Root cause positioning method and device for abnormal transaction, equipment and storage medium

Abstract

The embodiment of the invention provides a root cause positioning method and device for an abnormal transaction, equipment and a storage medium, and relates to the technical field of artificial intelligence, and the method is characterized in that the method comprises the steps: obtaining an abnormal transaction link in which the abnormal transaction is located; any transaction link is a link which is generated on the basis of each node for processing the transaction in the transaction system and represents a node processing flow; determining at least one normal transaction link having the same starting node as the abnormal transaction link; determining a root cause node of the abnormal transaction according to the at least one normal transaction link; determining a field variable for triggering the alarm information based on the alarm information of the root cause node; and from the field blood relationship, determining the blood relationship factor causing the field variable to change as the root cause of the abnormal transaction. The root cause node of the abnormal transaction is determined according to the normal transaction link which is the same as the starting node of the abnormal transaction link, so that the determination of the root cause node is more accurate.

Description

Technical Field

[0001] The present invention relates to the field of computer information technology, and in particular to a method, device, equipment and storage medium for locating the root cause of an abnormal transaction. Background Art

[0002] With the development of computer technology, more and more technologies are being applied in the financial field. The traditional financial industry is gradually transforming into financial technology (Fintech). However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology.

[0003] The operation and maintenance of financial systems are facing major challenges. With the continuous deepening of financial business and the complex interaction between financial business and other businesses, it becomes difficult to locate abnormal transactions when they occur. In the production environment, locating and analyzing abnormal transactions depends on the abnormal indicator alarm information in the production environment, combined with manual labeling.

[0004] However, the test environment is complex, such as unstable subsystem versions, low server configuration, and other issues. In addition, the data in the test environment is not real data, which will lead to unexpected abnormal transactions. Therefore, manual analysis is often used to locate abnormal transactions, resulting in low efficiency in root cause location and analysis of abnormal transactions, and prone to omissions and misjudgments. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus, device and storage medium for locating the root cause of abnormal transactions, which are used to improve the efficiency of locating the root cause of abnormal transactions and analyzing them.

[0006] In a first aspect, an embodiment of the present application provides a method for locating the root cause of an abnormal transaction, including:

[0007] Obtain an abnormal transaction link where the abnormal transaction is located; any transaction link is a link representing a node processing flow generated based on each node that processes the transaction in the transaction system;

[0008] Determine at least one normal transaction link having the same starting node as the abnormal transaction link;

[0009] Determining a root cause node of the abnormal transaction according to the at least one normal transaction link;

[0010] Based on the alarm information of the root cause node, determining the field variable that triggers the alarm information;

[0011] From the field lineage relationship, the lineage factor causing the field variable to change is determined as the root cause of the abnormal transaction.

[0012] In the embodiment of the present application, the root cause node of the abnormal transaction is determined based on the normal transaction link that is the same as the starting node of the abnormal transaction link, so that the determination of the root cause node of the abnormal transaction link is more accurate; based on the alarm information of the root cause node, the field variable is determined, and the blood relationship factor is determined based on the field variable, so as to determine the root cause of the abnormal transaction, and gradually locate and finally determine the root cause of the abnormal transaction, so that the determination of the root cause of the abnormal transaction is clearer and more accurate.

[0013] Optionally, determining the root cause node of the abnormal transaction according to the at least one normal transaction link includes:

[0014] For any normal transaction link, determine a similar transaction link between the abnormal transaction link and the normal transaction link; the similar transaction link is a common part between the abnormal transaction link and the normal transaction link;

[0015] Determine a maximum similar transaction link from similar transaction links corresponding to each normal transaction link, wherein the maximum similar transaction link is a similar transaction link with the largest number of nodes and edges;

[0016] The nodes with different attributes between the maximum similarity transaction link and the corresponding normal transaction link are used as the root cause nodes of the abnormal transaction.

[0017] In the embodiment of the present application, by determining the transaction links similar to the normal transaction, the scope of determining the root cause of the abnormal transaction can be narrowed; then the maximum similar transaction link is queried in the similar transaction links, and the root cause is determined by the maximum similar transaction link, so that the root cause of the abnormal transaction is determined more accurately. By using the node with different attributes in the maximum similar transaction link and the corresponding normal transaction link as the abnormal transaction root cause node, the situation of misjudgment caused by using the similar transaction link to determine the root cause node is avoided, and the accuracy of determining the abnormal transaction root cause node is improved.

[0018] Optionally, the determining a similar transaction link between the abnormal transaction link and the normal transaction link includes:

[0019] Matching nodes with the same attributes in the normal transaction link and the abnormal transaction link to obtain a matching node pair;

[0020] The transaction link formed by the matching node pair with the same edge attribute is used as the similar transaction link between the abnormal transaction link and the normal transaction link.

[0021] In an embodiment of the present application, by matching the nodes of a normal transaction link and an abnormal transaction link, the transaction links with the same nodes can be preliminarily screened out; then, the transaction links formed by the matching node pairs with the same edge attributes are used as similar transaction links, so that the determination of similar transaction links is more accurate.

