Fault root cause node determination method, electronic equipment and storage medium

Abstract

The invention provides a fault root cause node determination method, electronic equipment and a storage medium, and the method comprises the steps: determining a target abnormal object according to an entity object corresponding to abnormal alarm information; acquiring a historical abnormal object of which the running state is an abnormal state at the receiving moment of the abnormal alarm information; determining a calling relation between the target abnormal object and the historical abnormal object in the calling deployment map; according to the calling relationship between the target abnormal object and the historical abnormal object, constructing an abnormal propagation link; determining a root cause score corresponding to each link node according to the depth and in-degree of each link node in the abnormal propagation link in the abnormal propagation link; sorting the plurality of link nodes according to a descending sequence of the root cause scores to obtain a sorted node list; and determining the first plurality of link nodes in the sorted node list as fault root cause nodes so as to ensure that the obtained root cause is more accurate by performing traceability detection on the fault root cause nodes.

Description

Technical Field

[0001] The present invention relates to the field of anomaly detection, and in particular to a method for determining a fault root cause node, an electronic device, and a storage medium. Background Art

[0002] The current method for determining the root cause of a device cluster is to trace the source of a node in the cluster to find the root cause of the abnormal failure when an abnormal failure occurs. However, in actual applications, the root cause positioning accuracy of this simple tracing method is low. Since only the node with the abnormal failure is traced, the relationship between multiple nodes is ignored, and the underlying root cause node that caused the abnormal failure cannot be accurately located. This will result in incomplete troubleshooting of the abnormal failure and increase the possibility of the corresponding failure problem occurring again. Summary of the Invention

[0003] In view of the above technical problems, the technical solution adopted by the present invention is:

[0004] According to one aspect of the present application, a method for determining a fault root cause node is provided, comprising the following steps:

[0005] Step S100: In response to receiving abnormality warning information, determining a target abnormal object according to the entity object corresponding to the abnormality warning information;

[0006] Step S200: Obtain historical abnormal objects whose operating status is abnormal at the time of receiving abnormal alarm information from all entity objects;

[0007] Step S300: Determine the call relationship between the target exception object and the historical exception object in a preset call deployment graph; the call deployment graph includes the call relationship between several entity objects;

[0008] Step S400: Construct an exception propagation link based on the call relationship between the target exception object and the historical exception object; the link node in the exception propagation link is the object identifier corresponding to the target exception object or the object identifier corresponding to the historical exception object;

[0009] Step S500: Determine the root cause score corresponding to each link node in the abnormal propagation link according to the depth and in-degree of each link node in the abnormal propagation link;

[0010] Step S600: sorting a number of link nodes according to descending order of root cause scores to obtain a sorted node list;

[0011] Step S700: Determine the first n link nodes in the sorted node list as fault root cause nodes; wherein n is a preset node quantity threshold.

[0012] In an exemplary embodiment of the present application, step S100 includes:

[0013] Step S110: If the abnormal alarm information indicates that the call of the entity object generates an abnormal alarm, then execute step S120;

[0014] If the abnormal alarm information indicates that the entity object itself has generated an abnormal alarm, the entity object is determined as the initial entity object, and step S130 is executed;

[0015] Step S120: If the ratio of the number of abnormal calls of the called entity object to the total number of calls of the called entity object is greater than a preset abnormal call ratio, the called entity object is determined as the initial entity object, and step S130 is executed;

[0016] Step S130: If the initial entity object is a service and / or component, the service and / or component is determined as a target abnormal object;

[0017] If the initial entity object is a deployment instance, the services and / or components deployed on the deployment instance are determined as target exception objects.

[0018] In an exemplary embodiment of the present application, the deployment graph is obtained by the following steps:

[0019] Step S301: Obtain the object identifier of the calling object and the object identifier of the called object corresponding to each entity object; the calling object corresponding to the entity object is the entity object having a calling relationship with the entity object; the called object corresponding to the entity object is the entity object having a called relationship with the entity object;

[0020] Step S302: Based on the calling relationship between each entity object and the calling object corresponding to the entity object, and the calling relationship between each entity object and the called object corresponding to the entity object, the object identifiers corresponding to each entity object are sequentially connected to obtain a call deployment graph;

[0021] If there is a calling relationship between two entity objects, then in the calling deployment graph, the object identifier of the calling entity object points to the object identifier of the called entity object.

