A device fault diagnosis method, an electronic device, a storage medium, and a program product

Abstract

The present invention discloses a device fault diagnosis method, an electronic device, a storage medium, and a program product, relating to the technical field of device fault diagnosis, including achieving dynamic template matching through the device attribute information of the device to be diagnosed, realizing log collection of the device to be diagnosed through the found log collection template, and realizing automatic parsing of the collected target logs through the log parsing template, without restricting the parsable log types, which greatly improves the scalability. Fault diagnosis is performed on the device to be diagnosed by dynamically matching the corresponding diagnostic rules through the diagnostic rule template. Compared with fault diagnosis only through the threshold matching method and device status, it can flexibly adapt to different devices, improve the fault diagnosis ability, and achieve unified management and efficient fault diagnosis of heterogeneous devices. It solves the technical problems of poor scalability, low operation and maintenance efficiency, and limited fault diagnosis ability, and achieves the technical effects of good scalability, improved operation and maintenance efficiency, and improved fault diagnosis ability.

Description

Technical Field

[0001] The present invention relates to the technical field of equipment fault diagnosis, and in particular to an equipment fault diagnosis method, electronic equipment, storage medium and program product. Background Art

[0002] As data centers continue to expand, fault diagnosis of heterogeneous device clusters becomes increasingly complex.

[0003] Due to the heterogeneity of devices in a cluster, traditional fault diagnosis methods often require hard-coded configuration for different devices, and then perform fault diagnosis through threshold matching and device status monitoring, resulting in poor scalability, low operation and maintenance efficiency, and limited fault diagnosis capabilities. Summary of the Invention

[0004] The present invention provides a device fault diagnosis method, electronic equipment, storage medium and program product, which at least solve the problems of poor scalability, low operation and maintenance efficiency and limited fault diagnosis capability in related technologies.

[0005] The present invention provides a device fault diagnosis method, comprising:

[0006] Obtaining device attribute information of the device to be diagnosed; wherein the device attribute information includes the device manufacturer and at least one of the device model, firmware version, and system version;

[0007] According to the device attribute information, the corresponding log collection template, log parsing template and diagnosis rule template are searched from the metadata database respectively;

[0008] Collecting the target log of the device to be diagnosed using the log collection template; wherein the log type of the target log is any one of multiple log types;

[0009] Performing log parsing on the target log using the log parsing template to obtain a parsing result;

[0010] The diagnostic rule template is used to perform diagnostic rule matching according to the parsing result, and fault diagnosis is performed on the device to be diagnosed according to the matched diagnostic rule.

[0011] The present invention also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned device fault diagnosis methods when executing the computer program.

[0012] The present invention also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned device fault diagnosis methods are implemented.

[0013] The present invention also provides a computer program product, including a computer program, which when executed by a processor implements the steps of any of the above device fault diagnosis methods.

[0014] The beneficial effects of the present invention are as follows. Since dynamic template matching can be achieved through the device attribute information of the device to be diagnosed, log collection of the device to be diagnosed can be realized through the found log collection template, automatic parsing of the collected target logs can be realized through the log parsing template, and there is no restriction on the log types that can be parsed, which greatly improves the scalability. Fault diagnosis of the device to be diagnosed is performed by dynamically matching the corresponding diagnostic rules through the diagnostic rule template. Compared with the method of only performing fault diagnosis through threshold matching and device status, it can flexibly adapt to different devices, improve the fault diagnosis ability, and realize the unified management and efficient fault diagnosis of heterogeneous devices. Therefore, the technical problems of poor scalability, low operation and maintenance efficiency, and limited fault diagnosis ability can be solved, and the technical effects of good scalability, improved operation and maintenance efficiency, and improved fault diagnosis ability can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0016] Figure 1 It is a flowchart of an implementation of a device fault diagnosis method provided by an embodiment of the present invention;

[0017] Figure 2 It is a flowchart of an implementation of another device fault diagnosis method provided by an embodiment of the present invention;

[0018] Figure 3 It is an architecture diagram of a device fault diagnosis system provided by an embodiment of the present invention;

[0019] Figure 4 It is a structural block diagram of a device fault diagnosis device provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the protection scope of the present invention.

[0021] It should be noted that in the description of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or device. The terms "first", "second", etc. in the present invention are used to distinguish similar objects, rather than to describe a specific order or sequence.

[0022] In order to enable those skilled in the art of the present technology to better understand the solution of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0023] Combined with the specific application environment architecture or specific hardware architecture on which the execution of the device fault diagnosis method depends, the specific application environment architecture or specific hardware architecture is described herein.

[0024] An embodiment of the present invention provides a device fault diagnosis method, and the method will be described in detail in combination with the execution process of the device fault diagnosis method.

[0025] See Figure 1 , Figure 1 is the implementation flowchart of a device fault diagnosis method provided by an embodiment of the present invention. The method may include the following steps:

[0026] S101: Obtain the device attribute information of the device to be diagnosed.

[0027] Among them, the device attribute information includes the device manufacturer, and also includes at least one of the device model, firmware version, and system version.

[0028] When it is necessary to perform fault diagnosis on the device to be diagnosed, obtain the device attribute information of the device to be diagnosed. The obtained device attribute information includes the device manufacturer, and may also include one or more pieces of device attribute information such as the device model, firmware version, and system version.

[0029] The device to be diagnosed may include a server, a storage device, a network device, a power supply device, a refrigeration device, etc.

[0030] S102: According to the device attribute information, respectively find the corresponding log collection template, log parsing template, and diagnosis rule template from the meta database.

[0031] The corresponding relationships between the device attribute information and the log collection template, log parsing template, and diagnosis rule template in the meta database are respectively preset in advance. After finding the device attribute information of the device to be diagnosed, according to the device attribute information, respectively find the corresponding log collection template, log parsing template, and diagnosis rule template from the meta database.

