Abnormal root cause determination method and device, electronic equipment and readable storage medium

Abstract

The invention discloses an exception root cause determination method and device, electronic equipment and a readable storage medium, and belongs to the field of exception detection. The method comprises the steps of obtaining a directory chain of a target file corresponding to an exception under the condition that the exception of a file system is monitored through printing data output by a serial port; according to the hierarchical sequence of the directory chain from high to low, sequentially obtaining and analyzing block data of respective data blocks of each layer of directory folder and the target file in the directory chain, and generating a target analysis file containing respective analysis results of each layer of directory folder and the target file; generating a tree graph based on the target analysis file; the tree graph is analyzed through an automatic analysis tool so as to determine the abnormal generation root cause, incremental analysis of a small part of data is achieved, analysis time consumption and resource consumption are reduced, and the real-time performance is high. In addition, the process does not affect continuous operation of equipment where the file system is located, the problem site state is reserved to the maximum extent, and the analysis accuracy can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of anomaly detection, and particularly relates to a method, apparatus, electronic device, and readable storage medium for determining the root cause of an anomaly. Background Art

[0002] The performance and stability of an embedded file system directly determine the operating efficiency and reliability of an embedded device. However, due to limited resources and complex working environments of embedded devices, the embedded file system (hereinafter referred to as the file system) is prone to anomalies, and root cause localization of anomalies is an important part of solving anomalies.

[0003] Related technologies perform root cause localization by parsing the offline full-volume data of the file system, scanning the file system through a static inspection tool, or creating an invasive snapshot, etc. However, these methods have poor real-time performance and low accuracy. Summary of the Invention

[0004] The present invention aims to solve at least one of the technical problems existing in the related technologies. For this purpose, the present invention provides a method, apparatus, electronic device, and readable storage medium for determining the root cause of an anomaly, which realizes incremental parsing of a small part of data, reduces parsing time consumption and resource consumption, and has high real-time performance.

[0005] In a first aspect, the present invention provides a method for determining the root cause of an anomaly, the method comprising: When an anomaly of the file system is detected in the print data output through the serial port, obtaining the directory chain of the target file corresponding to the anomaly; According to the hierarchical order from high to low of the directory chain, successively obtaining and parsing the block data of the data blocks of each layer of directory folder and the target file in the directory chain, and generating a target parsing file including the parsing results of each layer of directory folder and the target file respectively; the data format of the block data is binary data; the data format in the parsing file is structured data; Generating a tree-like graph based on the target parsing file; the tree-like graph at least includes the folder identifier of each directory folder, the file identifier of the target file, the hierarchical order, and each parsing result; Analyzing the tree-like graph through an automated analysis tool to determine the root cause of the anomaly.

[0006] The method for determining the root cause of an anomaly according to the present invention can be applied to any embedded file system. Once an anomaly in the file system is detected, the block data of each layer of directory folders and the target file in the directory chain are sequentially obtained and parsed to generate a target parsing file containing the parsing results of each layer of directory folders and the target file, realizing the conversion of discrete data entries into a traceable operation sequence chain, improving the diagnostic efficiency. Moreover, compared with analyzing discrete full-scale data, by generating a tree-like graph based on the target parsing file and analyzing the tree-like graph through an automated analysis tool to determine the root cause of the anomaly, incremental parsing of a small part of the data is achieved, reducing the parsing time and resource consumption, and having high real-time performance. In addition, this process does not affect the continued operation of the device where the file system is located, and maximally retains the problem scene state, which can improve the accuracy of parsing.

[0007] According to an embodiment of the present invention, the directory chain includes a root directory folder; sequentially obtaining the block data of each layer of directory folders and the target file in the directory chain includes: Obtaining the block address of the root directory folder; the block address of the root directory folder is the block address of the superblock; Obtaining the block data of the data block of the root directory folder according to the block address of the root directory folder; Parsing the block data in the data block of the root directory folder to obtain the parsing result of the root directory folder; In the case where there are other folders in the directory chain besides the root directory folder, querying the block addresses of the other folders and the target file from the parsing result of the root directory folder; Obtaining the block data of the data blocks of the other folders and the target file according to the block addresses of the other folders and the target file.

[0008] According to an embodiment of the present invention, each data block includes two sub-data blocks; the block data in the two sub-data blocks are backup data for each other; and parsing the block data of each layer of directory folders and the target file in the directory chain includes: For the data block of any one of the directory folders and the target file, parsing the version numbers of the two sub-data blocks respectively from the data headers of the block data of the corresponding two sub-data blocks of the data block; Determining the target sub-data block with the higher version number according to the version numbers of the two sub-data blocks; Parsing the data body of the target sub-data block to obtain the parsing result of the data body; Concatenating the parsing result of the version number and the data body of the target sub-data block to obtain the parsing result of the data block.

[0009] According to an embodiment of the present invention, parsing the data body of the target sub-data block to obtain the parsing result of the data body includes: Perform at least one metadata parsing on the data body based on the encoding rule until the parsing end condition is met; during this parsing process, execute the following steps: When the data body corresponding to this parsing is not empty, read the radix data of the first preset number of bytes of the data body corresponding to this parsing; When it is determined that the tag corresponding to the radix data of the first preset number of bytes is a metadata tag, parse the metadata information corresponding to this parsing from the data body corresponding to this parsing; Remove the radix data corresponding to the metadata tag and metadata information corresponding to this parsing from the data body corresponding to this parsing to obtain the data body corresponding to the next parsing; Concatenate the metadata information obtained from each parsing in order to obtain the parsing result of the data body; the parsing end condition is that the tag of the latest parsing is not a metadata tag, or the new data body of the latest parsing is empty.

[0010] According to an embodiment of the present invention, parsing the metadata information corresponding to this parsing from the data body corresponding to this parsing includes: Parse the metadata attribute information from the data body corresponding to this parsing; the metadata attribute information includes at least the metadata type and the data length; Based on the data length, extract the radix data corresponding to the data content of the metadata information; Based on the metadata type, perform format conversion on the radix data corresponding to the data content to obtain the data content of the metadata; Concatenate the metadata attribute information and the data content of the metadata to obtain the metadata information corresponding to this parsing.

[0011] According to an embodiment of the present invention, the metadata attribute further includes the file identifier of the associated file; generating a target parsing file including the parsing results of each layer of directory folders and the target file respectively, includes: Store the parsing results of each layer of directory folders and the target file respectively into the initial parsing file in sequence to obtain an intermediate parsing file; Find the target metadata where the file identifier of the target file is located from the intermediate parsing file; Obtain the file content of the target file according to the target metadata; Store the file content of the target file into the intermediate parsing file to obtain the target parsing file.

