Abnormity diagnosis method, system and equipment based on log and storage medium

Abstract

The invention provides a log-based anomaly diagnosis method, system and device and a storage medium, and relates to the technical field of computer application. The log-based anomaly diagnosis method comprises the following steps: acquiring log data of a plurality of application services; synchronizing the log data to an anomaly detection model, obtaining an abnormal log in the log data, obtaining key feature data according to the abnormal log, and generating vector data according to the key feature data; obtaining an analysis report according to the key feature data; retrieving a historical fault database according to the key feature data and the vector data to obtain similar historical cases; and generating push information according to the analysis report and the similar historical cases. By the adoption of the log-based anomaly diagnosis method, complex log anomalies can be automatically recognized and analyzed, meanwhile, an analysis report is automatically generated, similar historical cases are recommended, manual intervention is reduced, and more accurate anomaly diagnosis and solutions are provided.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and more specifically, to a log-based abnormality diagnosis method, system, device and storage medium. Background Art

[0002] Currently, log processing and anomaly detection usually involves simple anomaly identification and alarming of log data based on preset keywords or rules, and then notifying relevant personnel to handle the problem. Although this method can provide preliminary error information, it is limited to surface-level monitoring and cannot perform in-depth analysis. It also has the following problems:

[0003] 1. Lack of intelligent analysis capabilities: Current log anomaly detection mainly relies on rule matching or keyword capture, which cannot intelligently identify potential abnormal patterns or root causes, lacks adaptive capabilities, and lacks intelligent reasoning and automatic repair capabilities.

[0004] 2. High reliance on manual intervention: After an exception occurs, the system only provides simple error information, which often requires manual detailed analysis and positioning. R&D personnel need to manually diagnose and solve the problem, which is inefficient and prone to omissions or misjudgments.

[0005] 3. Difficulty in knowledge accumulation and sharing: Every time a problem occurs, R&D personnel need to analyze it from scratch and cannot reuse historical cases or solutions. The system cannot realize the accumulation of knowledge and intelligence, resulting in a lack of experience accumulation in the processing process. Summary of the invention

[0006] In order to solve the problems or at least part of the problems existing in the above-mentioned prior art, the embodiments of the present invention provide a log-based anomaly diagnosis method, system, storage medium, device and computer program product, which obtains abnormal logs and key feature data through an anomaly detection model, and then obtains analysis reports and similar historical cases in the historical fault database based on the key feature data. It can automatically identify and analyze complex log anomalies, and at the same time, automatically generate analysis reports and recommend similar historical cases, reduce manual intervention, and provide more accurate anomaly diagnosis and solutions.

[0007] According to the first aspect of the present invention, an embodiment of the present invention provides a log-based exception diagnosis method, which includes: obtaining log data of multiple application services; synchronizing the log data to an exception detection model, obtaining exception logs in the log data, obtaining key feature data based on the exception logs, and generating vector data based on the key feature data, wherein the key feature data includes: error information, exception keywords, exception stack trace information, thread ID; obtaining an analysis report based on the key feature data; searching a historical fault database based on the key feature data and vector data to obtain similar historical cases; generating push information based on the analysis report and similar historical cases.

[0008] According to the above-mentioned embodiment of the present invention, by synchronizing the acquired log data to the anomaly detection model, acquiring the anomaly log and key feature data, and then acquiring the analysis report based on the key feature data, and searching the historical fault database based on the key feature data and the vector data generated based on the key feature data to obtain similar historical cases, it is possible to automatically identify and analyze complex log anomalies, improve the accuracy and comprehensiveness of detection, and at the same time, automatically generate analysis reports and recommend similar historical cases, thereby reducing the workload of manual diagnosis and improving problem solving efficiency.

[0009] In some embodiments of the present invention, obtaining an analysis report based on the key feature data includes: obtaining a call chain of a thread corresponding to the thread ID based on the thread ID; obtaining report information in the analysis report based on the call chain, the report information including: service name, stack information, call chain of the thread ID, occurrence time, and error code.

[0010] In some embodiments of the present invention, the abnormality diagnosis method further includes: acquiring a solution according to the push information, and sending the solution and vector data to the historical fault database.