[0022] In an exemplary embodiment of the present application, step S300 includes:

[0023] Step S310: Determine the target abnormal object and the historical abnormal objects as abnormal entity objects;

[0024] Step S320: Obtain the object identifier of each abnormal entity object to obtain an abnormal entity object identifier list A=(A1, A2, ..., Ai ,...,A j ); where i = 1, 2, ..., j; j is the number of abnormal entity objects; A i is the object identifier of the i-th abnormal entity object;

[0025] Step S330: Determine A from the call deployment graph. i The corresponding abnormal entity object and A k The calling relationship between the corresponding exception entity objects; where k = 1, 2, ..., j; and k ≠ i.

[0026] In an exemplary embodiment of the present application, step S400 includes:

[0027] Step S410: A i The corresponding abnormal entity object and A k Among the corresponding exception entity objects, the exception entity object belonging to the caller is determined as the calling exception object, and the exception entity object belonging to the callee is determined as the called exception object;

[0028] Step S420: Determine the shortest path in the call deployment graph, starting from the object identifier of the calling exception object and ending at the object identifier of the called exception object, as A. i and A k The calling relationship path between them;

[0029] Step S430: Integrate and remove duplicates from multiple call relationship paths to obtain an initial propagation link;

[0030] Step S440: Prune the initial propagation link according to the number of abnormal nodes and normal nodes in the initial propagation link to obtain an abnormal propagation link.

[0031] In an exemplary embodiment of the present application, step S440 includes:

[0032] Step S441: Determine the object identifier of the abnormal entity object in the initial propagation link as an abnormal node, and determine the object identifier of the non-abnormal entity object in the initial propagation link as a normal node;

[0033] Step S442: In the initial propagation link, if the number of normal nodes between two adjacent abnormal nodes is greater than a preset interval number, the call relationship path between the two abnormal nodes is deleted from the initial propagation link;

[0034] Step S443: If the link node with an out-degree of zero in the initial propagation link is a normal node, the call relationship path between the normal node and the abnormal node closest to the normal node, as well as the normal node, are deleted from the initial propagation link to obtain an abnormal propagation link.

[0035] In an exemplary embodiment of the present application, step S500 includes:

[0036] Step S510: Obtain the depth of each link node in the abnormal propagation link to obtain a node depth list B = (B1, B2, ..., B m ,...,B q ); where m = 1, 2, ..., q; q is the number of link nodes in the abnormal propagation link; B m is the depth of the mth link node in the abnormal propagation link;

[0037] Step S520: Obtain the in-degree of each link node in the abnormal propagation link to obtain a node in-degree list C = (C1, C2, ..., C m ,...,C q ); among them, C m is the in-degree of the m-th link node in the abnormal propagation link;

[0038] Step S530: Determine the transitivity score corresponding to each link node in the abnormal propagation link according to the node depth list B to obtain a transitivity score list D = (D1, D2, ..., D m ,...,D q ); where D m =B m / B0;D m is the transitivity score corresponding to the mth link node in the abnormal propagation link; B0=MAX(B); MAX() is a preset maximum value determination function;

[0039] Step S540: Determine the service call score corresponding to each link node in the abnormal propagation link according to the node in-degree list C, so as to obtain a service call score list E=(E1, E2, ..., E m ,...,E q ); where E m =C m / C0;E m is the service call score corresponding to the mth link node in the abnormal propagation link; C0 = MAX(C);

[0040] Step S550: Determine the root cause score corresponding to each link node in the abnormal propagation link according to the transitivity score list D and the service call score list E, so as to obtain a root cause score list F = (F1, F2, ..., F m ,...,F q ); where F m =a×D m +b×E m ; F m is the root cause score corresponding to the mth link node in the abnormal propagation link; a is the preset transitivity score coefficient; b is the preset service call score coefficient; a+b=1.

[0041] In an exemplary embodiment of the present application, step S600 includes:

[0042] Step S610: sort the root cause scores in the root cause score list F from large to small to obtain a sorted root cause score list G = (G1, G2, ..., G m ,...,G q ); where G m is the mth root cause score obtained after sorting in descending order of values;

[0043] Step S620, traverse the sorted root cause score list G, if G m =G p , then execute steps S630 to S670; wherein p = 1, 2, ..., q; and p ≠ m;

[0044] If the root cause scores in the sorted root cause score list G are different, then the link nodes are sorted accordingly according to the ranks of the root cause scores in the sorted root cause score list G to obtain a sorted node list;

[0045] Step S630: Get G m The number of abnormal information generated by the corresponding link node within the target time period d(m); where the end time of the target time period is the time when the abnormal alarm information is received, and the length of the target time period is the preset time length;

[0046] Step S640: If d(m) is greater than or equal to the preset first information threshold, determine G m The abnormal information score J of the corresponding link node m =g1×G m ;

