Automatic analysis method and device for server downtime dump file, equipment and medium

Abstract

The invention relates to the technical field of emerging information, and discloses a server downtime dump file automatic analysis method, device and equipment and a medium, and the method comprises the following steps: extracting feature information of a kernel dump file when a server downtime; matching the feature information of the kernel dump file with case features of a preset case database, and calculating a matching degree; and outputting a downtime case analysis result based on the matching degree and a preset matching threshold value. According to the method and the device, the threshold of analyzing the kernel dump file generated by server downtime can be reduced, the kernel dump file can be conveniently used by non-professional kernel developers, and the efficiency of analyzing server downtime reasons and repairing downtime problems by professional kernel developers is improved; and repeated analysis of partial downtime cases which have been analyzed by other developers and have repair schemes can also be avoided.

Description

Technical Field

[0001] The present invention relates to the field of emerging information technology, and in particular to a method, device, equipment and medium for automatically analyzing server downtime dump files. Background Art

[0002] Currently, most servers on the x86 or arm64 platforms rely on the kdump tool (the kdump tool is a tool in the Linux system used to save memory dumps (crash dumps) when the system crashes) to preserve the scene in the form of coredump files. After the crash, the crash tool (a tool for analyzing kernel dump files) is used to analyze the preserved coredump files to find the cause of the crash and repair it. However, the crash tool is a tool for professional kernel developers and has the following disadvantages:

[0003] 1. Complexity: The crash tool may be too complex for non-kernel developers. It requires familiarity and understanding of the underlying kernel structure, debugging techniques, and various command options, which may be a steep learning curve for non-professionals.

[0004] 2. Difficulty of analysis: The use of crash tools requires in-depth kernel knowledge and experience. It involves understanding complex concepts such as kernel data structures, symbol resolution, and debugging techniques. For non-professionals, understanding and analyzing this information may be a difficult task.

[0005] 3. Time consumption: It usually takes a long time to use crash tools for downtime analysis. Non-professionals may need to invest a lot of time and energy to learn and apply this tool, thus delaying the process of downtime analysis and repair.

[0006] 4. Unable to detect repeated crashes: The crash tool itself cannot automatically detect repeated crashes caused by the same reason. This means that even if the same crash occurs, non-professionals still need to analyze each crash case one by one, and will not get automated repetitive identification and analysis, wasting analysis time and increasing the complexity of debugging.

[0007] 5. Unable to detect known repair solutions: Crash tools cannot automatically detect crash cases that already have repair solutions. This means that when facing such crashes, technicians still need to repeatedly analyze and find repair solutions, which wastes time and reduces work efficiency. Summary of the invention

[0008] In view of this, the present invention provides a method, device, equipment and medium for automatically analyzing server crash dump files to solve the problem that crash tools must be oriented to professional kernel developers when analyzing kernel dump files, resulting in non-professional technicians being unable to analyze the causes of server crashes.

[0009] In a first aspect, the present invention provides a method for automatically analyzing a server crash dump file, the method comprising:

[0010] Extract characteristic information of the core dump file when the server crashes;

[0011] Match the characteristic information of the kernel dump file with the case characteristics of the preset case database, and calculate the matching degree;

[0012] The downtime case analysis results are output based on the matching degree and the preset matching threshold.

[0013] The server downtime dump file automatic analysis method provided by the present invention determines possible downtime causes and matching degrees by reading necessary characteristic information in a kernel dump file generated by a Linux server kernel downtime at runtime, and then comparing and matching the characteristic information with characteristic data of known cases recorded in a preset downtime case database, and outputs information such as analysis results that are easy to read. The method can lower the threshold for analyzing the kernel dump file generated by the server downtime, is convenient for non-professional kernel developers to use, improves the efficiency of professional kernel developers in analyzing the server downtime causes and repairing downtime problems, and can also avoid repeated analysis of some downtime cases that have been analyzed and have repair solutions by other developers. The method is used for automatic analysis of downtime causes of various servers and virtual machines based on Linux operating systems, greatly saves the analysis time of operation and maintenance and professional developers on online system downtime cases, improves the efficiency of solving downtime problems, and solves the problem that the crash tool must face professional kernel developers when analyzing kernel dump files, which makes it impossible for non-professional technicians to analyze the server downtime causes.