[0012] According to an embodiment of the present invention, the metadata attribute further includes the file structure type of the associated file; the file structure type is an inline structure type or a compressed pointer structure type; obtaining the file content of the target file according to the target metadata includes: In the case where the structure type of the target file is determined to be the inline structure type from the target metadata, determine that the file content of the target file is the data content of the target metadata; or, In the case where the structure type of the target file is determined to be the compressed pointer structure type from the target metadata, obtain the file length of the target file and the address of the last data content from the data content of the target metadata; the target file includes a plurality of content units arranged in an orderly manner; Perform at least one content search operation on the target file until the sum of the lengths of the plurality of content units obtained by each search operation reaches the file length; the search operation includes: Obtain the data content corresponding to the current search operation based on the search address corresponding to the current search operation; Extract the content unit corresponding to the current search operation and the operation address corresponding to the next search operation from the data content corresponding to the current search operation; Concatenate the content unit corresponding to the current search operation in front of the content unit corresponding to the previous historical search operation; Among them, the search address corresponding to the first search operation is the address of the last data content.

[0013] In a second aspect, the present invention provides a device for determining the root cause of an exception, and the device includes: A first processing module, configured to obtain the directory chain of the target file corresponding to the exception in the case where an exception in the file system is monitored through the print data output through the serial port; A second processing module, configured to sequentially obtain and parse the block data of the data blocks of each layer directory folder and the target file in the directory chain in the hierarchical order from high to low, and generate a target parsing file including the parsing results of each layer directory folder and the target file respectively; the data format of the block data is binary data; the data format in the parsing file is structured data; A third processing module, configured to generate a tree-like graph based on the target parsing file; the tree-like graph at least includes the folder identifier of each directory folder, the file identifier of the target file, the hierarchical order, and each parsing result; A fourth processing module, configured to analyze the tree-like graph through an automated analysis tool to determine the root cause of the exception.

[0014] The root cause determination device for anomalies according to the present invention can be applied to any embedded file system. Once an anomaly in the file system is detected, it sequentially obtains and parses the block data of each layer of directory folders and target files in the directory chain, generates a target parsing file containing the parsing results of each layer of directory folders and target files respectively, realizes the conversion of discrete data entries into a traceable operation sequence chain, improves the diagnosis efficiency, and compared with analyzing discrete full-scale data, by generating a tree-like graph based on the target parsing file and analyzing the tree-like graph through an automated analysis tool to determine the root cause of the anomaly, it realizes incremental parsing of a small part of the data, reduces the parsing time and resource consumption, and has high real-time performance. In addition, this process does not affect the continued operation of the device where the file system is located, and maximally retains the problem site state, which can improve the accuracy of parsing.

[0015] In a third aspect, the present invention provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it implements the root cause determination method for anomalies provided in the first aspect as described above.

[0016] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the root cause determination method for anomalies provided in the first aspect as described above.

[0017] In a fifth aspect, the present invention provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the root cause determination method for anomalies provided in the first aspect.

[0018] In a sixth aspect, the present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the root cause determination method for anomalies provided in the first aspect as described above.

[0019] One or more of the above technical solutions in the embodiments of the present invention have at least one of the following technical effects: The present invention can be applied to any embedded file system. Once an anomaly in the file system is detected, it sequentially obtains and parses the block data of each directory folder and the target file in the directory chain, generating a target parsing file containing the parsing results of each directory folder and the target file, realizing the conversion of discrete data entries into a traceable operation sequence chain, improving the diagnostic efficiency. Moreover, compared with analyzing discrete full-scale data, by generating a tree-like graph based on the target parsing file and analyzing the tree-like graph through an automated analysis tool to determine the root cause of the anomaly, it realizes incremental parsing of a small part of the data, reducing the parsing time and resource consumption, and having high real-time performance. In addition, this process does not affect the continued operation of the device where the file system is located, and maximally preserves the problem scene state, which can improve the accuracy of parsing.

[0020] Additional aspects and advantages of the present invention will be given in part in the following description, become apparent in part from the following description, or be understood through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and / or additional aspects and advantages of the present invention will become apparent and be readily understood from the following description of embodiments in conjunction with the accompanying drawings, in which: Figure 1 is a schematic diagram of the system architecture of a method for determining the root cause of an anomaly provided by an embodiment of the present invention; Figure 2 is a first flowchart of a method for determining the root cause of an anomaly provided by an embodiment of the present invention; Figure 3 is a schematic diagram of a tree-like graph provided by an embodiment of the present invention; Figure 4 is a flowchart of a method for parsing data blocks provided by an embodiment of the present invention; Figure 5 is a second flowchart of a method for determining the root cause of an anomaly provided by an embodiment of the present invention; Figure 6 is a schematic diagram of the structure of a device for determining the root cause of an anomaly provided by an embodiment of the present invention; [[ID=?]] Figure 7 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0022] The following will clearly describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention fall within the scope of protection of the present invention.

[0023] The terms "first", "second", etc. in the description and claims of the present invention are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same category, and do not limit the number of objects. For example, the first object can be one or more. In addition, "and / or" in the description and claims means at least one of the connected objects, and the character " / ", generally represents an "or" relationship between the associated objects before and after.

[0024] In the current era of deep digital penetration, embedded devices have been widely integrated into many fields such as industry, healthcare, transportation, and smart homes, becoming a key force in promoting the intelligent transformation of various industries. As the core component for data storage and management in embedded devices, the embedded file system shoulders the heavy responsibility of organizing, storing, and retrieving data, and its performance and stability directly determine the operating efficiency and reliability of embedded devices. However, due to the limited resources and complex working environment of embedded devices, the embedded file system is prone to abnormal situations. Abnormal situations may cause data loss, damage, or inconsistency, resulting in the inability to read critical business data and affecting the normal operation of the business. Therefore, designing an effective file system to locate the root cause (traceability) of anomalies is crucial for ensuring the stable operation of the file system and its related services.

[0025] Traditional methods for determining the root cause of anomalies in embedded file systems include: Method 1: Offline full - volume data parsing. By exporting the complete operation data of the file system (such as transaction records, metadata changes), using regular expression matching, keyword filtering, or manual inspection of log entries one by one on an external device to locate error codes or abnormal operation nodes.

[0026] However, this method also has some deficiencies. For example, the traceability takes a long time. The full - volume data is huge in volume and complex in content. When analyzing, a large amount of information needs to be processed, and parsing the operation records line by line consumes a large amount of time, making the process slow and difficult to locate the root cause of the problem in a short time. The real - time performance is poor. It is necessary to stop the system operation and export the data in full volume, and it is impossible to trace in real time when an anomaly occurs. It cannot be discovered and processed in time at the moment when an anomaly occurs, which may lead to serious consequences for some systems with high real - time requirements.

[0027] Method 2: Static inspection tools. Use specialized static inspection tools (such as fsck) to scan the file system, scan the integrity of the file system metadata, and repair inconsistent states.

[0028] However, this method's dynamic operation is invisible. It only scans the file system at a static moment and cannot track the dynamic changes during the file system's operation. Due to the limitations of the rule library, predefined rules are difficult to cover all abnormal scenarios, resulting in a high false alarm / miss rate.

[0029] Method 3: Invasive snapshot. During the operation of the file system, a complete state copy of the file system at a certain moment is created regularly by means of specific instructions or operations. During diagnosis, the normal snapshot is compared with the snapshot at the abnormal moment to analyze the differences to find the cause of the abnormality.