[0022] Optionally, the determining, based on the alarm information of the root cause node, a field variable that triggers the alarm information includes:

[0023] Obtaining alarm information of the root cause node;

[0024] Determining whether there is a system failure according to the first alarm information in the alarm information;

[0025] If there is no system failure, determining the abnormal code line in the root cause node according to the second alarm information in the alarm information;

[0026] Determine the field variable in the abnormal code line that triggers the warning information.

[0027] In the embodiment of the present application, firstly, it is determined whether there is a system fault through the first alarm information. If there is, an alarm result of the system fault is directly generated without judging whether it is a business fault, thereby improving the efficiency of fault determination. If there is no system fault, it is determined to be a business fault, and the field variables are determined according to the abnormal code line, thereby improving the efficiency of determining business faults.

[0028] Optionally, the determining whether there is a system failure according to the first alarm information in the alarm information includes:

[0029] The first alarm information in the alarm information is input into the large model to determine whether there is a system failure; the first alarm information includes at least one of database alarm information, service availability alarm information, server alarm information and test alarm information; the second alarm information includes at least one of log alarm information and return code alarm information.

[0030] In the embodiment of the present application, by inputting the first alarm information into the large model, determining whether a system failure exists through the large model, the efficiency and accuracy of determining the system failure are improved.

[0031] Optionally, obtaining the alarm information of the root cause node includes:

[0032] According to the occurrence time of the abnormal transaction, the root cause node and the server through which the abnormal transaction passes, the alarm information of the root cause node is obtained from each historical alarm information of the transaction system.

[0033] In an embodiment of the present application, historical alarm information is filtered according to time, root cause node, and server, thereby filtering out the alarm information of the root cause node, thereby improving the efficiency of analyzing and processing the alarm information and avoiding the tediousness of searching for the alarm information of the root cause node in massive alarm information.

[0034] Optionally, from the field lineage relationship, determining the lineage factor causing the field variable to change as the root cause of the abnormal transaction includes:

[0035] From the field kinship relationship, determine each kinship factor corresponding to the field variable;

[0036] For any blood relationship factor, determining whether the blood relationship factor has changed before the abnormal transaction occurs;

[0037] The changed blood relationship factor is determined as the root cause of the abnormal transaction.

[0038] In the embodiment of the present application, by determining whether the bloodline factor has changed before the abnormal transaction occurs, it is possible to determine whether the bloodline factor is the root cause of the abnormal transaction, thereby improving the efficiency and accuracy of confirming the root cause of the abnormal transaction.

[0039] In a second aspect, an embodiment of the present application provides a root cause location device for abnormal transactions, including:

[0040] An acquisition module is used to acquire an abnormal transaction link where an abnormal transaction is located; any transaction link is a link representing a node processing flow generated based on each node that processes the transaction in the transaction system;

[0041] A determination module, configured to determine at least one normal transaction link having the same starting node as the abnormal transaction link;

[0042] The determination module is further configured to determine a root cause node of the abnormal transaction according to the at least one normal transaction link;

[0043] The determination module is further used to determine the field variable that triggers the alarm information based on the alarm information of the root cause node;

[0044] The determination module is further used to determine the blood relationship factor that causes the field variable to change as the root cause of the abnormal transaction from the field blood relationship.

[0045] Optionally, the determining module is specifically used to:

[0046] For any normal transaction link, determine a similar transaction link between the abnormal transaction link and the normal transaction link; the similar transaction link is a common part between the abnormal transaction link and the normal transaction link;

[0047] Determine a maximum similar transaction link from similar transaction links corresponding to each normal transaction link, wherein the maximum similar transaction link is a similar transaction link with the largest number of nodes and edges;

[0048] The nodes with different attributes between the maximum similarity transaction link and the corresponding normal transaction link are used as the root cause nodes of the abnormal transaction.

[0049] Optionally, the determining module is specifically used to:

[0050] Matching nodes with the same attributes in the normal transaction link and the abnormal transaction link to obtain a matching node pair;

[0051] The transaction link formed by the matching node pair with the same edge attribute is used as the similar transaction link between the abnormal transaction link and the normal transaction link.

[0052] Optionally, the determining module is specifically used to:

[0053] Obtaining alarm information of the root cause node;

[0054] Determining whether there is a system failure according to the first alarm information in the alarm information;

[0055] If there is no system failure, determining the abnormal code line in the root cause node according to the second alarm information in the alarm information;

[0056] Determine the field variable in the abnormal code line that triggers the warning information.

[0057] Optionally, the determining module is specifically used to:

[0058] The first alarm information in the alarm information is input into the large model to determine whether there is a system failure; the first alarm information includes at least one of database alarm information, service availability alarm information, server alarm information and test alarm information; the second alarm information includes at least one of log alarm information and return code alarm information.

[0059] Optionally, the acquisition module is specifically used for:

[0060] According to the occurrence time of the abnormal transaction, the root cause node and the server through which the abnormal transaction passes, the alarm information of the root cause node is obtained from each historical alarm information of the transaction system.