[0011] According to the above-mentioned embodiments of the present invention, by storing the solutions and vector data in the historical fault database, rich historical knowledge can be gradually accumulated, thereby accelerating the resolution of subsequent similar problems, and providing valuable data support for model optimization.

[0012] In some embodiments of the present invention, obtaining key feature data based on the exception log includes: extracting key feature data from the exception log through natural language processing (NLP) technology; searching the historical fault database based on the key feature data and vector data to obtain similar historical cases includes: retrieving similar historical cases corresponding to the exception log in the historical fault database through the NLP technology.

[0013] According to the second aspect of the present invention, an embodiment of the present invention provides a log-based exception diagnosis system, which includes: a log acquisition module, used to acquire log data of multiple application services; a feature data extraction module, used to synchronize the log data to an exception detection model, acquire exception logs in the log data, acquire key feature data based on the exception logs, and generate vector data based on the key feature data, wherein the key feature data includes: error information, exception keywords, exception stack tracing information, thread ID; an analysis report acquisition module, used to acquire an analysis report based on the key feature data; a case acquisition module, used to search a historical fault database based on the key feature data and vector data to acquire similar historical cases; a push information acquisition module, used to generate push information based on the analysis report and similar historical cases.

[0014] According to the above-mentioned embodiment of the present invention, by synchronizing the acquired log data to the anomaly detection model, acquiring the anomaly log and key feature data, and then acquiring the analysis report based on the key feature data, and searching the historical fault database based on the key feature data and the vector data generated based on the key feature data to obtain similar historical cases, it is possible to automatically identify and analyze complex log anomalies, improve the accuracy and comprehensiveness of detection, and at the same time, automatically generate analysis reports and recommend similar historical cases, thereby reducing the workload of manual diagnosis and improving problem solving efficiency.

[0015] In some embodiments of the present invention, obtaining an analysis report based on the key feature data includes: obtaining a call chain of a thread corresponding to the thread ID based on the thread ID; obtaining report information in the analysis report based on the call chain, the report information including: service name, stack information, call chain of the thread ID, occurrence time, and error code.

[0016] In some embodiments of the present invention, the abnormality diagnosis system further includes an incremental learning module for acquiring a solution according to the push information, and sending the solution and vector data to the historical fault database.

[0017] According to the above-mentioned embodiments of the present invention, by storing the solutions and vector data in the historical fault database, rich historical knowledge can be gradually accumulated, thereby accelerating the resolution of subsequent similar problems, and providing valuable data support for model optimization.

[0018] In some embodiments of the present invention, obtaining key feature data based on the exception log includes: extracting key feature data from the exception log through natural language processing (NLP) technology; searching the historical fault database based on the key feature data and vector data to obtain similar historical cases includes: retrieving similar historical cases corresponding to the exception log in the historical fault database through the NLP technology.

[0019] According to the third aspect of the present invention, an embodiment of the present invention provides a computer-readable storage medium having computer-readable instructions stored thereon. When the computer-readable instructions are executed by a processor, the computer performs the following operations: the operations include the steps included in the log-based anomaly diagnosis method described in any of the above embodiments.

[0020] According to the fourth aspect of the present invention, an embodiment of the present invention provides a computer device including a memory and a processor, wherein the memory is used to store one or more computer-readable instructions, wherein the one or more computer-readable instructions, when executed by the processor, can implement the log-based anomaly diagnosis method as described in any one of the above embodiments.

[0021] According to a fifth aspect of the present invention, an embodiment of the present invention provides a computer program product including a computer program, and when the computer program is executed by a processor, the log-based anomaly diagnosis method as described in any one of the above embodiments is implemented.