[0030] However, this method is highly invasive. Creating a snapshot will interfere with the normal operation of the file system, resulting in a short interruption of the service.

[0031] To solve the above problems, embodiments of the present invention provide a method, apparatus, electronic device, and readable storage medium for determining the root cause of an abnormality.

[0032] The following will combine the accompanying drawings and explain in detail the method, apparatus, electronic device, and readable storage medium for determining the root cause of an abnormality provided by the embodiments of the present invention through specific embodiments and their application scenarios.

[0033] Among them, the method for determining the root cause of an abnormality can be applied to the host computer on which the target application APP is installed, and the target APP can execute each step of the method for determining the root cause of an abnormality.

[0034] See Figure 1 , the embodiments of the present invention provide a schematic diagram of the system architecture of a method for determining the root cause of an abnormality. The target APP in the host computer interacts with the embedded device with a file system through a serial port to obtain the print data of the file system, and monitors whether there is an abnormality in the file system based on the print data.

[0035] In addition, the method for determining the root cause of an abnormality in the embodiments of the present invention can also be executed by a device equipped with the target APP, or by setting up a cloud diagnosis server to upload the relevant data of the embedded device to the cloud for root cause tracing; a dedicated hardware tracing module can also be used.

[0036] Since there are various types of embedded file systems, their carriers may be flash, SD cards, or EEPROM, and the instructions for data acquisition and the parsing rules of the data itself are also different. This article only takes the littlefs file system on flash as an example for illustration.

[0037] As Figure 2 shown, the method for determining the root cause of an abnormality includes: step 210, step 220, step 230, and step 240.

[0038] Step 210: When it is monitored from the print data output through the serial port that there is an abnormality in the file system, obtain the directory chain of the target file corresponding to the abnormality.

[0039] The file system in the embodiment of the present invention refers to the file system of an embedded device, that is, an embedded file system.

[0040] Taking the target APP program as the execution subject as an example, the target APP program can monitor in real time the print data output during the operation of the file system through the serial port. The print data includes, but is not limited to, file system mount information, file operation logs, file system errors and warnings, and performance data, etc.

[0041] For any kind of print data, when it is determined that there is an exception indicator in the print data, it can be determined that there is an abnormality in the file system.

[0042] The exception indicator usually refers to the status used to mark or indicate the occurrence of an exception in a program. Specifically, the exception indicator refers to the mechanism in a program for tracking, detecting, responding to, or recording errors or exception situations, and usually includes error codes, exception flags (such as represented by boolean values), and status codes, etc.

[0043] For example, if it is monitored that data cannot be written to the file file1.txt continuously, and the file system has an abnormal error message printed as littlefswrite file1.txt error, "error" is the exception prompt.

[0044] The target file refers to the file where the abnormality occurs. For example, if the aforementioned file1.txt cannot write data continuously, this file1.txt is the corresponding target file.

[0045] When performing root cause location of the abnormality, it is necessary to determine the directory chain and directory level of the target file corresponding to the abnormality. The directory chain represents the path of the target file in the file system. The directory chain includes at least one directory folder and the file name of the target file. The directory level represents which level directory the target file is in the file system, and the directory level is represented by N.

[0046] Step 220: According to the hierarchical order of the directory chain from high to low, sequentially obtain and parse the block data of each layer of directory folder and the target file in the directory chain, and generate a target parsing file containing the parsing results of each layer of directory folder and the target file respectively; the data format of the block data is binary data; the data format in the parsing file is structured data.

[0047] The data block of a file is the basic unit for the file system to store the content of the file. The data block size is configurable. For example, 1 data block is 4096 bytes.

[0048] The data blocks of the directory folder store metadata about files (such as file names, permissions, locations, sizes, etc.) in the file system, and this information is also stored in the data blocks.

[0049] After determining the directory chain in the embodiments of the present invention, in the hierarchical order from high to low (starting from the root directory folder and sequentially down to the lower-level directory folders), the data blocks of each directory folder and the data blocks of the target file are accessed in sequence.

[0050] First, the data block of the root directory folder is obtained. The data block of the root directory folder is the superblock of the file system, i.e., superblock.

[0051] The block data of the data block can be obtained by inputting the fal instruction.

[0052] Assume the block addresses of the superblock are: 00000000, 00001000, that is, the file system starts from address 00000000 for 8192 bytes. Then, the block data of the superblock can be obtained based on the following fal instruction: fal probe data ------- represents obtaining the file system partition information with the name data; fal read 0 8192 ----- represents reading the data of 8192 bytes starting from 0 in the data file system partition.

[0053] The block data of the obtained data block can be stored in a file, such as log_littlefs_superblock.txt.

[0054] In fact, except that the address of the superblock extracted for the first time is known, the addresses of other folders on the directory chain except the root directory folder need to be obtained from the parsing result of the root directory folder. Therefore, it is necessary to first parse the block data of the corresponding superblock of the root directory folder to obtain the corresponding parsing result of the root directory folder, and then query the block addresses of other folders and the target file from the parsing result of the root directory folder; according to the block addresses of other folders and the target file, obtain the block data of the data blocks of other folders and the target file.

[0055] The data format of block data is base data, such as binary, hexadecimal, etc. It is necessary to parse the base data, and the parsing result obtained is structured data. Structured data refers to data that conforms to a certain format and organization method, and is usually highly ordered and normalized. This type of data is usually stored in database tables and presented in the form of rows and columns. Each column represents a data field, and the data type is usually predefined, such as integers, floating decimals, characters, etc.

[0056] The block data of each data block can be parsed according to the data definition rules of the littlefs file system. The parsing result of each data block can be stored in the target parsing file analysis.txt. Analysis.txt can present all the current contents under the root directory of the littlefs file system, including all file names and folder names.

[0057] For example, the format presented by the parsing result of a certain file is: tag: 00200403; type: 0x002 = DIR; id: 001; size: 003; data: 427363 = Bsc(005E9000, 000D6000), tap represents the tag type, tape being 0x002 represents the file type, id represents the file identifier of the associated file, size represents the length L of the subsequent data associated with the tag, and data represents the data content of the tag.

[0058] Step 230: Generate a tree-like graph based on the target parsing file; the tree-like graph at least includes the folder identifiers of each directory folder, the file identifiers of the target files, the hierarchical order, and each parsing result.

[0059] The analysis.txt file finally obtained in the embodiment of the present invention is the target parsing file. A tree-like graph of the entire branch where the target file corresponding to the exception is located can be generated according to the target parsing file. Specifically, the tree-like graph can be generated with the help of a graphics library or a predefined file.

[0060] The nodes of the tree-like graph are folder identifiers (which can be folder names) or file identifiers (which can be file names), used to represent the directory folders or target files on the directory chain. The connection relationship between the nodes represents the upper and lower directory relationship, and the attributes of the nodes can include the corresponding parsing results.

[0061] In addition, the tree-like picture can also include other files and directories at the adjacent levels of the target file, as well as the data block pointer address where the file is located, etc., which are not limited herein.