[0061] Optionally, the determining module is specifically used to:

[0062] From the field kinship relationship, determine each kinship factor corresponding to the field variable;

[0063] For any blood relationship factor, determining whether the blood relationship factor has changed before the abnormal transaction occurs;

[0064] The changed blood relationship factor is determined as the root cause of the abnormal transaction.

[0065] In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-described method when executing the program.

[0066] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device, wherein when the program is run on the computer device, the computer device executes the steps of the above-described method.

[0067] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the method described above.

[0068] In the embodiment of the present application, the root cause node of the abnormal transaction is determined based on the normal transaction link that is the same as the starting node of the abnormal transaction link, so that the determination of the root cause node of the abnormal transaction link is more accurate; based on the alarm information of the root cause node, the field variable is determined, and the blood relationship factor is determined based on the field variable, so as to determine the root cause of the abnormal transaction, and gradually locate and finally determine the root cause of the abnormal transaction, so that the determination of the root cause of the abnormal transaction is clearer and more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0070] Figure 1 It is a root cause analysis method for abnormal transactions in a production environment;

[0071] Figure 2 A system architecture diagram provided for an embodiment of the present application;

[0072] Figure 3 A schematic diagram of a process for locating the root cause of an abnormal transaction provided in an embodiment of the present application;

[0073] Figure 4 A flowchart of a method for locating a root cause node of an abnormal transaction provided in an embodiment of the present application;

[0074] Figure 5 A schematic diagram of a structure for determining a similar link graph provided in an embodiment of the present application;

[0075] Figure 6 A schematic diagram of a process for determining a field variable in an abnormal code line that triggers an alarm message provided by an embodiment of the present application;

[0076] Figure 7 A schematic diagram of a process for determining the root cause of an abnormal transaction provided in an embodiment of the present application;

[0077] Figure 8 A root cause location device for abnormal transactions provided in an embodiment of the present application;

[0078] Fig. 9 A computer device is provided in an embodiment of the present application. DETAILED DESCRIPTION

[0079] In order to make the purpose, technical solution and beneficial effects of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0080] To facilitate understanding of this solution, the application scenario of this solution is introduced below.

[0081] In the digital economy, bank operations and maintenance face major challenges. Although the microservice architecture improves flexibility, as business deepens and service interactions become more complex, it becomes difficult to locate the root cause of abnormal transactions. Massive log data analysis is time-consuming, and cross-service fault propagation increases the difficulty of problem identification. Therefore, R&D personnel need to quickly and accurately locate the root cause in a dynamic environment to ensure service stability and user satisfaction.

[0082] In the traditional production environment, the root cause analysis of abnormal transactions depends on the abnormal indicator alarm of the production environment. First, the indicator alarm is triggered by the monitoring system. The root cause system obtains the abnormal transaction flow list, analyzes the abnormal transaction link, and confirms the root cause system of the abnormal transaction. Then, the abnormal transaction information of the root cause system is collected, such as server, database, slow SQL, ERROR, etc., combined with the manually labeled dependent root cause knowledge base, and finally the root cause of the abnormal transaction is summarized and analyzed. Figure 1 The figure shows a method for analyzing the root cause of abnormal transactions in a production environment. When an abnormal transaction occurs, an alarm message is issued, and then the abnormal transaction serial number is obtained. According to the abnormal transaction serial number and combined with manual analysis of the abnormal transaction link, the abnormal system is located. Finally, the abnormal information is collected, and the root cause of the abnormal transaction is analyzed in combination with the correlation between the historical alarm information and the root cause stored in the database.

[0083] The root cause analysis of abnormal transactions in the test environment faces more severe challenges. Compared with the production environment, the test environment is more complex, such as unstable subsystem versions and frequent releases during the R&D cycle. In addition, the server configuration of the test environment is relatively low, and it is easy to encounter situations where the load is too high and the service is unavailable. At the same time, the permission management of the test environment is not as strict as the production environment, and there is a risk of misoperation, which leads to service unavailability. In addition, the test data is not generated by real user transactions, but is artificially constructed, which will also bring many unexpected anomalies, interfering with the root cause classification analysis of batch abnormal transactions in the traditional production environment. Therefore, when performing root cause analysis on abnormal transactions in the test environment, it is necessary to rely on manual reading of log files and other means to check abnormal alarms one by one, as well as manually identify and eliminate interference items. This process is not only time-consuming and labor-intensive, but also inefficient. When faced with massive data and complex scenarios, it is very easy to generate analysis omissions or misjudgments, which increases the difficulty of locating the root causes of abnormal transactions in the test environment and affects the efficiency of bank system testing and optimization. In this regard, the present application proposes a root cause location method for abnormal transactions, and the specific operation steps are as follows:

[0084] First, this application analyzes and locates the root cause of a single abnormal transaction, obtains the business serial number of the abnormal transaction, and determines the transaction link where the abnormal transaction is located according to the business serial number, including the starting node of the abnormal transaction; then determines the normal transaction link with the same starting node as the abnormal transaction link, determines the maximum similar transaction link with the abnormal transaction link from the normal transaction link, and takes the node with different attributes from the normal transaction link in the maximum similar transaction link as the root cause node. Finally, the first alarm information of the root cause node is input into the large model to determine whether there is a system failure. If so, the conclusion of the system failure is output; if not, the abnormal code line of the root cause node is determined according to the second alarm information of the root cause node, and then the field variable is determined, so as to locate the root cause of the abnormal transaction.