[0032] It is also possible to preset the priority of device attribute information during template search, and set the priority of device attribute information from high to low as device manufacturer, device model, firmware version, and system version. When searching for log collection templates, log parsing templates, and diagnostic rule templates, combined with the types of device attribute information currently set, search for the corresponding log collection templates, log parsing templates, and diagnostic rule templates from the meta-database in the order from high to low priority. For example, when the device attribute information includes device manufacturer, device model, firmware version, and system version, search for the corresponding log collection templates, log parsing templates, and diagnostic rule templates from the meta-database in the order of device manufacturer, device model, firmware version, and system version; when the device attribute information includes device manufacturer, device model, and system version, search for the corresponding log collection templates, log parsing templates, and diagnostic rule templates from the meta-database in the order of device manufacturer, device model, and system version. By setting the priority of device attribute information from high to low as device manufacturer, device model, firmware version, and system version, and performing template search in the order of the priority of device attribute information, timely exclusion of irrelevant log collection templates, log parsing templates, and diagnostic rule templates is achieved, improving the efficiency of template search.

[0033] S103: Collect the target logs of the device to be diagnosed using the log collection template.

[0034] Among them, the log type of the target log is any one of multiple log types.

[0035] After finding the log collection template, use the log collection template to collect the target logs of the device to be diagnosed. The log collection template can define the protocol, command, retry policy, etc. of log collection, support dynamic adaptation of multiple log types and protocols, and match device attribute information through regular expressions. The system can automatically select the optimal collection template, avoiding the problems of manual configuration and rule matching caused by device differences in traditional technologies.

[0036] S104: Parse the target logs using the log parsing template to obtain the parsing result.

[0037] After finding the log parsing template, use the log parsing template to parse the target logs to obtain the parsing result. The log parsing template can define plugins, security policies, etc. for log parsing. By dynamically loading parsing plugins, the system can flexibly handle the parsing requirements of different devices and log types, solving the problems of low parsing efficiency and insufficient security caused by log format differences in related technologies.

[0038] S105: Perform diagnostic rule matching according to the parsing result using the diagnostic rule template, and perform fault diagnosis on the device to be diagnosed according to the matched diagnostic rule.

[0039] After finding the diagnostic rule template, use the diagnostic rule template to perform diagnostic rule matching based on the parsing result, and perform fault diagnosis on the device to be diagnosed according to the matched diagnostic rule. The diagnostic rule template can define the conditional expression, applicable scope, solution suggestions, etc. for fault diagnosis, support dynamic binding and flexible matching of the expression engine, and solve the problem of limited diagnostic ability of a single rule in the related technology. By constructing a meta-database and adopting a three-level template separation architecture of a log collection template, a log parsing template, and a diagnostic rule template, the decoupling of log collection, log parsing, and fault diagnosis is achieved.

[0040] Through the present invention, since dynamic template matching can be achieved through the device attribute information of the device to be diagnosed, log collection of the device to be diagnosed can be achieved through the found log collection template, automatic parsing of the collected target log can be achieved through the log parsing template, and there is no restriction on the log types that can be parsed, which greatly improves the scalability. Fault diagnosis is performed on the device to be diagnosed by dynamically matching the corresponding diagnostic rule through the diagnostic rule template. Compared with the method of performing fault diagnosis only through threshold matching and device status, it can flexibly adapt to different devices, improve the fault diagnosis ability, and achieve unified management and efficient fault diagnosis of heterogeneous devices. Therefore, the technical problems of poor scalability, low operation and maintenance efficiency, and limited fault diagnosis ability can be solved, and the technical effects of good scalability, improved operation and maintenance efficiency, and improved fault diagnosis ability can be achieved.

[0041] See Figure 2 , Figure 2 which is the implementation flowchart of another device fault diagnosis method provided by the embodiment of the present invention. The method may include the following steps:

[0042] S201: Obtain the device attribute information of the device to be diagnosed.

[0043] Among them, the device attribute information includes the device manufacturer, and also includes at least one of the device model, firmware version, and system version.

[0044] S202: According to the device attribute information, respectively find the corresponding log collection template, log parsing template, and diagnostic rule template from the meta-database.

[0045] S203: Use the log collection template to collect the target log of the device to be diagnosed.

[0046] Among them, the log type of the target log is any one of multiple log types.

[0047] S204: Initialize the sandbox environment to obtain the target sandbox.

[0048] After collecting the target logs of the device to be diagnosed, initialize the sandbox environment to obtain a target sandbox.

[0049] The process of initializing the sandbox environment may include: when the sandbox container layer sandbox container is running, create an independent namespace and load a lightweight user-mode kernel; load a Berkeley Packet Filter (BPF) program on the host side of the Secure Computing Mode with Berkeley Packet Filter (Seccomp-BPF) filter layer to define allowed system calls; configure resource usage limits through control groups and resource limits in the control group resource control layer. Obtaining the target sandbox through the initialization of the sandbox environment provides a secure and reliable log parsing environment for subsequent log parsing.

[0050] S205: Use the log parsing template to perform log parsing on the target logs in the target sandbox to obtain a parsing result.

[0051] After the target sandbox is obtained through the initialization of the sandbox environment, use the log parsing template to perform log parsing on the target logs in the target sandbox to obtain a parsing result. By performing log parsing in the target sandbox, the security and reliability of the log parsing process are ensured.

[0052] In a specific embodiment of the present invention, using the log parsing template to perform log parsing on the target logs in the target sandbox may include the following steps:

[0053] Step 1: Obtain the target log type to which the target logs belong;

[0054] Step 2: Obtain the target parsing plugin corresponding to the target log type;

[0055] Step 3: Inject the plugin code corresponding to the target parsing plugin into the parsing process in the target sandbox so that the parsing process uses the log parsing template to perform log parsing on the target logs in the target sandbox.

[0056] For ease of description, the above three steps can be combined for explanation.