[0014] In an optional implementation, extracting characteristic information of a kernel dump file when a server crashes includes:

[0015] Automatically decompress the kernel dump file when the server crashes, and use analysis tools to extract the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes from the decompressed kernel dump file;

[0016] The kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes are used as feature information.

[0017] The automated analysis method for server downtime dump files provided by the present invention automatically decompresses the kernel dump files when the server is down, and uses an analysis tool to extract the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server is down from the decompressed kernel dump files, and uses the extracted data as feature information to extract necessary feature information as needed, which not only retains part of the memory content of the server when it is down and necessary information such as CPU registers, but also can add a custom database to the downtime database according to actual conditions, flexibly adjust feature data, minimum matching threshold, etc., and also provides conditions for the subsequent construction of a data structure for automatic comparison and analysis in the next step, thereby improving analysis efficiency.

[0018] In an optional implementation, before matching the characteristic information of the kernel dump file with the case characteristics of the preset case database, the server crash dump file automatic analysis method further includes:

[0019] A data structuring tool is used to structure the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes, and generate an identifiable feature information data structure.

[0020] The automated analysis method for server downtime dump files provided by the present invention uses a data structuring tool to structure the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes, and generates an identifiable feature information data structure, which is beneficial to the subsequent automatic comparative analysis of the feature information.

[0021] In an optional implementation, the preset case database includes a community case database and a custom case database;

[0022] Matching the characteristic information of the core dump file with the case characteristics of the preset case database and calculating the matching degree includes:

[0023] Obtain at least one corresponding case similar to the server downtime situation and case features in each corresponding case from a community case database and / or a custom case database;

[0024] The matching degree is calculated based on the identifiable feature information data structure and the case features to obtain at least one matching degree, and the one with the highest matching degree value is screened out from the at least one matching degree as the highest matching degree.

[0025] In an optional implementation, calculating the matching degree based on the identifiable feature information data structure and the corresponding case features includes:

[0026] Based on the identifiable feature information data structure and the corresponding case features, the matching degree is calculated in percentage form using an edit distance method or a statistical method.

[0027] The automated analysis method for server downtime dump files provided by the present invention records cases that have been analyzed by others into a downtime case database, and compares and matches them with feature data of known cases recorded in a preset downtime case database to determine possible downtime causes and matching degrees, thereby avoiding repeated manual analysis of the same case.

[0028] In an optional implementation, outputting the downtime case analysis result based on the size of the matching degree and the preset matching threshold includes:

[0029] The highest matching degree is compared with the preset matching threshold. When the highest matching degree is greater than the preset matching threshold, the analysis result of successful downtime case matching is obtained, and the corresponding case information of the highest matching degree is output. The corresponding case information includes the case source, cause analysis, solution and the highest matching degree value;

[0030] When the highest matching degree is less than the preset matching threshold, the analysis result of the downtime case matching failure is obtained, and the characteristic information of the kernel dump file when the server crashes is output, so that kernel developers can analyze the cause of the crash and obtain a solution to the server crash.

[0031] The automatic analysis method of server downtime dump files provided by the present invention compares the highest matching degree with a preset matching threshold value. When the highest matching degree is greater than the preset matching threshold value, an analysis result of successful matching of the downtime case is obtained, and corresponding case information of the highest matching degree is output. The corresponding case information includes case source, cause analysis, solution and the highest matching degree value. For many downtime cases whose causes have been analyzed by other developers and repair solutions are available, the method can automatically identify and provide analysis results and repair solutions, thereby improving analysis efficiency. The method can be used for automatic analysis of downtime causes of various servers and virtual machines based on Linux operating systems, greatly saving the analysis time of operation and maintenance and professional developers for online system downtime cases, and improving the efficiency of solving downtime problems. When the highest matching degree is less than the preset matching threshold value, an analysis result of failed matching of the downtime case is obtained, and characteristic information of the kernel dump file when the server is down is output, so that kernel research and development personnel can analyze the cause of the downtime and obtain a solution to the cause of the downtime, thereby achieving the purpose of facilitating operation and maintenance personnel and non-kernel developers to analyze the cause of the server downtime when matching fails.