[0085] refer to Figure 2 , a system architecture diagram of a root cause location method for abnormal transactions provided in an embodiment of the present application, the system architecture diagram includes: a terminal device 201 and a server 202, the terminal device 201 can be a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto, the server 202 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The terminal device 201 and the server 202 can be connected by wire or wirelessly.

[0086] refer to Figure 3 , is a flow chart of a method for locating the root cause of an abnormal transaction provided in an embodiment of the present application, comprising the following steps:

[0087] Step 301, obtaining an abnormal transaction link where the abnormal transaction is located; any transaction link is a link representing a node processing flow generated based on each node that processes the transaction in the transaction system.

[0088] Specifically, each transaction corresponds to a unique business serial number, and the transaction link can be queried based on the business serial number. Similarly, there is also a unique business serial number for abnormal transactions, and the transaction link of abnormal transactions can be queried based on the business serial number, including the node where the abnormal transaction occurred, the link of the node processing flow, etc. There are multiple nodes in the transaction system, and any transaction requires at least one node to process it. The processing flow formed by multiple nodes that process a transaction flow is used as the transaction link of a transaction. The transaction link is composed of different nodes and edges connecting nodes. Different transactions have different transaction links. The transaction link where the transaction failed is an abnormal transaction link.

[0089] Step 302: Determine at least one normal transaction link having the same starting node as the abnormal transaction link.

[0090] Specifically, a transaction link with normal transactions is a normal transaction link. Any transaction link has a starting node. After determining the abnormal transaction link, a normal transaction link with the same starting node as the abnormal transaction link is determined. There is at least one normal transaction link with the same starting node as the abnormal transaction link. For example, if the abnormal transaction link is ABCDE, then A is the starting node of the abnormal transaction link, and normal transaction links with starting node A are obtained, such as ABC, ABCDEF, etc.

[0091] When determining a normal transaction link, each historical normal transaction having the same starting node as the abnormal transaction link is obtained, and different baseline link graphs are summarized through each historical normal transaction, wherein each baseline link graph corresponds to at least one normal transaction link.

[0092] Step 303: Determine the root cause node of the abnormal transaction according to at least one normal transaction link.

[0093] Specifically, the root cause node is the node that causes the transaction to be abnormal, and the root cause node of the abnormal transaction is determined from the normal transaction link. Since the normal transaction link and the abnormal transaction link have the same starting node, the node after the starting node of the abnormal transaction link is the node that causes the abnormal transaction, so the root cause node of the abnormal transaction can be determined from the normal transaction link.

[0094] Step 304: Based on the alarm information of the root cause node, determine the field variable that triggers the alarm information.

[0095] Specifically, the system will trigger an alarm message when an abnormal transaction occurs. The alarm message is generated based on the root cause node. The field variable is determined based on the alarm message of the root cause node. The field variable represents the field that caused the abnormal transaction.

[0096] Step 305: From the field lineage relationship, determine the lineage factor that causes the field variable to change as the root cause of the abnormal transaction.

[0097] Specifically, the field lineage is determined based on the field variable. The field lineage includes multiple lineage factors, at least one of which causes the field variable to change. The lineage factor that causes the field variable to change is used as the root cause of the abnormal transaction. The abnormal transaction link is determined from the abnormal transaction, the root cause node is located from the abnormal transaction link, the field variable is located from the root cause node, and the lineage factor is determined from the field variable. The lineage factor is used as the root cause of the abnormal transaction.

[0098] In the embodiment of the present application, the root cause node of the abnormal transaction is determined based on the normal transaction link that is the same as the starting node of the abnormal transaction link, so that the determination of the root cause node of the abnormal transaction link is more accurate; based on the alarm information of the root cause node, the field variable is determined, and the blood relationship factor is determined based on the field variable, so as to determine the root cause of the abnormal transaction, and gradually locate and finally determine the root cause of the abnormal transaction, so that the determination of the root cause of the abnormal transaction is clearer and more accurate.

[0099] In some embodiments, based on at least one normal transaction link, a root cause node of an abnormal transaction is determined, such as Figure 4 As shown, the following steps are included:

[0100] Step 401: for any normal transaction link, determine a similar transaction link between the abnormal transaction link and the normal transaction link; the similar transaction link is a common part between the abnormal transaction link and the normal transaction link.

[0101] Specifically, in the normal transaction link, there is a common part with the abnormal transaction link, that is, it has the same nodes and edges as the abnormal transaction link. The common part of the normal transaction link and the abnormal transaction link is taken as a similar transaction link. From multiple normal transaction links, a similar transaction link is determined, and there are multiple similar transaction links. For example, if the abnormal transaction link is ABCDE, and the normal transaction links are ABC and ABCDEF, then the similar transaction links are ABC and ABCDE.