[0057] Obtain the target log type to which the target log belongs, obtain the target parsing plugin corresponding to the target log type, use the reflection principle to load the parsing plugin specified by the entry method (entry_method), and inject the plugin code corresponding to the target parsing plugin into the parsing process in the target sandbox, so that the parsing process can perform log parsing on the target log in the target sandbox using the log parsing template. By using sandbox technology to restrict the system access rights and resource usage of the parsing plugin, it is ensured that log parsing is only performed within the target sandbox, ensuring the security and controllability of the log parsing process. At the same time, the plugin-based design enables the log parsing module to flexibly support multiple log types and formats, solving the problems of low parsing efficiency and insufficient security caused by log format differences in related technologies.

[0058] The input / output of the target parsing plugin can be redirected to the system main process, and the target log and parsing results are passed through the Inter-Process Communication (IPC) mechanism. The target parsing plugin loads predefined parsing rules, and the target sandbox restricts the system access rights of the target plugin according to the syscall_whitelist.

[0059] S206: When it is determined that the parsing of the target log is completed according to the parsing result, perform a destruction operation on the target sandbox.

[0060] After performing log parsing and obtaining the parsing result, when it is determined that the parsing of the target log is completed according to the parsing result, perform a destruction operation on the target sandbox. By destroying the sandbox in a timely manner after the log parsing is completed, timely release of resources is achieved, improving resource utilization.

[0061] S207: Standardize the parsing result according to a preset format to obtain a standardized log.

[0062] After performing log parsing and obtaining the parsing result, standardize the parsing result according to a preset format to obtain a standardized log.

[0063] S208: Use the diagnostic rule template to perform diagnostic rule matching based on the standardized log, and perform fault diagnosis on the device to be diagnosed according to the matched diagnostic rule.

[0064] After obtaining the standardized log, use the diagnostic rule template to perform diagnostic rule matching based on the standardized log, and perform fault diagnosis on the device to be diagnosed according to the matched diagnostic rule. By standardizing the parsing result to obtain a standardized log and performing diagnostic rule matching based on the standardized log, the diagnostic rule matching efficiency is greatly improved, and thus the fault diagnosis efficiency is improved.

[0065] In a specific embodiment of the present invention, diagnosing rule matching based on standardized logs using a diagnosing rule template may include the following steps:

[0066] Using an expression engine to perform dynamic variable binding according to the parsing result by means of the diagnosing rule template to obtain a target expression;

[0067] Correspondingly, performing fault diagnosis on the device to be diagnosed according to the matched diagnosing rule may include the following steps:

[0068] Step 1: Execute the target expression to obtain an execution result;

[0069] Step 2: Determine whether the standardized log is a fault log according to the execution result. If so, execute Step 3; if not, determine that the device to be diagnosed has no fault;

[0070] Step 3: Analyze the device fault path according to the standardized log, and perform fault diagnosis according to the analyzed fault path.

[0071] For the convenience of description, the above steps can be combined for explanation.

[0072] After performing log parsing to obtain a parsing result, use an expression engine to perform dynamic variable binding according to the parsing result by means of the diagnosing rule template to obtain a target expression, execute the target expression to obtain an execution result, determine whether the standardized log is a fault log according to the execution result. If so, analyze the device fault path according to the standardized log and perform fault diagnosis according to the analyzed fault path. If not, determine that the device to be diagnosed has no fault. Using an expression engine to perform dynamic variable binding according to the parsing result by means of the diagnosing rule template supports dynamic binding of fields in the log (such as component type, metric data, etc.), can flexibly match rule conditions according to the log content, supports logical operators such as AND, OR, NOT, and also supports comparison operators such as >, <, ==, and also supports function calls, thus realizing the support for complex judgment conditions. Through the expression engine, the system can dynamically load and update diagnosing rules, support new fault scenarios without modifying the code, and significantly improve the flexibility and maintainability of the system. By executing the expression to determine whether it is a fault log, the error rate of fault diagnosis is reduced and the efficiency of fault diagnosis is improved.

[0073] In a specific embodiment of the present invention, analyzing the device fault path according to the standardized log and performing fault diagnosis according to the analyzed fault path may include the following steps:

[0074] Step 1: When the number of devices to be diagnosed is greater than 1, obtain the device identification information of each device to be diagnosed;

[0075] Step 2: Query topological data based on each device identification information to obtain the rack positions and upstream and downstream nodes of each device to be diagnosed;

[0076] Step 3: Determine the priorities of each device to be diagnosed according to the standardized logs, the rack positions and upstream and downstream nodes of each device to be diagnosed, and insert each device to be diagnosed into a preset queue in the order of the priorities of each device to be diagnosed from high to low;

[0077] Step 4: Find the device to be diagnosed with the highest current priority from the preset queue;

[0078] Step 5: Determine each fault path corresponding to the device to be diagnosed with the highest current priority according to the rack position and upstream and downstream nodes of the device to be diagnosed with the highest current priority;

[0079] Step 6: Obtain the path scores of each fault path corresponding to the device to be diagnosed with the highest current priority, and sort the path scores from high to low;

[0080] Step 7: Select a preset number of path scores from the end with the highest path scores according to the path score sorting result, and return to execute Step 4 until the preset queue is empty;

[0081] Step 8: Perform fault correlation diagnosis according to the fault paths corresponding to the selected path scores respectively.

[0082] For convenience of description, the above eight steps can be combined for explanation.

[0083] When the number of devices to be diagnosed is greater than 1, obtain the device identification information of each device to be diagnosed, query topological data based on each device identification information to obtain the rack positions and upstream and downstream nodes where each device to be diagnosed is located, determine the priorities of each device to be diagnosed according to the standardized logs and the rack positions and upstream and downstream nodes where each device to be diagnosed is located, and insert each device to be diagnosed into a preset queue in the order of the priorities of each device to be diagnosed from high to low. Search for the device to be diagnosed with the highest current priority from the preset queue, determine each fault path corresponding to the device to be diagnosed with the highest current priority according to the rack position and upstream and downstream nodes where the device to be diagnosed with the highest current priority is located, obtain the path scores of each fault path corresponding to the device to be diagnosed with the highest current priority, and sort the path scores from high to low. Select a preset number of path scores from the end with the highest path scores according to the path score sorting result. Further search for the device to be diagnosed with the highest current priority among the remaining devices to be diagnosed in the preset queue, and screen and obtain the top preset number of path scores with higher values according to the path scores of each fault path corresponding to the device to be diagnosed until the preset queue is empty. After selecting each path score, perform fault correlation diagnosis according to the fault paths corresponding to each selected path score. By performing fault correlation diagnosis according to the fault paths selected for each device to be diagnosed in the preset queue, the effective analysis of the fault relevance of each device is realized, and the fault diagnosis efficiency is further improved.