[0047] If d(m) is less than the preset first information threshold and greater than the preset second information threshold, then determine G m The abnormal information score J of the corresponding link node m =g2×Gm ;

[0048] If d(m) is less than or equal to the preset second information threshold, then determine G m The abnormal information score J of the corresponding link node m =g3×G m ;

[0049] Among them, the first information volume threshold is greater than the second information volume threshold; g1 is the preset first abnormality alarm coefficient; g2 is the preset second abnormality alarm coefficient; g3 is the preset third abnormality alarm coefficient; g1>g2>g3;

[0050] Step S650: Get G p The number of abnormal information generated by the corresponding link node in the target time period f(p);

[0051] Step S660: If f(p) is greater than or equal to the first information threshold, determine G p The abnormal information score J of the corresponding link node p =g1×G p ;

[0052] If f(p) is less than the first information threshold and greater than the second information threshold, then determine G p The abnormal information score J of the corresponding link node p =g2×G p ;

[0053] If f(p) is less than or equal to the second information threshold, then determine G p The abnormal information score J of the corresponding link node p =g3×G p ;

[0054] Step S670: According to J m and J p In descending order, for G m The corresponding link nodes and G p The corresponding link nodes are sorted accordingly to obtain a sorted node list.

[0055] According to one aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored. The at least one instruction or the at least one program is loaded and executed by a processor to implement the aforementioned fault root cause node determination method.

[0056] According to one aspect of the present application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0057] The present invention has at least the following beneficial effects:

[0058] The present invention provides a method for determining a fault root cause node. The method determines a target abnormal object for which an abnormal alarm occurs based on an entity object corresponding to received abnormal alarm information. The method then obtains historical abnormal objects whose operating status is abnormal at the time the abnormal alarm information is received from all entity objects in the cluster. The method determines a call relationship between the target abnormal object and the historical abnormal objects in a call deployment graph. An abnormal propagation link is constructed based on the call relationship between the target abnormal object and the historical abnormal objects. The method determines a root cause score corresponding to each link node in the abnormal propagation link based on the depth and in-degree of each link node in the abnormal propagation link. The method sorts a plurality of link nodes in descending order of the root cause scores to obtain a sorted node list. The method finally determines the first plurality of link nodes in the sorted node list as the fault root cause nodes. The method analyzes the call relationship between the target abnormal object for which an abnormal alarm occurs and the historical abnormal objects that have not recovered to a normal state to determine the abnormal propagation link of the call relationship. The method then calculates a root cause score based on each link node in the abnormal propagation link to determine a fault root cause node with a relatively high root cause score. This ensures that the root cause obtained by tracing the fault root cause node is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0060] Figure 1 This is a flowchart of a method for determining a fault root cause node provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0062] This application proposes a method for determining the root cause node of a fault, such as Figure 1 As shown, the following steps are included:

[0063] Step S100: In response to receiving abnormality warning information, determining a target abnormal object according to the entity object corresponding to the abnormality warning information;

[0064] Exception alarm information is the alarm information generated by an entity object when an exception occurs (including call exceptions and service exceptions, etc.). The entity object corresponding to the exception alarm information is the entity object that generates and sends the exception alarm information (including services, databases, hosts, and other components (such as Kafka / agents, etc.)).

[0065] Furthermore, step S100 includes steps S110 to S130:

[0066] Step S110: If the abnormal alarm information indicates that the call of the entity object generates an abnormal alarm, then execute step S120;

[0067] If the abnormal alarm information indicates that the entity object itself has generated an abnormal alarm, the entity object is determined as the initial entity object, and step S130 is executed;

[0068] Step S120: If the ratio of the number of abnormal calls of the called entity object to the total number of calls of the called entity object is greater than a preset abnormal call ratio, the called entity object is determined as the initial entity object, and step S130 is executed;

[0069] Step S130: If the initial entity object is a service and / or component, the service and / or component is determined as a target abnormal object;

[0070] If the entity object is a service or component, when the service or component itself generates an alarm, the service or component is the initial entity object.

[0071] If the initial entity object is a deployment instance, the services and / or components deployed on the deployment instance are determined as target exception objects.

[0072] Step S200: Obtain historical abnormal objects whose operating status is abnormal at the time of receiving abnormal alarm information from all entity objects;

[0073] Each entity object corresponds to a cluster node. For example, if the entity object is a service, the service is the cluster node. If the entity object is a deployment instance, the deployment instance is the cluster node.