[0062] See Figure 3, an embodiment of the present invention provides a schematic diagram of a tree-like graph, which includes a directory chain. The directory chain is / - MinFrz40 - Data001 - file1.txt. Among them, " / " represents the root directory folder, "MinFrz40" is the folder name of the first-level directory folder, "Data001" is the second-level directory folder, and "file1.txt" is the file name of the target file corresponding to the exception.

[0063] There are corresponding parsing results for " / ", "MinFrz40", "Data001", and "file1.txt". For example, the parsing result of the root directory. The parsing result can include various metadata tags, metadata types, identifiers of associated files, data lengths, and data contents.

[0064] Step 240: Analyze the tree-like graph through an automated analysis tool to determine the root cause of the exception.

[0065] After obtaining the tree-like graph, it can be analyzed through an automated analysis tool (such as Databricks, GraphX) to trace back the operations before the target file had an exception. By analyzing the relevant address information of the problem file, analyzing the link information between files, and the relevant data operations of the problem file, etc., to determine whether these operations conform to the logical order of file and directory creation and update, whether there is an incomplete submission caused by power failure, and whether there are other unexpected operations that affect the normal file operation order, so as to locate the root cause of the exception. This root cause is the source of the exception.

[0066] The generation of the tree-like graph for this exception problem ends, and return to step 210 to continue monitoring file system exceptions.

[0067] The method for determining the root cause of the exception provided by the embodiment of the present invention can be applied to any embedded file system. Once an exception in the file system is detected, the block data of each layer of directory folders and the target file in the directory chain are sequentially obtained and parsed to generate a target parsing file containing the parsing results of each layer of directory folders and the target file, realizing the conversion of discrete data entries into a traceable operation sequence chain, improving the diagnostic efficiency. And compared with analyzing discrete full-scale data, by generating a tree-like graph based on the target parsing file and analyzing the tree-like graph through an automated analysis tool to determine the root cause of the exception, it realizes incremental parsing of a small part of the data, reduces the parsing time and resource consumption, and has high real-time performance. In addition, this process does not affect the continued operation of the device where the file system is located, and maximally retains the problem site state, which can improve the accuracy of parsing.

[0068] In some embodiments, a root directory folder is included in the directory chain; successively obtaining the block data of the directory folders and target files at each layer in the directory chain includes: Obtaining the block address of the root directory folder; the block address of the root directory folder is the block address of the super block; Obtaining the block data of the data block of the root directory folder according to the block address of the root directory folder; Parsing the block data in the data block of the root directory folder to obtain the parsing result of the root directory folder; In the case where there are other folders in the directory chain besides the root directory folder, querying the block addresses of the other folders and target files from the parsing result of the root directory folder; Obtaining the block data of the data blocks of the other folders and target files according to the block addresses of the other folders and target files.

[0069] As described in the foregoing embodiments, since the block size of each data block is determined, each data block has a corresponding block address, and the block address includes a start address (initial address) and an end address (ending address). The directory level of the root directory is 0, and the start address of the root directory super block extracted for the first time is 0000000. Then, the end address of the super block can be obtained according to the block size of the data block and the start address 0000000. Furthermore, the block data of the data block of the root directory folder can be obtained according to the start address and end address of the super block, and the block data in the data block of the root directory folder can be parsed to obtain the parsing result of the root directory folder. The parsing result of the root directory folder includes the block addresses of the other folders and target files in the directory chain besides the root directory folder. Furthermore, the block data of the data blocks of the other folders and target files can be obtained according to the block addresses of the other folders and target files.

[0070] In some embodiments, each data block includes two sub-data blocks; the block data in the two sub-data blocks are backup data for each other; and parsing the block data of the directory folders and target files at each layer in the directory chain includes: For the data block of any one of the directory folders and target files, parsing the version numbers of the two sub-data blocks respectively from the data headers of the block data of the two corresponding sub-data blocks of the data block; Determining the target sub-data block with the higher version number according to the version numbers of the two sub-data blocks; Parsing the data body of the target sub-data block to obtain the parsing result of the data body; Concatenating the parsing result of the version number and the data body of the target sub-data block to obtain the parsing result of the data block.

[0071] In fact, for disaster recovery purposes and to improve data reliability, a data block usually includes two sub-data blocks. The data in these two sub-data blocks are backup data for each other, and there are many identical parts in their parsing results. When performing data parsing, usually the parsing result of the block data of the target sub-data block with a higher version number is retained because the parsing result of the block data of the target sub-data block is more complete.

[0072] In addition, when the version numbers of the two target sub-data blocks are the same, one of the sub-data blocks can be randomly selected as the target sub-data block.

[0073] Specifically, assuming the size of the data block is 8192, then the sizes of the two sub-data blocks are 4096 respectively. The related technology is to parse the block data of the two sub-data blocks respectively. After both data blocks are parsed, the parsing result of the block data of the target sub-data block with a higher version number is retained.

[0074] For the consideration of saving parsing efficiency, the version numbers of each sub-data block can be compared first. Specifically, the data headers of the two sub-data blocks can be obtained, and the respective version numbers of the two sub-data blocks can be parsed from the two data headers.

[0075] In practical applications, the first 4096-byte binary data (the first sub-data block) can be taken out first, and then stored in variable B1. Then, the first target bytes (such as 4 bytes) of B1 are taken out and stored in variable R1. The first target bytes correspond to the data header of the first sub-data block, which is converted into revision_number to represent the version number of the first sub-data block, and the result is stored in A1.

[0076] Then, the last 4096-byte binary data (the second sub-data block) is taken out, and then stored in variable B2. Then, the first target bytes (such as 4 bytes) of B2 are taken out and stored in variable R2. The first target bytes correspond to the data header of the second sub-data block, which is converted into revision_number to represent the version number of the second sub-data block, and the result is stored in A2.

[0077] Next, the sizes of A1 and A2 can be compared. The larger value corresponds to the higher version number. Assuming the version number of A1 is better, then A1 can be retained, the data body B1 of A1 can be retained, and B2 and R2 corresponding to the other lower version number A2 can be deleted. That is, subsequently, the sub-data block B1 with a higher version number needs to be parsed, and there is no need to parse the sub-data block B2 with a lower version number, thereby improving the parsing efficiency.

[0078] Specifically, A1 can be removed from B1 to obtain a new B1, which is the data body of the target sub-data block. The data body in the target sub-data block can be parsed to obtain the parsing result of the data body. Then, the version number of the target sub-data block and the parsing result of the data body are concatenated to obtain the parsing result of the data block. Specifically, this concatenation can be achieved by appending the parsing result of the new B1 to A1 in an append form to obtain the parsing result of the target sub-data block, which is also the parsing result of the corresponding data block.

[0079] In some embodiments, parsing the data body of the target sub-data block to obtain the parsing result of the data body includes: Performing at least one metadata parsing on the data body based on the encoding rule until the parsing end condition is satisfied; in this parsing process, the following steps are executed: When the data body corresponding to this parsing is not empty, read the base data of the first preset number of bytes of the data body corresponding to this parsing; When it is determined that the label corresponding to the base data of the first preset number of bytes is a metadata label, parse the metadata information corresponding to this parsing from the data body corresponding to this parsing; Remove the base data corresponding to the metadata label and the metadata information corresponding to this parsing from the data body corresponding to this parsing to obtain the data body corresponding to the next parsing; Concatenate the metadata information obtained from each parsing in order to obtain the parsing result of the data body; the parsing end condition is that the label of the latest parsing is not a metadata label, or the new data body of the latest parsing is empty.