[0022] From the above, it can be seen that the log-based anomaly diagnosis method, system, storage medium, device and computer program product provided by the embodiments of the present invention, by synchronizing the acquired log data to the anomaly detection model, obtaining the anomaly log and key feature data, and then obtaining the analysis report based on the key feature data, and searching the historical fault database based on the key feature data and the vector data generated based on the key feature data to obtain similar historical cases, can automatically identify and analyze complex log anomalies, improve the accuracy and comprehensiveness of detection, and at the same time, automatically generate analysis reports and recommend similar historical cases, reduce the workload of manual diagnosis, and improve problem solving efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 is a flow chart of a log-based abnormality diagnosis method according to Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of a log-based abnormality diagnosis method according to Embodiment 2 of the present invention;

[0025] Figure 3 4 is a schematic diagram of the architecture of a log-based abnormality diagnosis system according to Example 3 of the present invention. DETAILED DESCRIPTION

[0026] The various aspects of the present invention are described in detail below in conjunction with the accompanying drawings and specific embodiments. Among them, well-known modules, units and their connections, links, communications or operations are not shown or described in detail. In addition, the described features, architectures or functions can be combined in any way in one or more embodiments. It should be understood by those skilled in the art that the various embodiments described below are only used for illustration and are not intended to limit the scope of protection of the present invention. It can also be easily understood that the modules or units or processing methods in each embodiment described herein and shown in the accompanying drawings can be combined and designed in various different configurations.

[0027] The following is a brief description of the terms used in this article.

[0028] NLP: Natural Language Processing, which enables computers to understand, process and generate human natural language.

[0029] Kafka: An open source stream processing platform.

[0030] ES: Elasticsearch, referred to as ES, is an open source distributed search engine based on the Lucene library.

[0031] API: Application Programming Interface, application programming interface.

[0032] Dense vector: A vector in which most of its elements are non-zero.

[0033] BERT: Bidirectional Encoder Representations from Transformers, a pre-trained language model.

[0034] GPT: Generative Pretrained Transformer, a pre-trained language model.

[0035] Error log: Error log is the relevant information recorded when errors or abnormal situations occur during the operation of the system, application, etc., including: timestamp, error source, error type, error code, error message, etc.

[0036] AI: Artificial Intelligence.

[0037] [Example 1]

[0038] Figure 1 4 is a flow chart of a log-based abnormality diagnosis method according to Embodiment 1 of the present invention.

[0039] like Figure 1 As shown, in Embodiment 1 of the present invention, the log-based abnormality diagnosis method may include: step S11, step S12, step S13, step S14 and step S15, and the above steps are described in detail below.

[0040] In step S11, log data of multiple application services is obtained.

[0041] In some implementations, the log data of each application service is synchronized to the ES platform through the middleware kafka. Among them, ES, as a log storage and retrieval engine, can support large-scale log data management, thereby achieving centralized storage and efficient query.

[0042] In step S12, the log data is synchronized to the exception detection model, the exception log in the log data is obtained, the key feature data is obtained according to the exception log, and the (feature) vector data is generated according to the key feature data, wherein the key feature data includes: error information, exception keywords, exception stack tracing information, and thread ID.

[0043] In some embodiments, key feature data is extracted from the abnormal log by NLP technology. Advanced natural language processing technology, such as BERT, GPT and other pre-trained large models, is used to extract key feature information such as error information, abnormal keywords, stack traces, etc. from the log text.

[0044] In this embodiment, the anomaly detection model is constructed by a deep learning algorithm, and an API interface is provided to facilitate the client to use the model. Specifically, the anomaly detection model is obtained through the following steps:

[0045] (1) Data cleaning: Perform standard cleaning on the exception log to obtain stack information, business keywords, service name, thread ID, etc.

[0046] (2) The cleaned standard data and related solutions are stored in the vector database. Optionally, key information is extracted from the exception log, such as keywords, stack information, error code, service name, error unique identifier, occurrence time, thread ID, etc., and then the stack information and keywords are converted into dense vector representation using natural language processing technology and stored in the vector database.

[0047] (3) Extracting key feature data, such as exception type, error code, etc. The key feature data is obtained through NLP processing, including word segmentation, stop word removal, and stem extraction operations.

[0048] (4) Use autoencoder for model training based on deep learning algorithm.

[0049] In step S13, an analysis report is obtained according to the key feature data. In this embodiment, a causal reasoning algorithm is used to perform in-depth analysis on the anomaly to obtain the analysis report.

[0050] In some implementations, obtaining an analysis report based on the key feature data includes: obtaining a call chain of a thread corresponding to the thread ID based on the thread ID; obtaining report information in the analysis report based on the call chain, the report information including: service name, stack information, call chain of the thread ID, occurrence time, and error code. The stack information (exception stack information) includes, but is not limited to: exception type, exception message, affected method name, affected method class name, and line number.