[0074] A historical abnormal object is an entity object that has an abnormality in a historical period and is still in an abnormal state (has not yet recovered to a normal state) at the time of receiving the abnormal alarm information.

[0075] Step S300: Determine the call relationship between the target exception object and the historical exception object in a preset call deployment graph; the call deployment graph includes the call relationship between several entity objects;

[0076] The deployment graph is called through steps S301 and S302 to obtain:

[0077] Step S301: Obtain the object identifier of the calling object and the object identifier of the called object corresponding to each entity object;

[0078] The calling object corresponding to the entity object is the entity object having a calling relationship with the entity object, and the called object corresponding to the entity object is the entity object having a called relationship with the entity object.

[0079] Step S302: Based on the calling relationship between each entity object and the calling object corresponding to the entity object, and the calling relationship between each entity object and the called object corresponding to the entity object, the object identifiers corresponding to each entity object are sequentially connected to obtain a call deployment graph;

[0080] If there is a calling relationship between two entity objects, then in the calling deployment graph, the object identifier of the calling entity object points to the object identifier of the called entity object.

[0081] Further, step S300 includes steps S310 to S330:

[0082] Step S310: Determine the target abnormal object and the historical abnormal objects as abnormal entity objects;

[0083] Step S320: Obtain the object identifier of each abnormal entity object to obtain an abnormal entity object identifier list A=(A1, A2, ..., A i ,...,A j ); where i = 1, 2, ..., j; j is the number of abnormal entity objects; A i is the object identifier of the i-th abnormal entity object;

[0084] Step S330: Determine A from the call deployment graph. i The corresponding abnormal entity object and A k The calling relationship between the corresponding exception entity objects; where k = 1, 2, ..., j; and k ≠ i.

[0085] Step S400: Construct an exception propagation link based on the call relationship between the target exception object and the historical exception objects;

[0086] Among them, the link node in the abnormal propagation link is the object identifier corresponding to the target abnormal object or the object identifier corresponding to the historical abnormal object.

[0087] Further, step S400 includes steps S410 to S440:

[0088] Step S410: A i The corresponding abnormal entity object and Ak Among the corresponding exception entity objects, the exception entity object belonging to the caller is determined as the calling exception object, and the exception entity object belonging to the callee is determined as the called exception object;

[0089] Step S420: Determine the shortest path in the call deployment graph, starting from the object identifier of the calling exception object and ending at the object identifier of the called exception object, as A. i and A k The calling relationship path between them;

[0090] Step S430: Integrate and remove duplicates from multiple call relationship paths to obtain an initial propagation link;

[0091] Step S440: Prune the initial propagation link according to the number of abnormal nodes and normal nodes in the initial propagation link to obtain an abnormal propagation link.

[0092] Wherein, step S440 includes steps S441 to S443:

[0093] Step S441: Determine the object identifier of the abnormal entity object in the initial propagation link as an abnormal node, and determine the object identifier of the non-abnormal entity object in the initial propagation link as a normal node;

[0094] Step S442: In the initial propagation link, if the number of normal nodes between two adjacent abnormal nodes is greater than a preset interval number, the call relationship path between the two abnormal nodes is deleted from the initial propagation link;

[0095] Step S443: If the link node with an out-degree of zero in the initial propagation link is a normal node, the call relationship path between the normal node and the abnormal node closest to the normal node, as well as the normal node, are deleted from the initial propagation link to obtain an abnormal propagation link.

[0096] Step S440 is a method for pruning the initial propagation link so that the link nodes of the determined abnormal propagation link can more clearly and intuitively display the call propagation relationship.

[0097] Step S500: Determine the root cause score corresponding to each link node in the abnormal propagation link according to the depth and in-degree of each link node in the abnormal propagation link;

[0098] Furthermore, step S500 includes steps S510 to S550:

[0099] Step S510: Obtain the depth of each link node in the abnormal propagation link to obtain a node depth list B = (B1, B2, ..., B m,...,B q ); where m = 1, 2, ..., q; q is the number of link nodes in the abnormal propagation link; B m is the depth of the mth link node in the abnormal propagation link;

[0100] Step S520: Obtain the in-degree of each link node in the abnormal propagation link to obtain a node in-degree list C = (C1, C2, ..., C m ,...,C q ); among them, C m is the in-degree of the m-th link node in the abnormal propagation link;

[0101] Step S530: Determine the transitivity score corresponding to each link node in the abnormal propagation link according to the node depth list B to obtain a transitivity score list D = (D1, D2, ..., D m ,...,D q ); where D m =B m / B0;D m is the transitivity score corresponding to the mth link node in the abnormal propagation link; B0=MAX(B); MAX() is a preset maximum value determination function;