[0084] In a specific embodiment of the present invention, determining the priorities of each device to be diagnosed according to the standardized logs and the rack positions and upstream and downstream nodes where each device to be diagnosed is located may include the following steps:

[0085] Step 1: Determine the current fault severity of each device to be diagnosed according to the standardized logs;

[0086] Step 2: Determine the node criticality level of each device to be diagnosed according to the rack position and upstream and downstream nodes where each device to be diagnosed is located;

[0087] Step 3: Calculate the priorities of each device to be diagnosed according to the current fault severity and node criticality level corresponding to each device to be diagnosed.

[0088] For the convenience of description, the above three steps can be combined for description.

[0089] Determine the current fault severity of each device to be diagnosed according to the standardized logs, determine the node criticality level of each device to be diagnosed according to the rack position and upstream and downstream nodes where each device to be diagnosed is located, and calculate the priorities of each device to be diagnosed according to the current fault severity and node criticality level corresponding to each device to be diagnosed. For example, the priority (priority) of each device to be diagnosed can be calculated by the following formula:

[0090] ;

[0091] For example, if the fault severity is defined as levels 1 - 5 from the prompt level (Info) to the critical level, and the node critical level is defined as levels 1 - 5 from the edge node to the core business node.

[0092] By calculating the priority of each device to be diagnosed according to the current fault severity and node critical level corresponding to each device to be diagnosed, an effective sorting of the fault degrees of each device to be diagnosed is achieved.

[0093] In a specific embodiment of the present invention, obtaining the path scores of each fault path corresponding to the device to be diagnosed with the highest current priority may include the following steps:

[0094] Step 1: Obtain a preset first attenuation factor;

[0095] Step 2: Determine the topology weight coefficient and connection weight corresponding to the device to be diagnosed with the highest current priority according to the rack position and upstream and downstream nodes where the device to be diagnosed with the highest current priority is located;

[0096] Step 3: Determine the propagation hop count corresponding to each fault path according to the number of nodes in each fault path;

[0097] Step 4: Calculate the path scores of each fault path corresponding to the device to be diagnosed with the highest current priority according to the first attenuation factor, topology weight coefficient, connection weight, the current fault severity and node critical level corresponding to the device to be diagnosed with the highest current priority, and the propagation hop count corresponding to each fault path.

[0098] For convenience of description, the above four steps can be combined for explanation.

[0099] Obtain a preset first attenuation factor, determine the topology weight coefficient and connection weight corresponding to the device to be diagnosed with the highest current priority according to the rack position and upstream and downstream nodes where the device to be diagnosed with the highest current priority is located, determine the propagation hop count corresponding to each fault path according to the number of nodes in each fault path, and calculate the path scores of each fault path corresponding to the device to be diagnosed with the highest current priority according to the first attenuation factor, topology weight coefficient, connection weight, the current fault severity and node critical level corresponding to the device to be diagnosed with the highest current priority, and the propagation hop count corresponding to each fault path. For example, the path scores of each fault path can be calculated by the following formula:

[0100] ;

[0101] Among them, the first attenuation factor has a value range of , the topology weight coefficient The value range of [value] is 0.1 - 1.0, and the value range of the connection weight W is 1 - 10.

[0102] By calculating the path scores of each fault path corresponding to the device to be diagnosed with the highest current priority according to the first attenuation factor, the topological weight coefficient, the connection weight, the current fault severity corresponding to the device to be diagnosed with the highest current priority, the node critical level, and the propagation hops corresponding to each fault path, multiple influencing factors affecting the path scores are fully considered, greatly improving the accuracy of path score calculation.

[0103] In a specific embodiment of the present invention, determining the propagation hops corresponding to each fault path according to the number of nodes in each fault path may include the following steps:

[0104] Step 1: Obtain the number of nodes included in each fault path respectively;

[0105] Step 2: Determine whether there is a number of nodes greater than the preset hop value. If so, execute Step 3; if not, execute Step 4;

[0106] Step 3: Determine the propagation hops of the fault path corresponding to the number of nodes greater than the preset hop value as the preset hop value, and determine the propagation hops of the fault path corresponding to the number of nodes less than or equal to the preset hop value as the number of nodes included in the fault path;

[0107] Step 4: Determine the number of nodes included in each fault path respectively as the propagation hops of the corresponding fault path.

[0108] For the convenience of description, the above four steps can be combined for explanation.

[0109] When determining the propagation hops of each fault path, obtain the number of nodes included in each fault path respectively, and determine whether there is a number of nodes greater than the preset hop value. If so, it means that there is a fault path with a relatively large number of included nodes. Determine the propagation hops of the fault path corresponding to the number of nodes greater than the preset hop value as the preset hop value, and determine the propagation hops of the fault path corresponding to the number of nodes less than or equal to the preset hop value as the number of nodes included in the fault path. If not, it means that there is no fault path with a relatively large number of included nodes, and determine the number of nodes included in each fault path respectively as the propagation hops of the corresponding fault path. By determining the propagation hops of the fault path according to the number of nodes included in the fault path and the preset hop value, in a complex topology, faults may be repeatedly propagated through loops. Setting the maximum preset hop value can force the termination of the algorithm and avoid infinite loops. The time complexity of path analysis grows exponentially with the number of hops. Limiting the propagation hops can balance computing resources and diagnostic accuracy and control the computational complexity.