[0080] The parsing of the data body in the embodiments of the present invention is a progressive parsing. Specifically, continuing from the foregoing embodiments, the new data body is stored in the variable B1. When the data body corresponding to this parsing is not empty, take out the base data of the first preset number of bytes (such as 4 bytes) of B1 and store it in the variable T. Determine whether the label corresponding to T is a metadata label tag. If so, store T in the variable A1, parse the metadata information corresponding to this parsing from the data body corresponding to this parsing, and store it in the variable A1. Remove the base data corresponding to the metadata label and the metadata information corresponding to this parsing from the corresponding variable B1 of the data body to obtain the new variable B1 corresponding to the next parsing. The new variable B1 corresponding to the next parsing also follows the above parsing method.

[0081] If not, the parsing of this data block ends.

[0082] In some embodiments, parsing the metadata information corresponding to this parsing from the data body corresponding to this parsing includes: Parse the metadata attribute information from the data body corresponding to this parsing; the metadata attribute information includes at least the metadata type and the data length; Based on the data length, extract the base data corresponding to the data content of the metadata information; Based on the metadata type, perform format conversion on the base data corresponding to the data content to obtain the data content of the metadata; Concatenate the metadata attribute information and the data content of the metadata to obtain the metadata information corresponding to this parsing.

[0083] In the case where the tag corresponding to the base data of the preset byte is determined to be the metadata tag in the embodiment of the present invention, further parse the 4-byte (i.e., 32-bit) tag according to the design specification of the tag, and identify metadata attribute information such as the metadata type type, the file id associated with the tag, and the subsequent data length L associated with the tag. The base data corresponding to the data content of the metadata information can be extracted according to the data length L and stored in the variable D.

[0084] Parse D. For example, if type = 0x001, it means that the content corresponding to this tag is a normal file (LFS_TYPE_REG), then D can be converted to ASCII code to parse the corresponding file name; if type = 0x002, it means that the content corresponding to this tag is a folder (LFS_TYPE_DIR), then D can be converted to ASCII code to parse the corresponding folder name; another example is that if type = 0x500, it means that the content corresponding to this tag is a CRC check code (LFS_TYPE_CRC), then D directly represents the CRC code, and after format conversion, it is still the original CRC code, so the CRC code is the same before and after conversion.

[0085] See Figure 4 , the embodiment of the present invention provides a flow diagram for parsing data blocks, including the following steps: Step 401, parse the version numbers of the two sub-data blocks respectively from the data headers of the block data of the two corresponding sub-data blocks of the data block; Step 402, determine the target sub-data block with the higher version number according to the version numbers of the two sub-data blocks; Step 403, obtain the data body corresponding to this parsing of the target sub-data block; Step 404, determine whether the data body corresponding to this parsing is empty; if not, execute step 405; if so, execute step 412; Step 405, read the base data of the preset first few bytes of the data body corresponding to this parsing; Step 406: Determine whether the tag corresponding to the pre-set byte's radix data is a metadata tag; if so, execute Step 407; if not, execute Step 412; Step 407: Parse the metadata attribute information from the data body corresponding to the current parsing; the metadata attribute information includes at least the metadata type and the data length; Step 408: Based on the data length, extract the radix data corresponding to the data content of the metadata information; Step 409: Based on the metadata type, perform format conversion on the radix data corresponding to the data content to obtain the data content of the metadata; Step 410: Concatenate the metadata attribute information and the data content of the metadata to obtain the metadata information corresponding to the current parsing; Step 411: Remove the metadata tag corresponding to the current parsing and the radix data corresponding to the metadata information from the data body to obtain the data body corresponding to the next parsing; execute Step 404; Step 412: Determine that the data block parsing is completed.

[0086] For the detailed execution processes of the above Steps 401 to 412, refer to the foregoing embodiments and will not be elaborated here.

[0087] In some embodiments, the metadata attribute further includes the file identifier of the associated file; generating a target parsing file including the parsing results of each layer of directory folders and the target file respectively includes: Successively store the parsing results of each layer of directory folders and the target file into the initial parsing file to obtain an intermediate parsing file; Search for the target metadata where the file identifier of the target file is located in the intermediate parsing file; Obtain the file content of the target file according to the target metadata; Store the file content of the target file into the intermediate parsing file to obtain the target parsing file.

[0088] In the embodiment of the present invention, the initial parsing file is an empty analysis.txt file. The parsing results of each layer of directory folders and the target file can be successively stored into the initial parsing file in hierarchical order to obtain an intermediate parsing file, that is, the intermediate file includes each parsing result.

[0089] In the embodiment of the present invention, for exceptions targeting the target file, in order to locate the root cause of the exception, it is also necessary to obtain the file content of the target file corresponding to the exception and store the file content of the target file into the above intermediate parsing file to obtain the target parsing file.

[0090] As described in the foregoing embodiments, the metadata attributes further include the file identifier of the associated file. Then, the metadata can be searched in the intermediate parsing file based on the file identifier of the target file to find the metadata information whose file identifier of the associated file is the same as that of the target file. This metadata information is the required target metadata information, and the file content of the target file can be obtained based on this target metadata information.

[0091] In some embodiments, the metadata attributes further include the file structure type of the associated file; the file structure type is an inline structure type or a compressed pointer structure type; obtaining the file content of the target file according to the target metadata includes: In the case where it is determined from the target metadata that the structure type of the target file is an inline structure type, determining that the file content of the target file is the data content of the target metadata; or, In the case where it is determined from the target metadata that the structure type of the target file is a compressed pointer structure type, obtaining the file length of the target file and the address of the last data content from the data content of the target metadata; the target file includes a plurality of content units arranged in an orderly manner; Performing at least one content search operation on the target file until the sum of the lengths of the multiple content units obtained by each search operation reaches the file length; the search operation includes: Obtaining the data content corresponding to the current search operation based on the search address corresponding to the current search operation; Extracting the content unit corresponding to the current search operation and the operation address corresponding to the next search operation from the data content corresponding to the current search operation; Concatenating the content unit corresponding to the current search operation in front of the content unit corresponding to the previous historical search operation; Wherein, the search address corresponding to the first search operation is the address of the last data content.

[0092] In fact, the metadata attributes further include the file structure type of the associated file, and the file structure type is an inline structure type inlinestruct or a compressed pointer structure type CTZSTRUCT.

[0093] Among them, the inline structure type inlinestruct means that the structure body is directly defined during declaration or initialization, rather than being defined separately externally and then referenced. The file structure type being an inline structure type indicates that the file size of the target file is less than 4096 bytes. In this case, the data part data of the target metadata information is the file content of the target file.