[0102] Step S540: Determine the service call score corresponding to each link node in the abnormal propagation link according to the node in-degree list C, so as to obtain a service call score list E=(E1, E2, ..., E m ,...,E q ); where E m =C m / C0;E m is the service call score corresponding to the mth link node in the abnormal propagation link; C0 = MAX(C);

[0103] Step S550: Determine the root cause score corresponding to each link node in the abnormal propagation link according to the transitivity score list D and the service call score list E, so as to obtain a root cause score list F = (F1, F2, ..., F m ,...,F q ); where F m =a×D m +b×E m ; F m is the root cause score corresponding to the mth link node in the abnormal propagation link; a is the preset transitivity score coefficient; b is the preset service call score coefficient; a+b=1.

[0104] Step S600: sorting a number of link nodes according to descending order of root cause scores to obtain a sorted node list;

[0105] Furthermore, step S600 includes steps S610 to S670:

[0106] Step S610: sort the root cause scores in the root cause score list F from large to small to obtain a sorted root cause score list G = (G1, G2, ..., G m ,...,G q ); where G m is the mth root cause score obtained after sorting in descending order of values;

[0107] Step S620, traverse the sorted root cause score list G, if G m =G p , then execute steps S630 to S670; wherein p = 1, 2, ..., q; and p ≠ m;

[0108] If each root cause score in the sorted root cause score list G is different, then several link nodes are sorted accordingly according to the ranks of the root cause scores in the sorted root cause score list G to obtain a sorted node list.

[0109] Step S630: Get G m The number of abnormal information generated by the corresponding link node within the target time period d(m); where the end time of the target time period is the time when the abnormal alarm information is received, and the length of the target time period is the preset time length;

[0110] Step S640: If d(m) is greater than or equal to the preset first information threshold, determine G m The abnormal information score J of the corresponding link node m =g1×G m ;

[0111] If d(m) is less than the preset first information threshold and greater than the preset second information threshold, then determine G m The abnormal information score J of the corresponding link node m =g2×G m ;

[0112] If d(m) is less than or equal to the preset second information threshold, then determine G m The abnormal information score J of the corresponding link node m =g3×G m ;

[0113] Among them, the first information volume threshold is greater than the second information volume threshold; g1 is the preset first abnormality alarm coefficient; g2 is the preset second abnormality alarm coefficient; g3 is the preset third abnormality alarm coefficient; g1>g2>g3;

[0114] Step S650: Get G p The number of abnormal information generated by the corresponding link node in the target time period f(p);

[0115] Step S660: If f(p) is greater than or equal to the first information threshold, determine G p The abnormal information score J of the corresponding link node p =g1×G p ;

[0116] If f(p) is less than the first information threshold and greater than the second information threshold, then determine G p The abnormal information score J of the corresponding link node p =g2×G p ;

[0117] If f(p) is less than or equal to the second information threshold, then determine G p The abnormal information score J of the corresponding link node p =g3×G p ;

[0118] Step S670: According to J m and J p In descending order, for G m The corresponding link nodes and G p The corresponding link nodes are sorted accordingly to obtain a sorted node list.

[0119] Step S700: Determine the first n link nodes in the sorted node list as fault root cause nodes; wherein n is a preset node quantity threshold.

[0120] On the other hand, after the fault root cause node is determined, a method for obtaining the fault root cause by performing root cause analysis on the fault root cause node is implemented by steps S810 to S850:

[0121] Step S810: Determine the root cause check item corresponding to the fault root cause node from the fault location map according to the node type of the fault root cause node;

[0122] Node types include services and components. Root cause check items can be indicators corresponding to CPU, memory, and disk, that is, specific root cause troubleshooting items.

[0123] The fault location map includes the association between several node types and root cause inspection items. The fault location map is determined through steps S8101 to S8104:

[0124] Step S8101: Obtain the node type corresponding to each fault root cause node and the root cause detection item for determining the fault root cause within a historical period;

[0125] The end time of the historical period is the current time, and the length of the historical period is the preset time length.

[0126] Step S8102: Determine the inspection item type corresponding to each root cause detection item as a root cause checkpoint;

[0127] Step S8103: De-duplicate multiple root cause detection items, and establish an association between the root cause detection item and the root cause checkpoint corresponding to the root cause detection item;

[0128] Step S8104: Establish an association relationship between each root cause checkpoint and the node type of the fault root cause node corresponding to the root cause checkpoint to obtain a fault location map.

