the highest proportion of high utilization, which is the abnormal location, outputs the abnormal location information, including resource type (CPU, memory, disk I / O), utilization rate, abnormal score, etc., and triggers corresponding response measures according to the abnormal location information, such as sending alarms, automatically adjusting resource allocation, triggering fault recovery processes, etc.

[0078] By combining load monitoring data with target link data, the present invention can more comprehensively reflect the operating status and abnormal conditions of the network, extract key features related to the abnormalities, and thus improve the recognition ability of the machine learning model; the machine learning model can quickly process the input feature set and output the abnormality location result, thereby achieving a rapid response to network abnormalities; the abnormality location result can provide detailed abnormality information, such as link, time, type, etc., which helps network administrators to quickly locate and solve problems, realizes automatic detection and location of network abnormalities, and reduces the need for manual intervention.

[0079] In the embodiment of the present application, based on the problem of how to improve the efficiency of anomaly locating a distributed microservice system, a method for anomaly locating a distributed microservice system is designed, which realizes obtaining load monitoring data of the distributed microservice system, and determining the sampling rate according to the load monitoring data to collect anomaly data in the distributed microservice system to obtain real-time link data; screening the real-time link data to obtain target link data, and inputting the target link data into a pre-built machine learning model for processing to obtain anomaly locating results. The technical solution; dynamically adjusting the sampling rate according to the load monitoring data to collect anomaly data in the distributed microservice system in a targeted manner, which helps to optimize resource utilization, and uses the pre-built machine learning model to locate the collected target link data, and adopts the distributed microservice architecture and machine learning technology to improve the accuracy of anomaly locating.

[0080] It should be noted that although the steps in the above flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders.

[0081] In another embodiment, if Figure 2 As shown, the second aspect of the present invention provides an abnormality positioning system for a distributed microservice system, comprising:

[0082] The data acquisition module 10 is used to acquire the load monitoring data of the distributed microservice system, and determine the sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data;

[0083] The anomaly locating module 20 is used to screen the real-time link data to obtain target link data, and input the target link data into a pre-built machine learning model for processing to obtain an anomaly locating result.

[0084] It should be noted that each module in the above-mentioned anomaly location system of a distributed microservice system can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules. For the specific definition of the anomaly location system of a distributed microservice system, please refer to the definition of the anomaly location method of a distributed microservice system in the above text. The two have the same functions and effects, which will not be repeated here.

[0085] A third aspect of the present invention provides an electronic device, the electronic device comprising:

[0086] processor, memory, and bus;

[0087] The bus is used to connect the processor and the memory;

[0088] The memory is used to store operation instructions;

[0089] The processor is used to call the operation instruction, and the executable instruction enables the processor to perform the operation corresponding to the abnormality location method of a distributed microservice system as shown in the first aspect of the present application.

[0090] In an alternative embodiment, an electronic device is provided, such as Figure 3 As shown, Figure 3 The electronic device 5000 shown includes: a processor 5001 and a memory 5003. The processor 5001 and the memory 5003 are connected, such as through a bus 5002. Optionally, the electronic device 5000 may also include a transceiver 5004. It should be noted that in actual applications, the transceiver 5004 is not limited to one, and the structure of the electronic device 5000 does not constitute a limitation on the embodiments of the present application.

[0091] Processor 5001 may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 5001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0092] The bus 5002 may include a path to transmit information between the above components. The bus 5002 may be a PCI bus or an EISA bus, etc. The bus 5002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0093] The memory 5003 may be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compressed optical disk, a laser disk, an optical disk, a digital versatile disk, a Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0094] The memory 5003 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 5001. The processor 5001 is used to execute the application code stored in the memory 5003 to implement the content shown in any of the above method embodiments.

[0095] Among them, electronic devices include but are not limited to: mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc.

[0096] A fourth aspect of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the method for locating an exception in a distributed microservice system shown in the first aspect of the present application is implemented.

[0097] Another embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0098] In addition, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the above method are implemented.