[0094] The compressed pointer structure type CTZSTRUCT generally involves storing or representing a pointer (i.e., a memory address) in a more compact form, which can save memory space or optimize performance. The structure type of the target file is the compressed pointer structure type. The file size of the target file is greater than 4096 bytes. In this case, the file content is usually divided into multiple content units arranged in an orderly manner. The sizes of these content units can be the same or different, and each content unit is stored at multiple addresses respectively.

[0095] The file length of the target file and the address of the last data content can be obtained from the data content of the target metadata. For example, the data content data of the target metadata corresponds to 8 bytes. Among them, the last 4 bytes represent the file length of the target file, and the first 4 bytes represent the address of the data content where the last content unit is located. Next, at least one content search operation can be performed on the target file until the sum of the lengths of the multiple content units obtained by each search operation reaches the file length. During each search process, the data content corresponding to the current search operation can be obtained based on the search address corresponding to the current search operation; the content unit corresponding to the current search operation and the operation address corresponding to the next search operation can be extracted from the data content corresponding to the current search operation, and the content unit corresponding to the current search operation is concatenated in front of the content unit corresponding to the previous historical search operation until the sum of the lengths of the multiple content units obtained by each search operation reaches the file length.

[0096] The search address corresponding to the first search operation is the address of the last data content. The last data content includes the last content unit and the search address of the next search operation. Through the search address of the next search operation, the data content corresponding to the next search can be found. The data content corresponding to the next search includes the penultimate content unit and the search address corresponding to the next search. In this way, the complete file content can be searched in turn.

[0097] See Figure 5 , the second flow diagram of a method for determining the root cause of an exception provided by an embodiment of the present invention includes the following steps: Step 501, continuously monitor the file system; Step 502, determine whether an exception occurs; if so, execute Step 503; if not, execute Step 501; Step 503, obtain the directory chain and the directory level number N of the target file corresponding to the exception; Step 504, obtain the block data of the data block of the root directory folder according to the block address of the root directory folder; Step 505: Parse the block data in the data blocks of the root directory folder to obtain the parsing result of the root directory folder; and store the parsing result of the root directory folder in the initial parsing file. Step 506: Determine whether the directory level number N is greater than 0. If it is, execute Step 507; if not, execute Step 512. Step 507: Obtain the block address of the directory folder at the current level from the initial parsing file; the current level is greater than 0. Step 508: Obtain the block data of the data blocks of the directory folder at the current level according to the block address of the directory folder at the current level. Step 509: Parse the block data of the data blocks of the directory folder at the current level to obtain the parsing result of the directory folder at the current level. Step 510: Append and store the parsing result of the directory folder at the current level in the initial parsing file to obtain an intermediate parsing file. Step 511: Update the current level to the next level, and determine whether the level number of the next level is greater than N. If it is, execute Step 512; if not, execute Step 507. Step 512: Obtain and append the file content of the target file to the intermediate parsing file to obtain the final target parsing file; execute Step 513. Step 513: Generate a tree-like graph based on the target parsing file. Step 514: Analyze the tree-like graph through an automated analysis tool to determine the root cause of the anomaly; return to Step 501.

[0098] For the detailed execution process of the above Steps 501 to 514, refer to the foregoing embodiments and will not be elaborated here.

[0099] The method for determining the root cause of an anomaly provided by the embodiments of the present invention can monitor the anomalies of the file system in real time through the developed APP, and trigger the traceability mechanism immediately once an anomaly is found; it can be applied to all embedded file systems and has strong versatility. Parsing the relevant branches from the root directory folder to the target file targeted by the anomaly greatly reduces the data range of the traceability target, realizes incremental parsing, and there is no need to analyze item by item from the full-scale data, reducing the parsing time and resource consumption; taking the littlefs file system as an example, the size of the full-scale exported data of this file system is 164MB, while the data size extracted incrementally by the present invention is only several hundred KB (the specific size depends on the directory depth where the problem file is located. If it is a file under the first-level directory, the data size is about 100KB). The traceability time for full-scale parsing is 4 hours, while the incremental parsing is only 15 minutes. Generate a tree-like graph based on the target parsing file; the tree-like graph at least includes the folder identifiers of each directory folder, the file identifiers of the target files, the hierarchical order, and each parsing result, realizing the construction of a transaction execution chain, converting discrete data entries into a traceable operation sequence chain, and improving the diagnosis efficiency; Through the developed APP, all processes from abnormal monitoring to extraction and parsing of abnormal-related data are automatically completed without omission, minimizing the human participation in the traceability process, and thus reducing the missed judgment and misjudgment caused by the high human participation in the prior art; In addition, when an abnormality in the file system of the embedded terminal is detected, the developed host computer APP immediately extracts a small part of the data related to the abnormal file and generates a tree-like branch graph, which does not affect the continued operation of the terminal and maximally retains the problem site state; In addition, the above-mentioned root cause location process of the abnormality is automatically implemented through the existing rules of the file system and interacts with the data extraction process of the file system carrier to completely parse all the data related to the path of the problem file; The target parsing file provided by the embodiment of the present invention can assist technicians in analyzing the relevant address information of the problem file, analyzing the link information between files, and data operations related to the problem file, greatly simplifying the analysis difficulty.

[0100] Compared with the foregoing method 1, the root cause determination method for abnormality provided by the present invention has strong real-time performance. Once an abnormality occurs, the parsing process is immediately started. From the occurrence of the abnormality to the generation of the abnormal branch graph, the entire process can be completed within 3 minutes without stopping the device operation and fully exporting the data before parsing; Compared with the foregoing method 2, the root cause determination method for abnormality provided by the present invention has high accuracy. The parsed data is all the data on the corresponding directory chain of the files related to the abnormal problem. By parsing layer by layer through the directory, there will be no omission; Compared with the foregoing method 3, the root cause determination method for abnormality provided by the present invention does not affect the normal operation of the terminal. The APP for executing the above-mentioned root cause location process is installed on the host computer. The APP only extracts a small part of the data of the file system when detecting an abnormality, and has low running interference and does not occupy the limited resources of the terminal.

[0101] For the root cause determination method for abnormality provided by the embodiment of the present invention, the execution subject may be a root cause determination device for abnormality. In the embodiment of the present invention, taking the root cause determination device for abnormality executing the root cause determination method for abnormality as an example, the root cause determination device for abnormality provided by the embodiment of the present invention is described.

[0102] The embodiment of the present invention also provides a root cause determination device for abnormality.

[0103] Such as Figure 6As shown in the figure, the root cause determination device for this exception includes: a first processing module 610, a second processing module 620, a third processing module 630, and a fourth processing module 640.

[0104] The first processing module 610 is configured to obtain the directory chain of the target file corresponding to the exception when it is monitored that there is an exception in the file system from the print data output through the serial port. The second processing module 620 is configured to sequentially obtain and parse the block data of the data blocks of each layer of directory folders and the target file in the directory chain according to the hierarchical order from high to low, and generate a target parsing file including the parsing results of each layer of directory folders and the target file respectively; the data format of the block data is binary data; the data format in the parsing file is structured data. The third processing module 630 is configured to generate a tree-like graph based on the target parsing file; the tree-like graph includes at least the folder identifier of each directory folder, the file identifier of the target file, the hierarchical order, and each parsing result. The fourth processing module 640 is configured to analyze the tree-like graph through an automated analysis tool to determine the root cause of the exception.