[0129] Further, step S810 includes steps S811 to S813:

[0130] Step S811: Obtain the node type corresponding to the fault root cause node;

[0131] Step S812: Obtain the check item list set I1, I2, ..., I corresponding to each node type identifier in the fault location map. c ,...,I e ; Where c = 1, 2, ..., e; e is the number of node type identifiers in the fault location map; I c Identify the check item list set corresponding to the c-th node type in the fault location map;

[0132] I c =(I c1 ,I c2 ,...,I ch ,...,I cr(c) ); where h = 1, 2, ..., r(c); r(c) is the number of root cause checkpoints corresponding to the c-th node type identifier in the fault location map; I ch Identify the hth root cause checkpoint corresponding to the cth node type in the fault location map; the root cause checkpoint is characterized by the check item type corresponding to the node type of the fault root cause node;

[0133] I ch =(I ch1 ,I ch2 ,...,Ichs ,...,I cht(ch) ); where s = 1, 2, ..., t(ch); t(ch) is the number of root cause check items corresponding to the root cause check point of the c-th node type identifier in the fault location map; I chs Identify the sth root cause check item of the hth root cause check point corresponding to the cth node type in the fault location map; the root cause check item represents the check information of the root cause of the fault root cause node;

[0134] Step S813, traverse each node type identifier in the fault location map, if I c If the corresponding node type is the same as the node type corresponding to the fault root cause node, then I ch1 ,I ch2 ,...,I chs ,...,I cht(ch) Determine the root cause check item corresponding to the fault root cause node.

[0135] Step S820: Determine an initial root cause detection period corresponding to the root cause node according to the abnormality occurrence time of the root cause node and the root cause detection time of the root cause node;

[0136] The abnormality occurrence time is the time when the fault abnormality of the fault root cause node occurs, and the root cause detection time is the time when the fault root cause node triggers the root cause detection.

[0137] Further, step S820 includes steps S821 and S822:

[0138] Step S821: Obtain the time K1 when the fault root cause node last experienced a fault anomaly and the time K2 when the fault root cause node last triggered root cause detection;

[0139] Step S822: Determine the period between K1 and K2 as the initial root cause detection period.

[0140] Step S8201: If the number of root cause check items corresponding to the fault root cause node is greater than a preset check item number threshold, then execute steps S8202 to S8205; otherwise, execute step S830;

[0141] Step S8202: shortening the initial root cause detection period according to a preset shortened period length to obtain a shortened root cause detection period;

[0142] Wherein, step S8202 includes step S82021:

[0143] Step S82021, K1 to K2-K 02 The period between is determined as the shortened root cause detection period; among them, K02 Shorten the length of the preset time period; K 02 <K 01 .

[0144] If the number of root cause check items corresponding to the fault root cause node is greater than the check item number threshold, it means that the number of check items that need to be root cause investigated is too large, and it is considered that the determined target root cause check items include interference items. Therefore, in order to reduce the amount of data processing, it is necessary to appropriately reduce the number of check items and shorten the length of the detection period to the time when the last fault anomaly occurred. The subsequent abnormal data can be considered as an extension of the abnormal data generated when the fault anomaly occurred.

[0145] Step S8203: Obtain the detection function corresponding to each root cause check item of the fault root cause node;

[0146] Step S8204: Obtain several operating parameters of each root cause inspection item of the fault root cause node within the shortened root cause detection period;

[0147] Step S8205: According to the detection function corresponding to each root cause check item, several operating parameters of the root cause check item within the shortened root cause detection period are processed to obtain the fault root cause of the fault root cause node within the shortened root cause detection period.

[0148] Step S830: Determine the root cause of the fault of the root cause node within the initial root cause detection period based on a number of operating parameters of each root cause check item of the root cause node within the initial root cause detection period;

[0149] Further, step S830 includes steps S831 to S833:

[0150] Step S831: Obtain the detection function corresponding to each root cause check item of the fault root cause node;

[0151] Step S832: Obtain several operating parameters of each root cause check item of the fault root cause node within the initial root cause detection period;

[0152] Step S833: According to the detection function corresponding to each root cause check item, several operating parameters of the root cause check item are processed to obtain the root cause of the fault root cause node within the initial root cause detection period.

[0153] Step S840: If the number of fault root causes of the fault root cause node within the initial root cause detection period is less than a preset threshold number of fault root causes, the initial root cause detection period is extended according to a preset period extension length to obtain an extended root cause detection period.