[0051] In an optional implementation, when no relevant solution is found in the vector database based on the vector data, the key feature data is analyzed as follows: checking the exception type, identifying the exception keyword (case by) to continue stack tracing, and tracing the complete call chain through the thread ID to obtain the context, thereby obtaining an analysis report including the following information: service name, stack information, exception type, affected method name, thread ID call chain, occurrence time, error code and other information.

[0052] In step S14, a historical fault database is searched based on the key feature data and vector data to obtain similar historical cases.

[0053] In some embodiments, similar historical cases corresponding to the exception log are retrieved in the historical fault database / vector database through NLP technology to obtain solutions. Optionally, according to the keywords and stack information of the exception log, vector retrieval is performed through the historical fault database / vector database to find the data with the closest similarity as similar historical cases. The vector database includes but is not limited to: stack information, service name, solution, service code, exception type, keyword, service identifier, and solver.

[0054] In step S15, push information is generated according to the analysis report and similar historical cases.

[0055] In some implementations, anomaly detection results, real-time analysis reports, and similar cases are pushed to relevant R&D personnel via WeChat for Business.

[0056] In a further embodiment, the abnormality diagnosis method further comprises: obtaining a solution according to the push information, and sending the solution and vector data to the historical fault database. Furthermore, the solution is used as incremental data for updating and retraining the model.

[0057] The historical fault database includes: logs, feature data vectors, and solutions. The solutions are obtained through manual processing based on similar historical cases obtained by similarity matching based on stack information and entered into the historical fault database and vector database; the vector database stores the resolved and effective anomaly information and solutions; the historical fault database stores the full amount of data.

[0058] By storing solutions and vector data in the historical fault database, rich historical knowledge can be gradually accumulated, thereby accelerating the resolution of subsequent similar problems and providing valuable data support for model optimization.

[0059] The above-mentioned log-based anomaly diagnosis method of Example 1 of the present invention is adopted, by synchronizing the acquired log data to the anomaly detection model, obtaining the anomaly log and key feature data, and then obtaining the analysis report based on the key feature data, and searching the historical fault database based on the key feature data and the vector data generated according to the key feature data to obtain similar historical cases. It can automatically identify and analyze complex log anomalies, improve the accuracy and comprehensiveness of detection, and at the same time, automatically generate analysis reports and recommend similar historical cases, reduce the workload of manual diagnosis, and improve problem solving efficiency.

[0060] [Example 2]

[0061] Figure 2 4 is a flow chart of a log-based abnormality diagnosis method according to Embodiment 2 of the present invention.

[0062] like Figure 2 As shown, in Embodiment 2 of the present invention, the log-based abnormality diagnosis method may include the following steps:

[0063] (1) Synchronize the logs of various application services to ES (elasticsearch) through Kafka.

[0064] (2) Extract key feature data from logs through NLP technology, such as error logs or keywords.

[0065] (3) Sending the extracted logs to the anomaly detection model for judgment. In some implementations, the anomaly detection model is used to perform log validity judgment, warning validity judgment, solution judgment, and whether the call chain is traced on the log data of multiple application services obtained. The above judgments are used to determine whether the log is a valid warning, whether there is a relevant solution, and whether the call chain needs to be traced.

[0066] (4) The acquired abnormal logs are subjected to causal reasoning algorithms to obtain in-depth analysis reports, and similar cases are matched from the fault database based on the NLP similarity algorithm.

[0067] (5) Push the analysis report and similar cases to relevant responsible persons via WeChat for Business.

[0068] (6) The relevant responsible personnel check the warning information sent through the enterprise WeChat or management background and provide the correct solution, and then synchronize the solution to the fault database. At the same time, the anomaly detection model performs deep learning on the incremental data in the fault database.