[0105] In some embodiments, the directory chain includes a root directory folder; the second processing module 620 is specifically configured to: Obtain the block address of the root directory folder; the block address of the root directory folder is the block address of the super block. Obtain the block data of the data block of the root directory folder according to the block address of the root directory folder. Parse the block data in the data block of the root directory folder to obtain the parsing result of the root directory folder. In the case that there are other folders in the directory chain except the root directory folder, query the block addresses of the other folders and the target file from the parsing result of the root directory folder. Obtain the block data of the data blocks of the other folders and the target file according to the block addresses of the other folders and the target file.

[0106] In some embodiments, each data block includes two sub-data blocks; the block data in the two sub-data blocks are backup data for each other; the second processing module 620 is specifically further configured to: For the data block of any one of each directory folder and the target file, parse the version numbers of the two sub-data blocks respectively from the data headers of the block data of the two corresponding sub-data blocks of the data block. Determine the target sub-data block with the higher version number according to the version numbers of the two sub-data blocks. Parse the data body of the target sub-data block to obtain the parsing result of the data body. Concatenate the parsing results of the version number of the target sub-data block and the data body to obtain the parsing result of the data block.

[0107] In some embodiments, the second processing module 620 is further specifically configured to: Perform at least one metadata parsing on the data body based on the encoding rule until the parsing end condition is met; during the current parsing process, execute the following steps: When the data body corresponding to the current parsing is not empty, read the base data of the first preset number of bytes of the data body corresponding to the current parsing; When it is determined that the label corresponding to the base data of the first preset number of bytes is a metadata label, parse the metadata information corresponding to the current parsing from the data body corresponding to the current parsing; Remove the base data corresponding to the metadata label and the metadata information corresponding to the current parsing from the data body corresponding to the current parsing to obtain the data body corresponding to the next parsing; Concatenate the metadata information obtained from each parsing in order to obtain the parsing result of the data body; the parsing end condition is that the label of the latest parsing is not a metadata label, or the new data body of the latest parsing is empty.

[0108] In some embodiments, the second processing module 620 is further specifically configured to: Parse the metadata attribute information from the data body corresponding to the current parsing; the metadata attribute information includes at least the metadata type and the data length; Extract the base data corresponding to the data content of the metadata information based on the data length; Perform format conversion on the base data corresponding to the data content based on the metadata type to obtain the data content of the metadata; Concatenate the metadata attribute information and the data content of the metadata to obtain the metadata information corresponding to the current parsing.

[0109] In some embodiments, the metadata attribute further includes the file identifier of the associated file; the second processing module 620 is further specifically configured to: Store the parsing results of each layer of directory folders and the target file into the initial parsing file in sequence to obtain an intermediate parsing file; Search for the target metadata where the file identifier of the target file is located from the intermediate parsing file; Obtain the file content of the target file according to the target metadata; Store the file content of the target file into the intermediate parsing file to obtain a target parsing file.

[0110] In some embodiments, the metadata attribute further includes the file structure type of the associated file; the file structure type is an inline structure type or a compressed pointer structure type; the second processing module 620 is further specifically configured to: When it is determined from the target metadata that the structure type of the target file is the inline structure type, determine that the file content of the target file is the data content of the target metadata; or, When it is determined from the target metadata that the structure type of the target file is the compressed pointer structure type, obtain the file length of the target file and the address of the last data content from the data content of the target metadata; the target file includes a plurality of content units arranged in an orderly manner; Perform at least one content search operation on the target file until the sum of the lengths of the multiple content units obtained by each search operation reaches the file length; the search operation includes: Obtain the data content corresponding to the current search operation based on the search address corresponding to the current search operation; Extract the content unit corresponding to the current search operation and the operation address corresponding to the next search operation from the data content corresponding to the current search operation; Concatenate the content unit corresponding to the current search operation in front of the content unit corresponding to the previous historical search operation; Among them, the search address corresponding to the first search operation is the address of the last data content.

[0111] The root cause determination device for exceptions in the embodiments of the present invention may be an electronic device or a component in an electronic device, such as an integrated circuit or a chip. The electronic device may be a terminal or other devices other than terminals. Exemplarily, the electronic device may be a mobile phone, a tablet computer, a laptop computer, a handheld computer, a vehicle-mounted electronic device, a Mobile Internet Device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc., and may also be a server, a Network Attached Storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc. The embodiments of the present invention do not make specific limitations.

[0112] The root cause determination device in the embodiments of the present invention can be a device with an operating system. The operating system can be the Microsoft (Windows) operating system, the Android operating system, the IOS operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present invention.

[0113] The root cause determination device provided in the embodiments of the present invention can implement Figures 1 to 5 each process implemented by the method embodiments. To avoid repetition, it will not be elaborated here.

[0114] In some embodiments, as Figure 7 shown, the embodiments of the present invention further provide an electronic device 700, including a processor 701, a memory 702, and a computer program stored on the memory 702 and executable on the processor 701. When the program is executed by the processor 701, it implements each process of the above-mentioned root cause determination method embodiments and can achieve the same technical effects. To avoid repetition, it will not be elaborated here.

[0115] The processor 701 can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present invention. The processor 701 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0116] The memory 702 can be a ROM (Read Only Memory), or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory), or other types of dynamic storage devices that can store information and instructions. It can also be an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory), or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium that can be used to carry or store computer programs and can be read by a computer, which is not limited herein.

[0117] The memory 702 is used to store the computer program for implementing the embodiments of the present invention and is controlled by the processor 701 for execution. The processor 701 is used to execute the computer program stored in the memory 702 to implement the steps shown in the foregoing method embodiments.

[0118] It should be noted that the electronic devices in the embodiments of the present invention include the above-mentioned mobile electronic devices and non-mobile electronic devices.

[0119] The embodiments of the present invention also provide a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements each process of the foregoing method embodiments for determining the root cause of an exception and can achieve the same technical effects. To avoid repetition, it will not be elaborated here.

[0120] Wherein, the processor is the processor in the electronic device described in the foregoing embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory ROM, random access memory RAM, magnetic disks, or optical discs, etc.

[0121] The embodiments of the present invention also provide a computer program product, including a computer program, which implements the foregoing method for determining the root cause of an exception when executed by a processor.

[0122] Wherein, the processor is the processor in the electronic device described in the foregoing embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory ROM, random access memory RAM, magnetic disks, or optical discs, etc.

[0123] Another embodiment of the present invention provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is configured to run programs or instructions to implement each process of the above-described method embodiments for determining the root cause of an exception, and can achieve the same technical effects. To avoid repetition, details are not described herein again.

[0124] It should be understood that the chip mentioned in the embodiments of the present invention may also be referred to as a system-on-chip, system chip, chip system, or system-on-a-chip, etc.