[0154] Further, step S840 includes step S841:

[0155] Step S841: If the number of root causes of the fault root cause node determined during the initial root cause detection period is less than the preset threshold value of the number of root causes of the fault root cause, then K1-K 01 The period between K1 and K2 is determined as the extended root cause detection period;

[0156] Among them, K 01 Extends the length of a preset time period.

[0157] If the number of root causes determined for a fault root cause node within the initial root cause detection period is less than a preset threshold for the number of root causes, it is considered that the number of root causes determined is insufficient to detect the root cause. Therefore, the detection period needs to be extended to obtain sufficient data to detect the root cause of the fault root cause node.

[0158] Step S850: Determine the root cause of the fault of the root cause node within the extended root cause detection period according to a number of operating parameters of each root cause check item of the root cause node within the extended root cause detection period.

[0159] The present invention provides a method for determining a fault root cause node. The method determines a target abnormal object for which an abnormal alarm occurs based on an entity object corresponding to received abnormal alarm information. The method then obtains historical abnormal objects whose operating status is abnormal at the time the abnormal alarm information is received from all entity objects in the cluster. The method determines a call relationship between the target abnormal object and the historical abnormal objects in a call deployment graph. An abnormal propagation link is constructed based on the call relationship between the target abnormal object and the historical abnormal objects. The method determines a root cause score corresponding to each link node in the abnormal propagation link based on the depth and in-degree of each link node in the abnormal propagation link. The method sorts a plurality of link nodes in descending order of the root cause scores to obtain a sorted node list. The method finally determines the first plurality of link nodes in the sorted node list as the fault root cause nodes. The method analyzes the call relationship between the target abnormal object for which an abnormal alarm occurs and the historical abnormal objects that have not recovered to a normal state to determine the abnormal propagation link of the call relationship. The method then calculates a root cause score based on each link node in the abnormal propagation link to determine a fault root cause node with a relatively high root cause score. This ensures that the root cause obtained by tracing the fault root cause node is more accurate.

[0160] An embodiment of the present invention further provides a computer program product comprising program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present invention described above in this specification.

[0161] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0162] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0163] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0164] Those skilled in the art will appreciate that various aspects of the present invention may be implemented as systems, methods, or program products. Therefore, various aspects of the present invention may be implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits," "modules," or "systems."

[0165] The electronic device according to this embodiment of the present invention is merely an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0166] The electronic device is implemented as a general-purpose computing device. Components of the electronic device may include, but are not limited to, the aforementioned at least one processor, the aforementioned at least one storage, and a bus connecting different system components (including the storage and the processor).

[0167] The storage stores program codes, which can be executed by the processor, so that the processor performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification.

[0168] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0169] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0170] The bus may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0171] The electronic device may also communicate with one or more external devices (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication may be performed via an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter.

[0172] In exemplary embodiments of the present disclosure, a computer-readable storage medium is also provided, on which is stored a program product capable of implementing the aforementioned methods of this specification. In some possible implementations, various aspects of the present invention may also be implemented in the form of a program product comprising program code. When the program product is executed on a terminal device, the program code is configured to cause the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the "Exemplary Methods" section of this specification.

[0173] The program product may be implemented in any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0174] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0175] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0176] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0177] Furthermore, the above-described figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention and are not intended to be limiting. It is readily understood that the processes illustrated in the above-described figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0178] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0179] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for determining a fault root cause node, characterized in that: The steps include: Step S100: In response to receiving abnormality warning information, determining a target abnormal object according to the entity object corresponding to the abnormality warning information; Step S200: Obtain historical abnormal objects of all entity objects whose operating status is abnormal at the time of receiving the abnormal alarm information; Step S300: Determine the call relationship between the target exception object and the historical exception object in a preset call deployment graph; the call deployment graph includes call relationships between multiple entity objects; Step S400: construct an exception propagation link based on the call relationship between the target exception object and the historical exception object; the link node in the exception propagation link is the object identifier corresponding to the target exception object or the object identifier corresponding to the historical exception object; Step S500: Determine a root cause score corresponding to each link node in the abnormal propagation link according to the depth and in-degree of each link node in the abnormal propagation link; Step S600: sorting a number of link nodes according to descending order of root cause scores to obtain a sorted node list; Step S700: Determine the first n link nodes in the sorted node list as fault root cause nodes; wherein n is a preset node quantity threshold.