[0032] In an optional implementation, the server downtime dump file automatic analysis method further includes:

[0033] The downtime cases that failed to match are treated as new cases, and the new cases, characteristic information corresponding to the new cases, and server downtime solutions are added to the custom case database.

[0034] The automated analysis method for server downtime dump files provided by the present invention treats downtime cases that fail to match as new cases, and adds the new cases and feature information and downtime cause solutions corresponding to the new cases to a custom case database, thereby providing a solution for analyzing similar downtime cases in the future, lowering the threshold for analyzing kernel dump files generated by server downtime (for use by non-professional kernel developers), improving the efficiency of developers in analyzing server downtime causes and fixing downtime problems, and avoiding repeated analysis of some downtime cases that have already been analyzed by other developers and have repair solutions.

[0035] In a second aspect, the present invention provides a device for automatically analyzing a server crash dump file, the device comprising:

[0036] Feature extraction module, used to extract feature information of kernel dump files when the server crashes;

[0037] A feature matching module is used to match the feature information of the kernel dump file with the case features of the preset case database and calculate the matching degree;

[0038] The case analysis module is used to output the downtime case analysis results based on the size of the matching degree and the preset matching threshold.

[0039] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the automatic analysis method of server crash dump files of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0040] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for automated analysis of server crash dump files of the first aspect or any corresponding embodiment thereof.

[0041] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the method for automated analysis of a server crash dump file according to the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 It is a flow chart of a method for automatically analyzing a server crash dump file according to an embodiment of the present invention;

[0044] Figure 2 It is a flow chart of another method for automatically analyzing a server crash dump file according to an embodiment of the present invention;

[0045] Figure 3 It is a flow chart of another method for automatically analyzing a server crash dump file according to an embodiment of the present invention;

[0046] Figure 4 It is a flow chart of another method for automatically analyzing a server crash dump file according to an embodiment of the present invention;

[0047] Figure 5 is a structural block diagram of a server crash dump file automatic analysis device according to an embodiment of the present invention;

[0048] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0050] The kernel dump file (referred to as coredump file) generated by a Linux server kernel crash is a compressed specific file format that retains part of the server's memory content and necessary information such as CPU registers at the time of the crash. The embodiment of the present invention extracts feature information of the coredump file during runtime, and then constructs a data structure for automatic comparison and analysis in the next step, and then compares it with feature data of known cases recorded in a crash case database to determine possible crash causes and matching degrees, and outputs easy-to-read analysis results and other information, thereby lowering the threshold for analyzing coredump files generated by server crashes, making it easier for non-professional kernel developers to use, improving the efficiency of developers in analyzing server crash causes and fixing crash problems, and avoiding repeated analysis of some crash cases that other developers have already analyzed and have repair plans for.

[0051] According to an embodiment of the present invention, an embodiment of a method for automated analysis of a server crash dump file is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0052] In this embodiment, a method for automatically analyzing a server crash dump file is provided, which can be used in the above-mentioned computer terminal, such as a central processing unit, etc. Figure 1 FIG. 1 is a flow chart of a method for automatically analyzing a server crash dump file according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0053] Step S101, extracting characteristic information of a kernel dump file when a server crashes.

[0054] Specifically, the server in this embodiment is a Linux server, and the kernel dump file is a file in a specific data format generated when the Linux kernel crashes and causes the server to crash after kdump is enabled in the Linux kernel (kdump is a tool and service used to capture memory operating parameters when the system crashes, deadlocks or freezes). The file retains part of the memory content of the server at the time of the crash and necessary feature information such as CPU registers, which is used to analyze the cause of the Linux kernel crash.

[0055] Step S102, matching the characteristic information of the kernel dump file with the case characteristics of the preset case database, and calculating the matching degree.

[0056] Specifically, the preset case database is a downtime case database, which records case feature data of known cases. The feature information of the kernel dump file is compared and matched with the case feature data of the known cases to determine the possible cause of the downtime and calculate the matching degree. There is at least one known case.

[0057] Step S103: outputting the downtime case analysis result based on the matching degree and the preset matching threshold.