[0102] Step 402: Determine the maximum similar transaction link from the similar transaction links corresponding to each normal transaction link. The maximum similar transaction link is the similar transaction link with the largest number of nodes and edges.

[0103] Specifically, the maximum similar transaction link is determined among multiple similar transaction links. The maximum similar transaction link is the similar transaction link with the largest number of nodes and edges. As shown in formula (1), the maximum similar transaction link is calculated as:

[0104] MCS(G1,G2)=MAX(V+E)……Formula (1)

[0105] Among them, MCS is the maximum similarity transaction link, G1 is the normal transaction link, G2 is the abnormal transaction link, V is the node, and E is the edge.

[0106] For example, Figure 5 The figure shows the normal transaction link graph and the abnormal transaction link graph, where A, B, C, D, E, and F are nodes and E1, E2, E3, E4, E5, and E6 are edges. The normal transaction link graph contains normal transaction links ABCD and ABEF, and the abnormal transaction link graph contains abnormal transaction links ABCD and ABE. As shown in formula (2), the maximum similarity transaction link between G1 and G2 is calculated as:

[0107] MCS(G1,G2)=MAX(V+E)={V1,V2,V3,V4,V5}+{E1,E2,E3,E4,E5}

[0108] =10...Formula (2)

[0109] That is, the maximum similarity transaction link is composed of nodes V1~V5 and edges E1~E5.

[0110] Step 403: Nodes with different attributes between the maximum similar transaction link and the corresponding normal transaction link are regarded as root cause nodes of abnormal transactions.

[0111] Specifically, nodes with the same attributes are nodes with the same upstream and downstream edges, and nodes with different attributes are nodes with at least one different upstream and downstream edge. Edges with the same attributes are edges with the same upstream and downstream nodes, and edges with different attributes are edges with at least one different upstream and downstream nodes. Nodes with different attributes in the normal transaction link corresponding to the maximum similarity transaction link are regarded as the root cause nodes of abnormal transactions.

[0112] For example, the maximum similarity transaction path is ABCDE, and the normal transaction link is ABCDEF. In the maximum similarity transaction link and the normal transaction link, the attributes of node E are different. Because in the maximum similarity transaction link, the upstream edge of node E is E5, and the downstream edge does not exist, while in the normal transaction link, the upstream edge of node E is E5, and the downstream edge is E6. Therefore, node E is regarded as the root cause node of the abnormal transaction.

[0113] In the embodiment of the present application, by determining the transaction links similar to the normal transaction, the scope of determining the root cause of the abnormal transaction can be narrowed; then the maximum similar transaction link is queried in the similar transaction links, and the root cause is determined by the maximum similar transaction link, so that the root cause of the abnormal transaction is determined more accurately. By using the node with different attributes in the maximum similar transaction link and the corresponding normal transaction link as the abnormal transaction root cause node, the situation of misjudgment caused by using the similar transaction link to determine the root cause node is avoided, and the accuracy of determining the abnormal transaction root cause node is improved.

[0114] In some embodiments, determining a similar transaction link between an abnormal transaction link and a normal transaction link includes:

[0115] The nodes with the same attributes in the normal transaction link and the abnormal transaction link are matched to obtain matching node pairs; the transaction link composed of the matching node pairs with the same edge attributes is used as the similar transaction link between the abnormal transaction link and the normal transaction link.

[0116] Specifically, when determining similar transaction links, firstly, nodes with the same attributes are determined from normal transaction links and abnormal transaction links as matching node pairs; then, the edge attributes of any matching node pair are determined, and the transaction links with the same edge attributes of the matching node pairs are taken as similar transaction links between the abnormal transaction link and the normal transaction link.

[0117] For example, the normal transaction links are ABC and ABCDEF, and the abnormal transaction link is ABCDE. First, the matching node pairs are determined. The nodes in the abnormal transaction link are temporarily set to A', B', C', D', and E'. The matching node pairs are A-A', B-B', C-C', D-D', and E-E'. Then, according to the matching node pairs, the edge attributes are determined. For example, the upstream and downstream edges of node A are E1 and E2, and the upstream and downstream edges of node A' are also E1 and E2; the upstream and downstream edges of node B are E2 and E3, and the upstream and downstream edges of node B' are also E2 and E3; the upstream and downstream edges of node C are E3 and E4, and the upstream and downstream edges of node C' are also E3 and E4; the upstream edge of node D is E4, and the downstream edge does not exist, so node D ’ The upstream edge of node E is also E4, and the downstream edge does not exist; the upstream and downstream edges of node E are E5 and E6, and node E’ The upstream and downstream edges are E5, and the downstream edge does not exist. Therefore, the similarity link between the normal transaction link ABC and the abnormal transaction link ABCDE is ABC, and the similarity link between the normal transaction link ABCDEF and the abnormal transaction link ABCDE is ABCD.

[0118] In an embodiment of the present application, by matching the nodes of a normal transaction link and an abnormal transaction link, the transaction links with the same nodes can be preliminarily screened out; then, the transaction links formed by the matching node pairs with the same edge attributes are used as similar transaction links, so that the determination of similar transaction links is more accurate.