[0110] The types of nodes in each path may include slave servers, switches, storage devices, application nodes, databases, load balancers, etc.

[0111] S209: When it is determined that the device to be diagnosed has a fault, calculate the alarm priority of the device to be diagnosed.

[0112] When it is determined that the device to be diagnosed has a fault, calculate the alarm priority of the device to be diagnosed. By calculating the alarm priorities of the devices to be diagnosed, the urgency of the alarms of the devices to be diagnosed can be effectively identified.

[0113] In a specific embodiment of the present invention, calculating the alarm priority of the device to be diagnosed may include the following steps:

[0114] Step 1: Obtain the fault type of the device to be diagnosed;

[0115] Step 2: Determine the static weight according to the fault type;

[0116] Step 3: Obtain the fault occurrence time of the device to be diagnosed;

[0117] Step 4: Determine the time sensitivity coefficient according to the fault occurrence time;

[0118] Step 5: Obtain the preset second attenuation factor and the historical alarm trigger times of the device to be diagnosed;

[0119] Step 6: Obtain the preset service correlation degree and the service criticality mark of the device to be diagnosed;

[0120] Step 7: Calculate the alarm priority of the device to be diagnosed according to the static weight, time sensitivity coefficient, second attenuation factor, historical alarm trigger times, service correlation degree and service criticality mark.

[0121] For the convenience of description, the above seven steps can be combined for description.

[0122] When calculating the alarm priority of the device to be diagnosed, obtain the fault type of the device to be diagnosed, determine the static weight according to the fault type, obtain the fault occurrence time of the device to be diagnosed, determine the time sensitivity coefficient according to the fault occurrence time, obtain the preset second attenuation factor and the historical alarm trigger times of the device to be diagnosed, obtain the preset service correlation degree and the service criticality mark of the device to be diagnosed, and calculate the alarm priority of the device to be diagnosed according to the static weight, time sensitivity coefficient, second attenuation factor, historical alarm trigger times, service correlation degree and service criticality mark. For example, the alarm priority of the device to be diagnosed can be calculated by the following formula:

[0123] ;

[0124] Among them, the static weight is the inherent weight of the fault type. For example, the static weight of a fatal fault = 5; T is the time sensitivity coefficient, that is, the multiplier of the time period. For example, during the early morning period, T = 1.5; a is the second attenuation factor, taking values from 0.1 to 0.3, which controls the attenuation speed of the influence of the historical trigger times; b is the business relevance, the rule improvement multiple for key devices. For example, b = 2.

[0125] S210: Perform fault alarms according to the alarm priority.

[0126] After calculating the alarm priority of the device to be diagnosed, perform fault alarms according to the alarm priority. A priority score threshold can also be set in advance, and the pre-configured priority score threshold can be obtained. If the alarm priority is greater than the priority score threshold, notify the administrator by email or text message. Otherwise, display them in descending order of scores. By designing the alarm priority calculation formula and combining the static weight, time sensitivity coefficient, historical trigger times, and business criticality marker, the alarm priority is dynamically calculated to ensure that high-priority alarms can be notified to the administrator in a timely manner. This flexible and dynamic processing method significantly improves the efficiency and accuracy of cluster operation and maintenance.

[0127] See Figure 3 , Figure 3 is the architecture diagram of a device fault diagnosis system provided by an embodiment of the present invention. The meta-database construction module is used to construct the meta-database, which is used to store and manage the log collection template, log parsing template, and diagnostic rule template. Each template contains the regular expression matching rules for the device manufacturer, model, firmware version, and system version. The meta-database adopts a three-level template separation architecture, and dynamically adapts to device characteristics through regular expressions, realizing the transformation of heterogeneous device management from hard coding to template-driven.

[0128] Log collection template: Define the protocol, command, retry policy, etc. for log collection, support dynamic adaptation of multiple log types and protocols. Through regular expression matching of device characteristics, the system can automatically select the optimal collection template, avoiding the problems of manual configuration and rule matching caused by device differences in traditional technologies.

[0129] Log parsing template: Define the parsing plug-ins, security policies, etc. for log parsing. By dynamically loading parsing plug-ins, the system can flexibly handle the parsing requirements of different devices and log types, solving the problems of low parsing efficiency and insufficient security caused by log format differences in related technologies.

[0130] Diagnostic rule template: Define the conditional expressions, applicable scopes, and solution suggestions for fault diagnosis, support dynamic binding and flexible matching of the expression engine, and solve the problem of limited diagnostic capabilities of single rules in related technologies.

[0131] When the server cluster health check task is triggered, the log collection module first queries the metadata database, filters out the most matching collection template according to the device attribute information (manufacturer, model, firmware version, and system version), loads the driver module corresponding to the protocol according to the protocol field in the log collection template, executes the collection instructions defined by the command, and sends a message indicating the completion of collection to the message middleware (such as Kafka) after collection.

[0132] The log parsing module listens to the message middleware. When there is new log to be processed, it searches for the associated parsing template according to the manufacturer, model, firmware version, and system version of the device. Initializes the sandbox environment, loads the parsing plugin specified by the entry_method using the reflection principle, injects the plugin code into the sandbox environment, redirects the input / output of the plugin to the main process, and transfers the log data and parsing results through the inter-process communication mechanism. The plugin loads the predefined parsing rules, and the sandbox restricts the system access rights of the plugin according to the system call whitelist. The resource usage of the parsing process is restricted by the resource_limits, and the process is terminated if the limit is exceeded. If an error occurs during the parsing process, the error_process is triggered for handling, and the sandbox instance is destroyed after parsing is completed.

[0133] After receiving the standardized log, the rule matching module queries the metadata database according to the device attribute information to obtain the matching diagnostic rules. Dynamically binds the conditional expressions through an expression engine (such as Google CEL), and executes the expressions to determine whether it is a fault log. Sends the fault log to the message middleware, and the asynchronous consumption thread receives the standardized log stream, enhances the features of the log, adds device topology data, and can discover complex or hidden faults in multi-source logs or cross-logs through the improved Dijkstra algorithm, thus significantly improving the accuracy and efficiency of fault diagnosis.