[0058] Specifically, the preset matching threshold is the minimum matching threshold set by the user according to the actual situation. For example, if the matching degree is greater than the minimum matching threshold set by the user, the known case corresponding to the result with the highest matching degree value is used as the cause of the downtime case analyzed this time, and the source of the known case corresponding to the result with the highest matching degree, the downtime cause analysis, the solution, the actual matching degree percentage and other information are output.

[0059] The server crash dump file automatic analysis method provided in this embodiment determines the possible crash cause and matching degree by reading necessary feature information in the kernel dump file generated by the Linux server kernel crash at runtime, and then comparing and matching the feature information with the feature data of known cases recorded in a preset crash case database, and outputs information such as easy-to-read analysis results. This can lower the threshold for analyzing the kernel dump file generated by the server crash, make it easier for non-professional kernel developers to use it, improve the efficiency of professional kernel developers in analyzing the server crash cause and fixing the crash problem, and avoid repeated analysis of some crash cases that other developers have already analyzed and have repair solutions. It is used for automatic analysis of crash causes of various servers and virtual machines based on the Linux operating system, greatly saving the analysis time of operation and maintenance and professional developers on online system crash cases, improving the efficiency of solving crash problems, and solving the problem that the crash tool must face professional kernel developers when analyzing kernel dump files, which makes it impossible for non-professional technicians to analyze the server crash cause.

[0060] In this embodiment, a method for automatically analyzing a server crash dump file is provided, which can be used in the above-mentioned computer terminal, such as a central processing unit, etc. Figure 2 FIG. 1 is a flow chart of a method for automatically analyzing a server crash dump file according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0061] Step S201, extracting characteristic information of a kernel dump file when a server crashes.

[0062] Specifically, the above step S201 includes:

[0063] Step S2011, automatically decompress the kernel dump file when the server crashes, and use analysis tools to extract the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes from the decompressed kernel dump file.

[0064] Specifically, the analysis tool may be a crash tool, which is an open source tool that can load the coredump file generated when the Linux kernel crashes. Various commands can be used to extract the kernel log, CPU register value, kernel function call stack, kernel function call stack content, and kernel data structure when the server crashes in the coredump file. For example, the bt command extracts the current kernel function call stack stack trace information, and the log command extracts and displays the kernel log when the server crashes. The specific workflow of the crash tool is a mature related technology and will not be repeated here.

[0065] like Figure 4 As shown in the figure, when the Linux server crashes, the analysis tool is run, and the coredump file generated by the Linux kernel crash is automatically decompressed and read, and some feature information is extracted, including the kernel log, CPU register value, kernel function call stack, kernel function call stack content, kernel data structure and other necessary features of the server crash. In order to construct the feature information data structure for the next step of automatic comparison and analysis.

[0066] Step S2012, taking the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes as feature information.

[0067] Specifically, the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes are used as feature information for automatic comparison and analysis of data structures in the next step.

[0068] Step S202, using a data structuring tool to structure the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes, to generate a recognizable feature information data structure.

[0069] Specifically, data structuring tools include data flow diagrams, data dictionaries, entity relationship diagrams, logic trees and other tools. Data structuring tools are used to structure the kernel logs, CPU register values, kernel function call stacks, kernel function call stack contents and kernel data structures when the server crashes, and to organize and store feature information in a certain format and pattern to facilitate subsequent processing and analysis.

[0070] Step S203, matching the characteristic information of the kernel dump file with the case characteristics of the preset case database, and calculating the matching degree. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0071] Step S204: Output the downtime case analysis result based on the matching degree and the preset matching threshold. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0072] The automated analysis method for server downtime dump files provided in this embodiment automatically decompresses the kernel dump files when the server crashes, and uses an analysis tool to extract the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes from the decompressed kernel dump files, and uses the extracted data as feature information to extract necessary feature information on demand, which not only retains part of the memory content of the server at the time of the crash and necessary information such as CPU registers, but also can add a custom database to the downtime database according to actual conditions, flexibly adjust feature data, minimum matching threshold, etc., and use a data structuring tool to structure the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes, and generate a recognizable feature information data structure, which is conducive to the subsequent automatic comparative analysis of the feature information.