[0119] In some embodiments, based on the alarm information of the root cause node, the field variable that triggers the alarm information is determined, such as Figure 6 As shown, the following steps are included:

[0120] Step 601: Obtain alarm information of the root cause node.

[0121] Step 602: Determine whether there is a system failure according to the first alarm information in the alarm information.

[0122] Step 603: If there is no system failure, determine the abnormal code line in the root cause node according to the second alarm information in the alarm information.

[0123] Step 604: Determine the field variable in the abnormal code line that triggers the alarm information.

[0124] Specifically, abnormal transactions usually include two situations: system abnormalities and business abnormalities. The occurrence of abnormal transactions will generate alarm information, which comes from the root cause node in the abnormal transaction. The alarm information includes the first alarm information and the second alarm information. According to the first alarm information, it is determined whether the abnormal transaction is caused by the system abnormality. If so, the alarm result of the system abnormality is directly generated; if not, it is a business abnormality. According to the second alarm information, the abnormal code line in the root cause node is determined, and the field variable that triggers the alarm information is determined from the abnormal code line.

[0125] In the embodiment of the present application, firstly, it is determined whether there is a system fault through the first alarm information. If there is, an alarm result of the system fault is directly generated without judging whether it is a business fault, thereby improving the efficiency of fault determination. If there is no system fault, it is determined to be a business fault, and the field variables are determined according to the abnormal code line, thereby improving the efficiency of determining business faults.

[0126] In some embodiments, determining whether there is a system failure according to the first alarm information in the alarm information includes:

[0127] The first alarm information in the alarm information is input into the large model to determine whether there is a system failure; the first alarm information includes at least one of database alarm information, service availability alarm information, server alarm information and test alarm information; the second alarm information includes at least one of log alarm information and return code alarm information.

[0128] Specifically, the first alarm information is input into the big model. The big model has domain knowledge of root cause analysis of environmental problems such as server resources, database resources, and service availability, as well as system problems. Therefore, the big model can be used to determine whether there is a system anomaly.

[0129] The first alarm information includes: database alarm information, service availability alarm information, server alarm information and test alarm information. The database alarm information also includes slow query alarm information, and the test alarm information includes MOCK baffle information.

[0130] The second alarm information includes: log alarm information and return code alarm information. ERROR is the alarm information in the log file. Collecting ERROR can provide a basis for locating the abnormal code line later. The return code alarm information is an error code set according to expert experience, such as 401 for unauthorized error, 404 for resource not found error, and 500 for internal server error. A business failure will print the ERROR log and return the abnormal return code at the same time. The ERROR log and the abnormal return code together represent a business failure, and one abnormal return code corresponds to an ERROR log.

[0131] In the embodiment of the present application, by inputting the first alarm information into the large model, determining whether a system failure exists through the large model, the efficiency and accuracy of determining the system failure are improved.

[0132] In some embodiments, obtaining the alarm information of the root cause node includes: obtaining the alarm information of the root cause node from various historical alarm information of the transaction system according to the occurrence time of the abnormal transaction, the root cause node, and the server through which the abnormal transaction passes.

[0133] Specifically, there are multiple alarm information. When obtaining the alarm information of the root cause node, the alarm information of the root cause node of the abnormal transaction needs to be screened out from the historical alarm information. According to the time when the abnormal transaction occurred, the root cause node, and the server through which the abnormal transaction passed, the alarm information of the root cause node is determined from the historical alarm information.

[0134] In an embodiment of the present application, historical alarm information is filtered according to time, root cause node, and server, thereby filtering out the alarm information of the root cause node, thereby improving the efficiency of analyzing and processing the alarm information and avoiding the tediousness of searching for the alarm information of the root cause node in massive alarm information.

[0135] In some embodiments, from the field lineage relationship, the lineage factor that causes the field variable to change is determined as the root cause of the abnormal transaction, such as Figure 7 As shown, the following steps are included:

[0136] Step 701: Determine the blood relationship factors corresponding to the field variables from the field blood relationship.

[0137] Specifically, field lineage refers to how the value of a field is generated from source data and passed to target data during data processing. Specifically, field lineage describes the source and flow of data during processing, helping to understand and manage the data processing process. Field lineage includes multiple field variables, and any field variable corresponds to a lineage factor. The lineage factor is the table or function where the field variable is located.

[0138] Step 702: For any blood relationship factor, determine whether the blood relationship factor has changed before the abnormal transaction occurs.

[0139] Specifically, before the abnormal transaction occurs, if the blood relationship factor has not changed, then the blood relationship factor is not the cause of the abnormality; if the blood relationship factor has changed, then the blood relationship factor may be the cause of the abnormal transaction. Therefore, for any blood relationship factor, it is determined whether the blood relationship factor has changed before the abnormal transaction occurs.

[0140] Step 703: determine the changed blood relationship factor as the root cause of the abnormal transaction.

[0141] Specifically, if the blood relationship factor changes, the blood relationship factor is regarded as the root cause of the abnormal transaction; if the blood relationship factor does not change, the blood relationship factor does not lead to the abnormal transaction.