[0134] An example of the log collection template is as follows:

[0135]

[0136] An example of the log parsing template is as follows:

[0137]

[0138] An example of the diagnostic rule template is as follows:

[0139]

[0140] An example of the message structure of the message indicating the completion of collection sent by the log collection module to the message middleware is as follows:

[0141]

[0142] The log parsing module standardizes the parsing results according to the format. The format example is as follows:

[0143]

[0144] It terminates when the preset queue for storing each device to be diagnosed for which a fault is determined is empty or reaches the maximum propagation hop count (such as 6 hops), and outputs the fault diagnosis result. The fault diagnosis result example is as follows:

[0145]

[0146] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0147] The embodiment of the present invention also provides a device fault diagnosis device, and the device may include:

[0148] An attribute information acquisition module 41, configured to acquire the device attribute information of the device to be diagnosed; wherein, the device attribute information includes the device manufacturer, and also includes at least one of the device model, firmware version, and system version;

[0149] A template acquisition module 42, configured to respectively find the corresponding log acquisition template, log parsing template, and diagnosis rule template from the meta database according to the device attribute information;

[0150] A log acquisition module 43, configured to acquire the target log of the device to be diagnosed by using the log acquisition template; wherein, the log type of the target log is any one of multiple log types;

[0151] An analysis result acquisition module 44, configured to perform log parsing on the target log by using the log parsing template to obtain an analysis result;

[0152] A fault diagnosis module 45, configured to perform diagnosis rule matching according to the analysis result by using the diagnosis rule template, and perform fault diagnosis on the device to be diagnosed according to the matched diagnosis rule.

[0153] Through the present invention, since dynamic template matching can be achieved through the device attribute information of the device to be diagnosed, log collection of the device to be diagnosed is realized through the found log collection template, automatic parsing of the collected target log is realized through the log parsing template, and there is no restriction on the log types that can be parsed, which greatly improves the scalability. Fault diagnosis of the device to be diagnosed is carried out by dynamically matching the corresponding diagnostic rules through the diagnostic rule template. Compared with the method of fault diagnosis only through threshold matching and device status, it can flexibly adapt to different devices, improves the fault diagnosis ability, and realizes the unified management and efficient fault diagnosis of heterogeneous devices. Therefore, the technical problems of poor scalability, low operation and maintenance efficiency, and limited fault diagnosis ability can be solved, and the technical effects of good scalability, improved operation and maintenance efficiency, and improved fault diagnosis ability can be achieved.

[0154] In a specific embodiment of the present invention, the parsing result obtaining module 44 may include:

[0155] A sandbox obtaining sub-module, configured to initialize a sandbox environment to obtain a target sandbox;

[0156] A log parsing sub-module, configured to perform log parsing on the target log in the target sandbox by using a log parsing template.

[0157] In a specific embodiment of the present invention, the log parsing sub-module may include:

[0158] A log type obtaining unit, configured to obtain the target log type to which the target log belongs;

[0159] A parsing plugin obtaining unit, configured to obtain a target parsing plugin corresponding to the target log type;

[0160] A log parsing unit, configured to inject the plugin code corresponding to the target parsing plugin into the parsing process in the target sandbox, so that the parsing process performs log parsing on the target log in the target sandbox by using a log parsing template.

[0161] In a specific embodiment of the present invention, the device may further include:

[0162] A sandbox destruction module, configured to perform a destruction operation on the target sandbox after obtaining the parsing result when it is determined according to the parsing result that the parsing of the target log is completed.

[0163] In a specific embodiment of the present invention, the fault diagnosis module 45 may include:

[0164] A standardized log obtaining sub-module, configured to standardize the parsing result according to a preset format to obtain a standardized log;

[0165] A diagnostic rule matching sub-module, which is used to match diagnostic rules according to standardized logs by using a diagnostic rule template.

[0166] In a specific embodiment of the present invention, the diagnostic rule matching sub-module includes:

[0167] An expression obtaining unit, which is used to perform dynamic variable binding according to the parsing result by using an expression engine and a diagnostic rule template to obtain a target expression;

[0168] The fault diagnosis module 45 may include:

[0169] An execution result obtaining sub-module, which is used to execute the target expression to obtain an execution result;

[0170] A judgment sub-module, which is used to judge whether the standardized log is a fault log according to the execution result;

[0171] A fault diagnosis sub-module, which is used to perform device fault path analysis according to the standardized log when it is determined that the standardized log is a fault log according to the execution result, and perform fault diagnosis according to the obtained fault path.

[0172] In a specific embodiment of the present invention, the fault diagnosis sub-module may include:

[0173] An identification information obtaining unit, which is used to obtain the device identification information of each device to be diagnosed when the number of devices to be diagnosed is greater than 1;

[0174] A topology query unit, which is used to query topology data according to the device identification information of each device to obtain the rack position and upstream and downstream nodes where each device to be diagnosed is located;

[0175] A device insertion unit, which is used to determine the priority of each device to be diagnosed according to the standardized log and the rack position and upstream and downstream nodes where each device to be diagnosed is located, and insert each device to be diagnosed into a preset queue in the order of the priority from high to low;

[0176] A device search unit, which is used to search for the device to be diagnosed with the highest current priority from the preset queue;

[0177] A fault path determination unit, which is used to determine each fault path corresponding to the device to be diagnosed with the highest current priority according to the rack position and upstream and downstream nodes where the device to be diagnosed with the highest current priority is located;

[0178] A path score sorting unit, which is used to obtain the path scores of each fault path corresponding to the device to be diagnosed with the highest current priority, and sort the path scores from high to low;

[0179] A repeated execution unit, configured to select a preset number of path scores from the end with the highest path score according to the path score sorting result, and repeatedly execute the step of finding the device to be diagnosed with the highest current priority from a preset queue until the preset queue is empty;

[0180] A fault correlation diagnosis unit, configured to perform fault correlation diagnosis according to the fault paths corresponding to the selected path scores respectively.