[0073] In this embodiment, a method for automatically analyzing a server crash dump file is provided, which can be used in a computer terminal, such as a central processing unit, etc. Figure 3 FIG. 1 is a flow chart of a method for automatically analyzing a server crash dump file according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0074] Step S301, extracting characteristic information of the kernel dump file when the server crashes. Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0075] Step S302, matching the characteristic information of the kernel dump file with the case characteristics of the preset case database, and calculating the matching degree.

[0076] Specifically, the preset case database includes a community case database and a custom case database, and the above step S302 includes:

[0077] Step S3021, obtaining at least one corresponding case similar to the server downtime and case features in each corresponding case from the community case database and / or the custom case database.

[0078] Specifically, Figure 4 As shown, the community case database mainly collects server downtime cases that have been reported and resolved by others from open source community channels such as the Linux kernel community and the CentOS community (open source technology exchange platform) on a regular basis, and uses analysis tools to extract case features of corresponding known cases (the extraction process is the same as step S201), thereby constructing case data for each known downtime case and adding it to the community case database.

[0079] The custom case database is mainly aimed at self-developed kernel codes, collecting server crash cases that have been solved by current kernel developers or have occurred but are not yet solved. The case features corresponding to the cases are extracted using the same method of extracting feature information as in the community case database, thereby constructing case data for each known crash case and adding it to the custom case database.

[0080] It should be noted that the preset case database is divided into two parts mainly to facilitate the distinction of cases according to actual conditions, and to adjust the characteristic values ​​of different databases and the analysis result output strategy according to different scenarios.

[0081] When a server downtime occurs, the downtime situation is analyzed, and at least one case similar to the server downtime situation and case features of each case are obtained from a community case database and / or a custom case database.

[0082] Step S3022, calculating the matching degree based on the identifiable feature information data structure and the corresponding case feature to obtain at least one matching degree, and selecting the one with the highest matching degree value from the at least one matching degree as the highest matching degree.

[0083] In some optional implementations, the above step S3022 includes:

[0084] Step a. Calculate the matching degree in percentage form based on the identifiable feature information data structure and the corresponding case features using an edit distance method or a statistical method.

[0085] 1. Based on the identifiable feature information data structure and the corresponding case features, the matching degree is calculated in percentage form based on the edit distance method, including:

[0086] The identifiable feature information data structure and the corresponding case features are converted into string a and string b respectively. The edit distance is a difference measure between two strings a and b, that is, a can be converted into b through at least several insertion, deletion, and substitution operations, which can be calculated by dynamic programming.

[0087] Define the edit distance between two strings as lev ab(|a|,|b|), the edit distance can be calculated using the following formula:

[0088]

[0089] Among them, |a| and |b| represent the length of string a and string b respectively, lev a，b (i, j) represents the distance between the first i characters in string a and the first j characters in string b. The three cases in min represent deletion, insertion, and replacement. For example, the first formula of min represents deleting characters from string a to equal string b, the second formula represents inserting characters into string a to equal string b, and the third formula represents replacement, depending on whether string a is equal to string b. a，b When the value of string a is greater than or equal to (i, j), divide the value of string b by the value of string a to get the percentage match.

[0090] 2. Based on the identifiable feature information data structure and the corresponding case features, the matching degree is calculated in percentage form based on statistical methods, including:

[0091] Based on statistical methods, text is usually converted into a vector to facilitate similarity calculation. If the number of case databases built is relatively small, the One-Hot method can be used. If the database is large, you can consider using the Word2Vector solution that maps a neural network into a word vector. Since the method is relatively mature, it will not be repeated here. Then, the text similarity can be obtained by calculating the cosine similarity between vectors. The calculation formula is as follows. The larger the value, the higher the text similarity, and then the best matching case is obtained and output to the user.

[0092]

[0093] Step S303: outputting the downtime case analysis result based on the matching degree and the preset matching threshold.

[0094] Specifically, Figure 4 As shown, the above step S303 includes:

[0095] Step S3031, compare the highest matching degree with the preset matching threshold. When the highest matching degree is greater than the preset matching threshold, the analysis result of successful matching of the downtime case is obtained, and the corresponding case information of the highest matching degree is output. The corresponding case information includes the case source, cause analysis, solution and the highest matching degree value.