[0069] The above-mentioned log-based anomaly diagnosis method of Example 2 of the present invention significantly improves the automation and intelligence level of log processing by integrating AI and big data technology, reduces dependence on manual work, and improves the efficiency and accuracy of problem solving. More specifically, (1) it can intelligently analyze anomalies in logs, and provide more accurate anomaly diagnosis and solutions through deep learning and causal reasoning; (2) through intelligent report generation and solution recommendation, it greatly reduces the manual analysis work of R&D personnel, so that they can focus more on problem solving itself, thereby reducing manual intervention and improving the level of automation and work efficiency; (3) through continuous incremental learning, it can continuously optimize the anomaly detection model, and over time, the accuracy and stability of detection gradually improve, gradually forming a "self-evolving" intelligent system; (4) it can record the process and solution of each problem solving and feedback to the fault case database, gradually accumulate rich historical knowledge, which can not only accelerate the solution of subsequent similar problems, but also provide valuable data support for model optimization; (5) through AI intelligent processing and real-time anomaly detection, enterprises can quickly respond to and solve potential problems, reduce downtime and service interruption, and improve system reliability and stability.

[0070] [Example 3]

[0071] Figure 3 4 is a schematic diagram of the architecture of a log-based abnormality diagnosis system according to Example 3 of the present invention.

[0072] like Figure 3As shown, the log-based abnormality diagnosis system includes: a log acquisition module 310, a feature data extraction module 320, an analysis report acquisition module 330, a case acquisition module 340, a push information acquisition module 350, and an incremental learning module 360.

[0073] The log acquisition module 310 is used to acquire log data of multiple application services.

[0074] In some implementations, the log data of each application service is synchronized to the ES platform through the middleware kafka. Among them, ES, as a log storage and retrieval engine, can support large-scale log data management, thereby achieving centralized storage and efficient query.

[0075] The feature data extraction module 320 is used to synchronize the log data to the exception detection model, obtain the exception log in the log data, obtain key feature data according to the exception log, and generate vector data according to the key feature data, wherein the key feature data includes: error information, exception keywords, exception stack trace information, and thread ID.

[0076] In some embodiments, key feature data is extracted from the abnormal log by NLP technology. Advanced natural language processing technology, such as BERT, GPT and other pre-trained large models, is used to extract key feature information such as error information, abnormal keywords, stack traces, etc. from the log text.

[0077] The analysis report acquisition module 330 is used to acquire an analysis report according to the key feature data.

[0078] In some implementations, obtaining an analysis report based on the key feature data includes: obtaining a call chain of a thread corresponding to the thread ID based on the thread ID; obtaining report information in the analysis report based on the call chain, the report information including: service name, stack information, call chain of the thread ID, occurrence time, and error code. The stack information (exception stack information) includes, but is not limited to: exception type, exception message, affected method name, affected method class name, and line number.

[0079] The case acquisition module 340 is used to search the historical fault database according to the key feature data and vector data to obtain similar historical cases.

[0080] In some implementations, NLP technology is used to retrieve similar historical cases corresponding to the abnormal log in a historical fault database to obtain a solution.

[0081] The push information acquisition module 350 is used to generate push information according to the analysis report and similar historical cases.

[0082] In some implementations, anomaly detection results, real-time analysis reports, and similar cases are pushed to relevant R&D personnel via WeChat for Business.

[0083] The incremental learning module 360 ​​is used to obtain a solution based on the push information, and send the solution and vector data to the historical fault database. The solution is used as incremental data to update and retrain the model. By storing the solution and vector data in the historical fault database, rich historical knowledge can be gradually accumulated, thereby accelerating the solution of subsequent similar problems and providing valuable data support for model optimization.

[0084] The above-mentioned log-based anomaly diagnosis system of Example 3 of the present invention is adopted, by synchronizing the acquired log data to the anomaly detection model, obtaining the anomaly log and key feature data, and then obtaining the analysis report based on the key feature data, and searching the historical fault database based on the key feature data and the vector data generated according to the key feature data to obtain similar historical cases. It can automatically identify and analyze complex log anomalies, improve the accuracy and comprehensiveness of detection, and at the same time, automatically generate analysis reports and recommend similar historical cases, reduce the workload of manual diagnosis, and improve problem solving efficiency.

[0085] Through the description of the above implementation modes, those skilled in the art can clearly understand that the present invention can be implemented by combining software with a hardware platform. Based on such an understanding, all or part of the contribution of the technical solution of the present invention to the background technology can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various implementation modes of the present invention or some parts of the implementation modes.