[0181] In a specific embodiment of the present invention, the device insertion unit may include:

[0182] A fault severity determination subunit, configured to determine the current fault severity of each device to be diagnosed according to the standardized log;

[0183] A node criticality level determination subunit, configured to determine the node criticality level of each device to be diagnosed according to the rack position and upstream and downstream nodes where each device to be diagnosed is located;

[0184] A device priority calculation subunit, configured to calculate the priority of each device to be diagnosed according to the current fault severity and node criticality level corresponding to each device to be diagnosed respectively.

[0185] In a specific embodiment of the present invention, the path score sorting unit may include:

[0186] A first attenuation factor acquisition subunit, configured to acquire a preset first attenuation factor;

[0187] A weight determination subunit, configured to determine the topology weight coefficient and connection weight corresponding to the device to be diagnosed with the highest current priority according to the rack position and upstream and downstream nodes where the device to be diagnosed with the highest current priority is located;

[0188] A propagation hop count determination subunit, configured to determine the propagation hop count corresponding to each fault path according to the number of nodes in each fault path;

[0189] A path score subunit, configured to calculate the path scores of each fault path corresponding to the device to be diagnosed with the highest current priority according to the first attenuation factor, topology weight coefficient, connection weight, current fault severity and node criticality level corresponding to the device to be diagnosed with the highest current priority, and the propagation hop count corresponding to each fault path.

[0190] In a specific embodiment of the present invention, the propagation hop count determination subunit is specifically configured to obtain the number of nodes included in each fault path; determine whether there is a number of nodes greater than a preset hop count value; if so, determine the propagation hop count of the fault path corresponding to the number of nodes greater than the preset hop count value as the preset hop count value, and determine the propagation hop count of the fault path corresponding to the number of nodes less than or equal to the preset hop count value; if not, determine the number of nodes included in each fault path as the propagation hop count of the corresponding fault path.

[0191] In a specific embodiment of the present invention, the apparatus may further include:

[0192] An alarm priority calculation module, configured to calculate the alarm priority of the device to be diagnosed when it is determined that the device to be diagnosed is faulty after performing fault diagnosis on the device to be diagnosed according to the matched diagnosis rule;

[0193] A fault alarm module, configured to perform fault alarm according to the alarm priority.

[0194] In a specific embodiment of the present invention, the alarm priority calculation module may include:

[0195] A fault type acquisition sub-module, configured to acquire the fault type of the device to be diagnosed;

[0196] A static weight determination sub-module, configured to determine a static weight according to the fault type;

[0197] A fault occurrence time acquisition sub-module, configured to acquire the fault occurrence time of the device to be diagnosed;

[0198] A time sensitivity coefficient determination sub-module, configured to determine a time sensitivity coefficient according to the fault occurrence time;

[0199] A second attenuation factor and historical alarm trigger count acquisition sub-module, configured to acquire a preset second attenuation factor and the historical alarm trigger count of the device to be diagnosed;

[0200] A service relevance and service criticality mark acquisition sub-module, configured to acquire a preset service relevance and the service criticality mark of the device to be diagnosed;

[0201] An alarm priority calculation sub-module, configured to calculate the alarm priority of the device to be diagnosed according to the static weight, time sensitivity coefficient, second attenuation factor, historical alarm trigger count, service relevance, and service criticality mark.

[0202] For the description of the features in the corresponding embodiment of the device fault diagnosis device, reference may be made to the relevant description in the corresponding embodiment of the device fault diagnosis method, which will not be elaborated here one by one.

[0203] An embodiment of the present invention further provides an electronic device, including a memory and a processor. A computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any of the above-described embodiments of the device fault diagnosis method.

[0204] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps in any of the above-described embodiments of the device fault diagnosis method when running.

[0205] In an exemplary embodiment, the above computer-readable storage medium may include, but is not limited to: various media such as USB flash drives, read-only memories (ROM for short), random access memories (RAM for short), mobile hard disks, magnetic disks, or optical discs that can store computer programs.

[0206] An embodiment of the present invention further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, it implements the steps in any of the above-described embodiments of the device fault diagnosis method.

[0207] An embodiment of the present invention further provides another computer program product, including a non-volatile computer-readable storage medium. The non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the steps in any of the above-described embodiments of the device fault diagnosis method.

[0208] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods for each specific application to implement the described functions, but such implementation should not be considered to exceed the scope of the present invention.

[0209] The above has introduced in detail a device fault diagnosis method, an electronic device, a storage medium, and a program product provided by the present invention. Specific examples are used in this article to elaborate on the principle and implementation manner of the present invention. The description of the above embodiments is only used to help understand the method and its core idea of the present invention. It should be noted that for those of ordinary skill in the art in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the protection scope of the present invention.

Claims

1. A device fault diagnosis method, characterized in that, Including: Obtain the device attribute information of the device to be diagnosed; wherein, the device attribute information includes the device manufacturer, and also includes at least one of the device model, firmware version, and system version; the priority of the device attribute information is set from high to low as the device manufacturer, device model, firmware version, and system version; According to the types of the device attribute information, respectively search for the corresponding log collection template, log parsing template, and diagnostic rule template from the meta database in the order of priority from high to low; Use the log collection template to collect the target logs of the device to be diagnosed; wherein, the log type of the target logs is any one of multiple log types; Use the log parsing template to perform log parsing on the target logs to obtain a parsing result; Use the diagnostic rule template to perform diagnostic rule matching according to the parsing result, and perform fault diagnosis on the device to be diagnosed according to the matched diagnostic rule.

2. The device fault diagnosis method according to claim 1, wherein, Using the log parsing template to perform log parsing on the target logs includes: Initialize the sandbox environment to obtain a target sandbox; Use the log parsing template to perform log parsing on the target logs within the target sandbox.