[0142] The following is an explanation of the root cause of abnormal transactions based on bloodline factors using specific code lines:

[0143] 1 package com.example; 2

[0145] 3 public class TestClass { 4

[0147] 5 private int x = 10; 6

[0149] 7 public void F4(int a,int b){

[0150] 8 if(a==0){

[0151] 9 throw new IllegalArgumentException("Argument a Cannot be zero");

[0152] 10}

[0153] 11 int result = b / a;

[0154] 12 System.out.println("Result:" + result);

[0155] 13} 14

[0157] 15 public static void main(String[] args) {

[0158] 16 TestClass testClass = new TestClass();

[0159] 17 try {

[0160] 18 testClass.F4(0, 10);

[0161] 19} catch (Exception e) {

[0162] 20 e.printStackTrace();

[0163] 21}

[0164] 22}

[0165] 23}

[0166] Error Log:

[0167] [main] ERROR com.example.ExceptionAdvice - Exception occurred: Argument a cannot be zero;

[0168] java.lang.IllegalArgumentException: Argument a cannot be zero;

[0169] at com.example.TestClass.F4(TestClass.java:9);

[0170] at com.example.TestClass.main(TestClass.java:19).

[0171] As shown above, the error log is located at line 9 of the code class com.example.TestClass method testMethod.

[0172] Assume that the variable field a of function F4 is obtained by processing the field columnA in table 3 and fieldA_F1 of function F1, and the fieldA_F1 of function F1 is obtained by fieldA in request interface A. The field lineage of variable field a is:

[0173] fieldA->fieldA_F1->a<-columnA.

[0174] In the embodiment of the present application, by determining whether the bloodline factor has changed before the abnormal transaction occurs, it is possible to determine whether the bloodline factor is the root cause of the abnormal transaction, thereby improving the efficiency and accuracy of confirming the root cause of the abnormal transaction.

[0175] Based on the same technical concept, the present application embodiment provides a root cause location device 800 for abnormal transactions, such as Figure 8 As shown, including:

[0176] The acquisition module 801 is used to acquire the abnormal transaction link where the abnormal transaction is located; any transaction link is a link representing the node processing flow generated based on each node that processes the transaction in the transaction system;

[0177] A determination module 802 is used to determine at least one normal transaction link having the same starting node as the abnormal transaction link;

[0178] The determination module 802 is further configured to determine the root cause node of the abnormal transaction according to the at least one normal transaction link;

[0179] The determination module 802 is further configured to determine a field variable that triggers the alarm information based on the alarm information of the root cause node;

[0180] The determination module 802 is further configured to determine, from the field lineage relationship, the lineage factor that causes the field variable to change as the root cause of the abnormal transaction.

[0181] Optionally, the determining module 802 is specifically configured to:

[0182] For any normal transaction link, determine a similar transaction link between the abnormal transaction link and the normal transaction link; the similar transaction link is a common part between the abnormal transaction link and the normal transaction link;

[0183] Determine a maximum similar transaction link from similar transaction links corresponding to each normal transaction link, wherein the maximum similar transaction link is a similar transaction link with the largest number of nodes and edges;

[0184] The nodes with different attributes between the maximum similarity transaction link and the corresponding normal transaction link are used as the root cause nodes of the abnormal transaction.

[0185] Optionally, the determining module 802 is specifically configured to:

[0186] Matching nodes with the same attributes in the normal transaction link and the abnormal transaction link to obtain a matching node pair;

[0187] The transaction link formed by the matching node pair with the same edge attribute is used as the similar transaction link between the abnormal transaction link and the normal transaction link.

[0188] Optionally, the determining module 802 is specifically configured to:

[0189] Obtaining alarm information of the root cause node;

[0190] Determining whether there is a system failure according to the first alarm information in the alarm information;

[0191] If there is no system failure, determining the abnormal code line in the root cause node according to the second alarm information in the alarm information;

[0192] Determine the field variable in the abnormal code line that triggers the warning information.

[0193] Optionally, the determining module 802 is specifically configured to:

[0194] The first alarm information in the alarm information is input into the large model to determine whether there is a system failure; the first alarm information includes at least one of database alarm information, service availability alarm information, server alarm information and test alarm information; the second alarm information includes at least one of log alarm information and return code alarm information.

[0195] Optionally, the acquisition module 801 is specifically used for:

[0196] According to the occurrence time of the abnormal transaction, the root cause node and the server through which the abnormal transaction passes, the alarm information of the root cause node is obtained from each historical alarm information of the transaction system.

[0197] Optionally, the determining module 802 is specifically configured to:

[0198] From the field kinship relationship, determine each kinship factor corresponding to the field variable;

[0199] For any blood relationship factor, determining whether the blood relationship factor has changed before the abnormal transaction occurs;

[0200] The changed blood relationship factor is determined as the root cause of the abnormal transaction.