[0099] In summary, the present invention relates to the field of computer technology, and discloses an anomaly positioning method, system, device and medium for a distributed microservice system, wherein the method includes obtaining load monitoring data of the distributed microservice system, and determining a sampling rate according to the load monitoring data to collect anomaly data in the distributed microservice system to obtain real-time link data; screening the real-time link data to obtain target link data, and inputting the target link data into a pre-built machine learning model for processing to obtain anomaly positioning results; dynamically adjusting the sampling rate according to the load monitoring data to collect anomaly data in the distributed microservice system in a targeted manner, which helps to optimize resource utilization, and using a pre-built machine learning model to locate the collected target link data, and using a distributed microservice architecture and machine learning technology to improve the accuracy of anomaly positioning.

[0100] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be directly referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. It should be noted that the technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0101] The above-mentioned embodiments only express several preferred implementation modes of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in the technical field, several improvements and substitutions can be made without departing from the technical principles of the present invention, and these improvements and substitutions should also be regarded as the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be based on the protection scope of the claims.

Claims

1. A method for locating anomalies in a distributed microservice system, characterized in that: include: Obtaining load monitoring data of a distributed microservice system, and determining a sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data; The real-time link data is screened to obtain target link data, and the target link data is input into a pre-built machine learning model for processing to obtain an abnormality positioning result.

2. The method for locating anomalies in a distributed microservice system according to claim 1, characterized in that: The load monitoring data includes CPU utilization and memory usage.

3. The method for locating anomalies in a distributed microservice system according to claim 2, characterized in that: The step of determining a sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data includes: Determine an adaptive sampling rate according to the CPU utilization rate and the memory utilization rate, and determine a gain sampling rate according to data request statistics; Performing anomaly detection on the distributed microservice system to obtain anomaly detection results; According to the abnormality detection result, the data in the distributed microservice system is collected by using the adaptive sampling rate and the gain sampling rate to obtain the first link data and the second link data, and the data are merged to obtain the real-time link data.

4. The method for locating anomalies in a distributed microservice system according to claim 3, characterized in that: The adaptive sampling rate is expressed by the following formula: L=w1*L1+w2*L2 Wherein, S is the adaptive sampling rate; K is the steepness factor; L is the total load of the distributed microservice system; T is the threshold parameter; L1 and L2 are CPU utilization and memory usage, respectively; w1 and w2 are weight factors, respectively.

5. The method for locating anomalies in a distributed microservice system according to claim 3, characterized in that: The method of collecting data in the distributed microservice system by using the adaptive sampling rate and the gain sampling rate according to the abnormality detection result, obtaining first link data and second link data and fusing them to obtain the real-time link data, includes: When it is detected that there is no abnormality in the distributed microservice system, data in the distributed microservice system is collected by using the adaptive sampling rate to obtain the first link data; When an abnormality is detected in the distributed microservice system, abnormal data in the distributed microservice system is collected by using the gain sampling rate to obtain abnormal link data as the second link data; The pre-abnormal link data and the post-abnormal link data are respectively extracted from the first link data to be merged with the second link data to obtain the real-time link data.

6. The method for locating anomalies in a distributed microservice system according to claim 1, characterized in that: The step of screening the real-time link data to obtain target link data includes: The duration of a single link span in the real-time link data is compared with a preset time threshold, and the real-time link data whose duration of a single link span exceeds the preset time threshold is used as the target link data.

7. The method for locating anomalies in a distributed microservice system according to claim 2, characterized in that: The target link data is input into a pre-built machine learning model for processing to obtain an abnormality positioning result, including: The load monitoring data and the target link data are constructed into a data set to be processed, and feature extraction is performed on the data set to be processed to obtain an abnormal feature set; The abnormal feature set is input into a pre-built machine learning model for processing to obtain an abnormality location result.

8. An abnormality location system for a distributed microservice system, characterized in that: include: A data acquisition module, used to acquire load monitoring data of a distributed microservice system, and determine a sampling rate according to the load monitoring data to collect abnormal data in the distributed microservice system to obtain real-time link data; The anomaly locating module is used to screen the real-time link data to obtain target link data, and input the target link data into a pre-built machine learning model for processing to obtain an anomaly locating result.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for locating anomalies in a distributed microservice system according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the abnormality locating method of the distributed microservice system according to any one of claims 1 to 7 is implemented.

Images