[0125] It should be noted that in this document, the terms "include", "comprise", or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device that includes a series of elements includes not only those elements but also other elements that are not explicitly listed, or elements that are inherent to such process, method, article, or device. Without further limitation, an element defined by the statement "including a..." does not exclude the presence of additional identical elements in the process, method, article, or device that includes the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present invention is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in a reverse order according to the functions involved. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. Additionally, the features described with reference to certain examples may be combined in other examples.

[0126] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-described method embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the related art, can be embodied in the form of a computer software product. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions for causing a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in various embodiments of the present invention.

[0127] The embodiments of the present invention have been described above in conjunction with the accompanying drawings. However, the present invention is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. Under the inspiration of the present invention, those of ordinary skill in the art can also make many forms without departing from the spirit and scope protected by the present invention and the claims, and all of them belong to the protection scope of the present invention.

[0128] In the description of this specification, the descriptions referring to terms such as "one embodiment", "some embodiments", "schematic embodiments", "examples", "specific examples", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0129] Although the embodiments of the present invention have been shown and described, those of ordinary skill in the art can understand that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the claims and their equivalents.

Claims

1. A method for determining the root cause of an anomaly, characterized in that, Including: When an abnormality in the file system is monitored in the print data output through the serial port, obtaining the directory chain of the target file corresponding to the abnormality; According to the hierarchical order of the directory chain from high to low, sequentially obtaining and parsing the block data of each layer of directory folders and the target file in the directory chain, and generating a target parsing file including the parsing results of each layer of directory folders and the target file respectively; The data format of the block data is binary data; The data format in the parsing file is structured data; Generating a tree-like graph based on the target parsing file; the tree-like graph at least includes the folder identifier of each directory folder, the file identifier of the target file, the hierarchical order, and each parsing result; Analyzing the tree-like graph through an automated analysis tool to determine the root cause of the abnormality.

2. The method for determining the root cause of an anomaly according to claim 1, wherein The directory chain includes a root directory folder; sequentially obtaining the block data of each layer of directory folders and the target file in the directory chain includes: Obtaining the block address of the root directory folder; the block address of the root directory folder is the block address of the super block; Obtaining the block data of the data block of the root directory folder according to the block address of the root directory folder; Parsing the block data in the data block of the root directory folder to obtain the parsing result of the root directory folder; When there are other folders in the directory chain except the root directory folder, querying the block addresses of the other folders and the target file from the parsing result of the root directory folder; Obtaining the block data of the data blocks of the other folders and the target file according to the block addresses of the other folders and the target file.

3. The method for determining the root cause of an anomaly according to claim 1, wherein Each data block includes two sub-data blocks; the block data in the two sub-data blocks are backup data for each other; And parsing the block data of each layer of directory folders and the target file in the directory chain respectively, including: For the data block of any one of each directory folder and the target file, parsing the version numbers of the two sub-data blocks respectively from the data headers of the block data of the two corresponding sub-data blocks of the data block; Determining the target sub-data block with the higher version number according to the version numbers of the two sub-data blocks; Parsing the data body of the target sub-data block to obtain the parsing result of the data body; Concatenating the parsing results of the version number and the data body of the target sub-data block to obtain the parsing result of the data block.

4. The method for determining the root cause of an exception according to claim 3, characterized in that The parsing the data body of the target sub-data block to obtain the parsing result of the data body includes: Performing at least one metadata parsing on the data body based on the encoding rule until the parsing end condition is met; in the current parsing process, the following steps are executed: When the data body corresponding to the current parsing is not empty, reading the binary data of the first preset number of bytes of the data body corresponding to the current parsing; When it is determined that the label corresponding to the binary data of the first preset number of bytes is a metadata label, parsing the metadata information corresponding to the current parsing from the data body corresponding to the current parsing; Remove the metadata tag corresponding to the current parsing and the binary data corresponding to the metadata information from the data body corresponding to the current parsing to obtain the data body corresponding to the next parsing; Concatenate the metadata information obtained from each parsing in order to obtain the parsing result of the data body; the parsing end condition is that the tag of the latest parsing is not a metadata tag, or the new data body of the latest parsing is empty.

5. The method for determining the root cause of an anomaly according to claim 4, characterized in that, The parsing of the metadata information corresponding to the current parsing from the data body corresponding to the current parsing includes: Parse the metadata attribute information from the data body corresponding to the current parsing; the metadata attribute information includes at least the metadata type and the data length; Based on the data length, extract the binary data corresponding to the data content of the metadata information; Based on the metadata type, perform format conversion on the binary data corresponding to the data content to obtain the data content of the metadata; Concatenate the metadata attribute information and the data content of the metadata to obtain the metadata information corresponding to the current parsing.

6. The method for determining the root cause of an anomaly according to claim 5, wherein The metadata attribute further includes the file identifier of the associated file; the generating of the target parsing file including the parsing results of each layer of directory folders and the target file respectively includes: Successively store the parsing results of each layer of directory folders and the target file respectively into the initial parsing file to obtain the intermediate parsing file; Search for the target metadata where the file identifier of the target file is located in the intermediate parsing file; Obtain the file content of the target file according to the target metadata; Store the file content of the target file into the intermediate parsing file to obtain the target parsing file.

7. The method for determining the root cause of an anomaly according to claim 6, wherein The metadata attribute further includes the file structure type of the associated file; The file structure type is an inline structure type or a compressed pointer structure type; The obtaining of the file content of the target file according to the target metadata includes: When it is determined from the target metadata that the structure type of the target file is an inline structure type, determining that the file content of the target file is the data content of the target metadata; or, When it is determined from the target metadata that the structure type of the target file is a compressed pointer structure type, obtain the file length of the target file and the address of the last data content from the data content of the target metadata; the target file includes a plurality of content units arranged in order; Perform at least one content search operation on the target file until the sum of the lengths of the plurality of content units obtained by each search operation reaches the file length; the search operation includes: Obtain the data content corresponding to the current search operation based on the search address corresponding to the current search operation; Extract the content unit corresponding to the current search operation and the operation address corresponding to the next search operation from the data content corresponding to the current search operation; Concatenate the content unit corresponding to the current search operation in front of the content unit corresponding to the previous historical search operation; Wherein, the search address corresponding to the first search operation is the address of the last data content.

8. An abnormal root cause determination device, characterized in that, Include: The first processing module is used to obtain the directory chain of the target file corresponding to the exception when an exception in the file system is monitored in the print data output through the serial port; The second processing module is used to sequentially obtain and parse the block data of the data blocks of each directory folder and the target file in the directory chain in the hierarchical order from high to low in the directory chain, and generate a target parsing file containing the parsing results of each directory folder and the target file respectively; The data format of the block data is binary data; The data format in the parsing file is structured data; The third processing module is used to generate a tree-like graph based on the target parsing file; the tree-like graph at least includes the folder identifier of each directory folder, the file identifier of the target file, the hierarchical order, and each parsing result; The fourth processing module is used to analyze the tree-like graph through an automated analysis tool to determine the root cause of the exception.

9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method for determining the root cause of the exception according to any one of claims 1-7.

10. A non-transitory computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the method for determining the root cause of the exception according to any one of claims 1-7.

Images