[0201] Based on the same technical concept, the embodiment of the present application provides a computer device, which may be a terminal or a server, such as Fig. 9 As shown, it includes at least one processor 901 and a memory 902 connected to the at least one processor. The specific connection medium between the processor 901 and the memory 902 is not limited in the embodiment of the present application. Fig. 9 For example, the processor 901 and the memory 902 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, and the like.

[0202] In the embodiment of the present application, the memory 902 stores instructions that can be executed by at least one processor 901. The at least one processor 901 can execute the steps included in the above-mentioned method for locating the root cause of abnormal transactions by executing the instructions stored in the memory 902.

[0203] Among them, the processor 901 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, and perform master-slave abnormal recovery by running or executing instructions stored in the memory 902 and calling data stored in the memory 902. Optionally, the processor 901 may include one or more processing units, and the processor 901 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 901. In some embodiments, the processor 901 and the memory 902 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0204] Processor 901 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0205] The memory 902 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 902 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 902 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 902 in the embodiment of the present application can also be a circuit or any other execution device that can realize a storage function, for storing program instructions and / or data.

[0206] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned method for locating the root cause of abnormal transactions.

[0207] Based on the same inventive concept, an embodiment of the present application provides a computer program product, characterized in that the computer program product includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned root cause locating method for abnormal transactions.

[0208] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0209] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0210] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0211] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0212] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for locating the root cause of abnormal transactions, characterized in that: include: Obtain an abnormal transaction link where the abnormal transaction is located; any transaction link is a link representing a node processing flow generated based on each node that processes the transaction in the transaction system; Determine at least one normal transaction link having the same starting node as the abnormal transaction link; Determining a root cause node of the abnormal transaction according to the at least one normal transaction link; Based on the alarm information of the root cause node, determining the field variable that triggers the alarm information; From the field lineage relationship, the lineage factor causing the field variable to change is determined as the root cause of the abnormal transaction.

2. The method according to claim 1, characterized in that The determining the root cause node of the abnormal transaction according to the at least one normal transaction link includes: For any normal transaction link, determine a similar transaction link between the abnormal transaction link and the normal transaction link; the similar transaction link is a common part between the abnormal transaction link and the normal transaction link; Determine a maximum similar transaction link from similar transaction links corresponding to each normal transaction link, wherein the maximum similar transaction link is a similar transaction link with the largest number of nodes and edges; The nodes with different attributes between the maximum similarity transaction link and the corresponding normal transaction link are used as the root cause nodes of the abnormal transaction.

3. The method according to claim 2, characterized in that The determining of similar transaction links between the abnormal transaction link and the normal transaction link includes: Matching nodes with the same attributes in the normal transaction link and the abnormal transaction link to obtain a matching node pair; The transaction link formed by the matching node pair with the same edge attribute is used as the similar transaction link between the abnormal transaction link and the normal transaction link.

4. The method according to any one of claims 1 to 3, characterized in that The step of determining, based on the alarm information of the root cause node, a field variable that triggers the alarm information, comprises: Obtaining alarm information of the root cause node; Determining whether there is a system failure according to the first alarm information in the alarm information; If there is no system failure, determining the abnormal code line in the root cause node according to the second alarm information in the alarm information; Determine the field variable in the abnormal code line that triggers the warning information.

5. The method according to claim 4, characterized in that The determining whether there is a system failure according to the first alarm information in the alarm information includes: The first alarm information in the alarm information is input into the large model to determine whether there is a system failure; the first alarm information includes at least one of database alarm information, service availability alarm information, server alarm information and test alarm information; the second alarm information includes at least one of log alarm information and return code alarm information.

6. The method according to claim 4, characterized in that Obtaining the alarm information of the root cause node includes: According to the occurrence time of the abnormal transaction, the root cause node and the server through which the abnormal transaction passes, the alarm information of the root cause node is obtained from each historical alarm information of the transaction system.

7. The method according to any one of claims 1 to 3, characterized in that: From the field lineage relationship, the lineage factor causing the field variable to change is determined as the root cause of the abnormal transaction, including: From the field kinship relationship, determine each kinship factor corresponding to the field variable; For any blood relationship factor, determining whether the blood relationship factor has changed before the abnormal transaction occurs; The changed blood relationship factor is determined as the root cause of the abnormal transaction.

8. A root cause location device for abnormal transactions, characterized in that: include: An acquisition module is used to acquire an abnormal transaction link where an abnormal transaction is located; any transaction link is a link representing a node processing flow generated based on each node that processes the transaction in the transaction system; A determination module, configured to determine at least one normal transaction link having the same starting node as the abnormal transaction link; The determination module is further configured to determine a root cause node of the abnormal transaction according to the at least one normal transaction link; The determination module is further used to determine the field variable that triggers the alarm information based on the alarm information of the root cause node; The determination module is further used to determine the blood relationship factor that causes the field variable to change as the root cause of the abnormal transaction from the field blood relationship.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer device, and when the program is run on the computer device, the computer device executes the steps of any one of the methods of claims 1 to 7.

11. A computer program product, characterized in that The computer program product comprises a computer program stored on a computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer device, the computer device is caused to execute the steps of the method according to any one of claims 1 to 7.

Images