[0086] Correspondingly, an embodiment of the present invention further provides a computer-readable storage medium on which computer-readable instructions or programs are stored. When the computer-readable instructions or programs are executed by a processor, the computer performs the following operations: the operations include the steps included in the log-based abnormality diagnosis method described in any of the above embodiments, which are not repeated here. The storage medium may include, for example, a CD, a hard disk, a floppy disk, a flash memory, a magnetic tape, etc.

[0087] In addition, an embodiment of the present invention further provides a computer device including a memory and a processor, wherein the memory is used to store one or more computer-readable instructions or programs, wherein the one or more computer-readable instructions or programs, when executed by the processor, can implement the log-based abnormality diagnosis method described in any of the above embodiments. The computer device can be, for example, a server, a desktop computer, a notebook computer, a tablet computer, etc.

[0088] The embodiment of the present invention also provides a computer program product including a computer program, wherein the computer program includes a program code for executing the log-based abnormality diagnosis method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the log-based abnormality diagnosis method provided by the embodiment of the present disclosure.

[0089] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention is described in detail with reference to the above embodiments, a person skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention. Therefore, the protection scope of the present invention shall be subject to the claims.

Claims

1. A log-based abnormality diagnosis method, characterized in that: The abnormality diagnosis method comprises: Get log data for multiple application services; Synchronize the log data to the anomaly detection model, obtain an anomaly log in the log data, obtain key feature data according to the anomaly log, and generate vector data according to the key feature data, wherein the key feature data includes: error information, anomaly keywords, anomaly stack trace information, and a thread ID; Obtaining an analysis report based on the key feature data; Searching a historical fault database according to the key feature data and the vector data to obtain similar historical cases; Generate push information based on the analysis report and similar historical cases.

2. The abnormality diagnosis method according to claim 1, characterized in that: The analysis report obtained based on the key feature data includes: Obtaining a call chain of a thread corresponding to the thread ID according to the thread ID; The report information in the analysis report is obtained according to the call chain, where the report information includes: service name, stack information, call chain of the thread ID, occurrence time, and error code.

3. The abnormality diagnosis method according to claim 1, characterized in that: The abnormality diagnosis method further comprises: A solution is obtained according to the pushed information, and the solution and vector data are sent to the historical fault database.

4. The abnormality diagnosis method according to claim 1, characterized in that: Acquiring key feature data according to the abnormal log includes: extracting key feature data from the abnormal log by natural language processing (NLP) technology; Searching the historical fault database according to the key feature data and the vector data to obtain similar historical cases includes: searching the historical fault database for similar historical cases corresponding to the abnormal logs by using the NLP technology.

5. A log-based abnormality diagnosis system, characterized in that: The abnormality diagnosis system comprises: Log acquisition module, used to obtain log data of multiple application services; A feature data extraction module is used to synchronize the log data to the anomaly detection model, obtain the anomaly log in the log data, obtain key feature data according to the anomaly log, and generate vector data according to the key feature data, wherein the key feature data includes: error information, anomaly keywords, anomaly stack trace information, and thread ID; An analysis report acquisition module, used to acquire an analysis report based on the key feature data; A case acquisition module, used to search the historical fault database according to the key feature data and vector data to obtain similar historical cases; The push information acquisition module is used to generate push information based on the analysis report and similar historical cases.

6. The abnormality diagnosis system according to claim 5, characterized in that: The analysis report obtained based on the key feature data includes: Obtaining a call chain of a thread corresponding to the thread ID according to the thread ID; The report information in the analysis report is obtained according to the call chain, where the report information includes: service name, stack information, call chain of the thread ID, occurrence time, and error code.

7. The abnormality diagnosis system according to claim 5, characterized in that: The abnormality diagnosis system also includes an incremental learning module, which is used to obtain a solution according to the pushed information and send the solution and vector data to the historical fault database.

8. A computer-readable storage medium storing computer-readable instructions, characterized in that: The computer-readable instructions are executed by a processor to implement the abnormality diagnosis method according to any one of claims 1 to 4.

9. A computer device comprising a memory and a processor, The memory stores computer-readable instructions, characterized in that: The processor executes the computer-readable instructions to implement the abnormality diagnosis method according to any one of claims 1 to 4.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the abnormality diagnosis method according to any one of claims 1 to 4 is implemented.

Images