3. The device fault diagnosis method according to claim 2, wherein Using the log parsing template to perform log parsing on the target logs within the target sandbox includes: Obtain the target log type to which the target logs belong; Obtain the target parsing plugin corresponding to the target log type; Inject the plugin code corresponding to the target parsing plugin into the parsing process in the target sandbox, so that the parsing process uses the log parsing template to perform log parsing on the target logs within the target sandbox.

4. The device fault diagnosis method according to claim 2, wherein After obtaining the parsing result, it further includes: When it is determined according to the parsing result that the parsing of the target logs is completed, perform a destruction operation on the target sandbox.

5. The device fault diagnosis method according to claim 1, wherein Using the diagnostic rule template to perform diagnostic rule matching according to the parsing result includes: Standardize the parsing result in a preset format to obtain standardized logs; Use the diagnostic rule template to perform diagnostic rule matching according to the standardized logs.

6. The device fault diagnosis method according to claim 5, characterized in that, Using the diagnostic rule template to perform diagnostic rule matching according to the standardized logs includes: Use the diagnostic rule template to perform dynamic variable binding according to the parsing result through an expression engine to obtain a target expression; Correspondingly, performing fault diagnosis on the device to be diagnosed according to the matched diagnostic rule includes: Execute the target expression to obtain an execution result; Judge whether the standardized logs are fault logs according to the execution result; If so, perform device fault path analysis according to the standardized logs, and perform fault diagnosis according to the analyzed fault path.

7. The device fault diagnosis method according to claim 6, characterized in that Performing device fault path analysis according to the standardized logs and performing fault diagnosis according to the analyzed fault path includes: When the number of devices to be diagnosed is greater than 1, obtain the device identification information of each device to be diagnosed; Perform topology data query according to each device identification information to obtain the rack positions and upstream and downstream nodes of each device to be diagnosed; Determine the priorities of the devices to be diagnosed according to the standardized log, the rack positions where the devices to be diagnosed are located, and the upstream and downstream nodes, and insert the devices to be diagnosed into a preset queue in the order of the priorities of the devices to be diagnosed from high to low; Search for the device to be diagnosed with the highest current priority from the preset queue; Determine the respective fault paths corresponding to the device to be diagnosed with the highest current priority according to the rack position where the device to be diagnosed with the highest current priority is located and the upstream and downstream nodes; Obtain the path scores of the respective fault paths corresponding to the device to be diagnosed with the highest current priority, and sort the path scores from high to low; Select a preset number of path scores from the end with the highest path scores according to the path score sorting result, and repeat the step of searching for the device to be diagnosed with the highest current priority from the preset queue until the preset queue is empty; Perform fault correlation diagnosis according to the fault paths corresponding to the respective path scores selected; 8. The device fault diagnosis method according to claim 7, characterized in that Determine the priorities of the devices to be diagnosed according to the standardized log, the rack positions where the devices to be diagnosed are located, and the upstream and downstream nodes, including: Determine the current fault severity of each device to be diagnosed according to the standardized log; Determine the node criticality levels of the devices to be diagnosed according to the rack positions where the devices to be diagnosed are located and the upstream and downstream nodes; Calculate the priorities of the devices to be diagnosed according to the current fault severity and node criticality levels corresponding to the devices to be diagnosed respectively; 9. The device fault diagnosis method according to claim 8, wherein, Obtain the path scores of the respective fault paths corresponding to the device to be diagnosed with the highest current priority, including: Obtain a preset first attenuation factor; Determine the topology weight coefficient and connection weight corresponding to the device to be diagnosed with the highest current priority according to the rack position where the device to be diagnosed with the highest current priority is located and the upstream and downstream nodes; Determine the propagation hop counts corresponding to the respective fault paths according to the number of nodes in each fault path; Calculate the path scores of the respective fault paths corresponding to the device to be diagnosed with the highest current priority according to the first attenuation factor, the topology weight coefficient, the connection weight, the current fault severity and node criticality level corresponding to the device to be diagnosed with the highest current priority, and the propagation hop counts corresponding to the respective fault paths; 10. The device fault diagnosis method according to claim 9, wherein, Determine the propagation hop counts corresponding to the respective fault paths according to the number of nodes in each fault path, including: Obtain the number of nodes included in each fault path respectively; Judge whether there is a number of nodes greater than a preset hop value; If so, determine the propagation hop count of the fault path corresponding to the number of nodes greater than the preset hop value as the preset hop value, and determine the propagation hop count of the fault path corresponding to the number of nodes less than or equal to the preset hop value as the number of nodes included in the fault path; If not, determine the number of nodes included in each fault path as the propagation hop count of the corresponding fault path; 11. The device fault diagnosis method according to any one of claims 1 to 10, characterized in that, After performing fault diagnosis on the device to be diagnosed according to the matched diagnosis rule, it further includes: When it is determined that the device to be diagnosed has a fault, calculate the alarm priority of the device to be diagnosed; Perform fault alarm according to the alarm priority; 12. The device fault diagnosis method according to claim 11, wherein Calculate the alarm priority of the device to be diagnosed, including: Obtain the fault type of the device to be diagnosed; Determine the static weight according to the fault type; Obtain the fault occurrence time of the device to be diagnosed; Determine the time sensitivity coefficient according to the fault occurrence time; Obtain the preset second attenuation factor and the historical alarm trigger times of the device to be diagnosed; Obtain the preset service relevance and the service criticality mark of the device to be diagnosed; Calculate the alarm priority of the device to be diagnosed according to the static weight, the time sensitivity coefficient, the second attenuation factor, the historical alarm trigger times, the service relevance and the service criticality mark.

13. An electronic device, characterized in that, Comprising: A memory for storing a computer program; A processor for implementing the steps of the device fault diagnosis method according to any one of claims 1 to 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, wherein the computer program implements the steps of the device fault diagnosis method according to any one of claims 1 to 12 when executed by a processor.

15. A computer program product, comprising a computer program, characterized in that, The computer program implements the steps of the device fault diagnosis method according to any one of claims 1 to 12 when executed by a processor.

Images