[0096] Specifically, if the highest matching degree is greater than the minimum matching threshold set by the user, the known downtime case corresponding to the highest matching degree result will be used as the cause of the downtime case analyzed this time, and the case source, cause analysis, solution and highest matching degree percentage of the downtime case corresponding to the highest matching degree result will be output.

[0097] Step S3032, when the highest matching degree is less than the preset matching threshold, the analysis result of the downtime case matching failure is obtained, and the characteristic information of the kernel dump file when the server crashes is output, so that the kernel R&D personnel can analyze the cause of the crash and obtain a solution to the server crash.

[0098] Specifically, if the highest matching degree does not meet the minimum matching threshold set by the user, the crash case analyzed this time is considered to be a new case, and the corresponding prompt (analysis result of failed matching) and feature information extracted from the coredump file generated by the Linux kernel crash are output in a readable form. Then, the manual analysis mode is entered to wait for kernel developers to perform further analysis to obtain a solution to the server crash.

[0099] Step S304: The downtime case that failed to match is taken as a new case, and the new case and the feature information and server downtime solution corresponding to the new case are added to the custom case database.

[0100] Specifically, the analysis results and solutions of new cases are updated to the case database as needed, the database downtime cases are improved, and the preset case database is dynamically updated.

[0101] The automatic analysis method of server downtime dump files provided in this embodiment records the cases analyzed by others in the downtime case database, and compares and matches with the characteristic data of known cases recorded in the preset downtime case database to determine the possible downtime causes and matching degree, avoids repeated analysis of the same case, and can automatically identify and give analysis results and repair solutions for downtime cases that many other developers have analyzed the causes and have repair solutions, thereby improving the analysis efficiency. It can be used for automatic analysis of downtime causes of various servers and virtual machines based on Linux operating systems, greatly saving the analysis time of operation and maintenance and professional developers for online system downtime cases, and improving the efficiency of solving downtime problems. When the highest matching degree is less than the preset matching threshold, the analysis result of the downtime case matching failure is obtained, and the characteristic information of the kernel dump file when the server is down is output, so that the kernel R&D personnel can analyze the downtime causes and obtain the downtime cause solution, achieving the purpose of facilitating the operation and maintenance personnel and non-kernel developers to analyze the server downtime causes when the matching fails. In this embodiment, a server downtime dump file automatic analysis device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation methods, and the descriptions that have been made will not be repeated. As used below, the term "module" may be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0102] This embodiment provides a server crash dump file automatic analysis device, such as Figure 5 As shown, including:

[0103] The feature extraction module 501 is used to extract feature information of a kernel dump file when a server crashes.

[0104] The feature matching module 502 is used to match the feature information of the kernel dump file with the case features of the preset case database and calculate the matching degree.

[0105] The case analysis module 503 is used to output the downtime case analysis result based on the size of the matching degree and the preset matching threshold.

[0106] In some optional implementations, the feature extraction module 501 includes:

[0107] The data extraction unit is used to automatically decompress the kernel dump file when the server crashes, and use analysis tools to extract the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes from the decompressed kernel dump file.

[0108] The feature determination unit is used to use the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes as feature information.

[0109] In some optional implementations, the preset case database includes a community case database and a custom case database; the feature matching module 502 includes:

[0110] The similar case acquisition unit is used to acquire at least one corresponding case similar to the server downtime situation and case features in each corresponding case from the community case database and / or the custom case database.

[0111] The feature matching unit is used to calculate the matching degree based on the identifiable feature information data structure and the case feature to obtain at least one matching degree, and select the one with the highest matching degree value from the at least one matching degree as the highest matching degree.

[0112] In some optional implementations, the feature matching unit includes:

[0113] The matching degree calculation subunit is used to calculate the matching degree in percentage form based on the identifiable feature information data structure and the corresponding case features using an edit distance-based method or a statistical method.

[0114] In some optional implementations, the case analysis module 503 includes:

[0115] The matching success determination unit is used to compare the highest matching degree with the preset matching threshold. When the highest matching degree is greater than the preset matching threshold, an analysis result of successful matching of the downtime case is obtained, and the corresponding case information of the highest matching degree is output. The corresponding case information includes the case source, cause analysis, solution and the highest matching degree value.

[0116] The matching failure determination unit is used to obtain the analysis result of the matching failure of the downtime case when the highest matching degree is less than the preset matching threshold, and output the characteristic information of the kernel dump file when the server crashes, so that the kernel R&D personnel can analyze the cause of the downtime and obtain the server downtime solution.

[0117] In an optional implementation manner, the server downtime dump file automatic analysis device further includes:

[0118] The feature information structuring module is used to structure the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes using a data structuring tool to generate a recognizable feature information data structure.

[0119] The data update module is used to treat the downtime cases that failed to match as new cases, and add the new cases and the feature information and server downtime solutions corresponding to the new cases into the custom case database.

[0120] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0121] The server crash dump file automated analysis device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0122] The embodiment of the present invention also provides a computer device having the above Figure 5 The server crash dump file automatic analysis device shown.

[0123] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0124] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0125] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0126] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0127] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0128] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0129] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0130] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0131] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0132] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for automatically analyzing server downtime dump files, characterized in that: The method comprises: Extract characteristic information of the kernel dump file when the server crashes; Matching the characteristic information of the kernel dump file with the case characteristics of a preset case database, and calculating the matching degree; The downtime case analysis result is output based on the size of the matching degree and the preset matching threshold.

2. The method according to claim 1, characterized in that The feature information of the kernel dump file when the server crashes includes: Automatically decompressing the kernel dump file when the server crashes, and using an analysis tool to extract the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes from the decompressed kernel dump file; The kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes are used as feature information.

3. The method according to claim 2, characterized in that Before matching the characteristic information of the kernel dump file with the case characteristics of a preset case database, the method further includes: A data structuring tool is used to structure the kernel log, CPU register value, kernel function call stack, kernel function call stack content and kernel data structure when the server crashes, to generate a recognizable feature information data structure.

4. The method according to claim 3, characterized in that The preset case database includes a community case database and a custom case database; Matching the characteristic information of the kernel dump file with the case characteristics of a preset case database and calculating the matching degree includes: Obtain at least one corresponding case similar to the server downtime situation and case features in each corresponding case from a community case database and / or a custom case database; The matching degree is calculated based on the identifiable feature information data structure and the case feature to obtain at least one matching degree, and the one with the highest matching degree value is selected from the at least one matching degree as the highest matching degree.

5. The method according to claim 4, characterized in that Calculating the matching degree based on the identifiable feature information data structure and the corresponding case features includes: Based on the identifiable feature information data structure and the corresponding case features, the matching degree is calculated in percentage form using an edit distance method or a statistical method.

6. The method according to claim 4, characterized in that Outputting the downtime case analysis results based on the size of the matching degree and the preset matching threshold includes: Compare the highest matching degree with a preset matching threshold value. When the highest matching degree is greater than the preset matching threshold value, obtain an analysis result that the downtime case is successfully matched, and output corresponding case information with the highest matching degree, wherein the corresponding case information includes case source, cause analysis, solution, and highest matching degree value; When the highest matching degree is less than the preset matching threshold, the analysis result of the downtime case matching failure is obtained, and the characteristic information of the kernel dump file when the server crashes is output, so that kernel developers can analyze the cause of the crash and obtain a solution to the server crash.

7. The method according to claim 6, characterized in that The method further comprises: The downtime cases that failed to match are treated as new cases, and the new cases, characteristic information corresponding to the new cases, and server downtime solutions are added to the custom case database.

8. A server downtime dump file automatic analysis device, characterized in that: The device comprises: Feature extraction module, used to extract feature information of kernel dump files when the server crashes; A feature matching module, used for matching the feature information of the kernel dump file with the case features of a preset case database, and calculating the matching degree; The case analysis module is used to output the downtime case analysis result based on the size of the matching degree and the preset matching threshold.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the server crash dump file automated analysis method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the server crash dump file automatic analysis method according to any one of claims 1 to 7.

Images