2. The method according to claim 1, characterized in that The step S100 includes: Step S110: If the abnormal alarm information indicates that the call of the entity object generates an abnormal alarm, then execute step S120; If the abnormal alarm information indicates that the entity object itself has generated an abnormal alarm, the entity object is determined as the initial entity object, and step S130 is executed; Step S120: If the ratio of the number of abnormal calls of the called entity object to the total number of calls of the called entity object is greater than a preset abnormal call ratio, the called entity object is determined as the initial entity object, and step S130 is executed; Step S130: If the initial entity object is a service and / or component, the service and / or component is determined as a target abnormal object; If the initial entity object is a deployment instance, the service and / or component deployed on the deployment instance is determined as a target exception object.

3. The method according to claim 2, characterized in that The call deployment graph is obtained by the following steps: Step S301: Obtain the object identifier of the calling object and the object identifier of the called object corresponding to each entity object; the calling object corresponding to the entity object is the entity object having a calling relationship with the entity object; the called object corresponding to the entity object is the entity object having a called relationship with the entity object; Step S302: according to the calling relationship between each entity object and the calling object corresponding to the entity object, and the calling relationship between each entity object and the called object corresponding to the entity object, the object identifiers corresponding to each entity object are sequentially connected to obtain a calling deployment graph; Wherein, if there is a calling relationship between the two entity objects, then in the calling deployment graph, the object identifier of the calling entity object points to the object identifier of the called entity object.

4. The method according to claim 3, characterized in that The step S300 includes: Step S310: Determine the target abnormal object and the historical abnormal object as abnormal entity objects; Step S320: Obtain the object identifier of each abnormal entity object to obtain an abnormal entity object identifier list A=(A1, A2, ..., A i ,...,A j ); where i = 1, 2, ..., j; j is the number of abnormal entity objects; A i is the object identifier of the i-th abnormal entity object; Step S330: Determine A from the call deployment graph. i The corresponding abnormal entity object and A k The calling relationship between the corresponding exception entity objects; where k = 1, 2, ..., j; and k ≠ i.

5. The method according to claim 4, characterized in that The step S400 includes: Step S410: A i The corresponding abnormal entity object and A k Among the corresponding exception entity objects, the exception entity object belonging to the caller is determined as the calling exception object, and the exception entity object belonging to the callee is determined as the called exception object; Step S420: The shortest path in the call deployment graph, starting from the object identifier of the call exception object and ending at the object identifier of the called exception object, is determined as A. i and A k The calling relationship path between them; Step S430: Integrate and remove duplicates from multiple call relationship paths to obtain an initial propagation link; Step S440: Prune the initial propagation link according to the number of abnormal nodes and normal nodes in the initial propagation link to obtain an abnormal propagation link.

6. The method according to claim 5, characterized in that The step S440 includes: Step S441: Determine the object identifier of the abnormal entity object in the initial propagation link as an abnormal node, and determine the object identifier of the non-abnormal entity object in the initial propagation link as a normal node; Step S442: In the initial propagation link, if the number of normal nodes between two adjacent abnormal nodes is greater than a preset interval number, the call relationship path between the two abnormal nodes is deleted from the initial propagation link; Step S443: If the link node with an out-degree of zero in the initial propagation link is a normal node, the call relationship path between the normal node and the abnormal node closest to the normal node, and the normal node are deleted from the initial propagation link to obtain an abnormal propagation link.

7. The method according to claim 6, characterized in that The step S500 includes: Step S510: Obtain the depth of each link node in the abnormal propagation link to obtain a node depth list B = (B1, B2, ..., B m ,...,B q ); wherein, m=1,2,...,q; q is the number of link nodes in the abnormal propagation link; B m is the depth of the mth link node in the abnormal propagation link in the abnormal propagation link; Step S520: Obtain the in-degree of each link node in the abnormal propagation link to obtain a node in-degree list C = (C1, C2, ..., C m ,...,C q ); among them, C m is the in-degree of the mth link node in the abnormal propagation link; Step S530: Determine the transitivity score corresponding to each link node in the abnormal propagation link according to the node depth list B, so as to obtain a transitivity score list D=(D1, D2, ..., D m ,...,D q ); where D m =B m / B0;D m is the transitivity score corresponding to the mth link node in the abnormal propagation link; B0=MAX(B); MAX() is a preset maximum value determination function; Step S540: Determine the service call score corresponding to each link node in the abnormal propagation link according to the node in-degree list C, so as to obtain a service call score list E=(E1, E2, ..., E m ,...,E q ); where E m =C m / C0;E m is the service call score corresponding to the mth link node in the abnormal propagation link; C0=MAX(C); Step S550: Determine the root cause score corresponding to each link node in the abnormal propagation link according to the transitivity score list D and the service call score list E, so as to obtain a root cause score list F = (F1, F2, ..., F m ,...,F q ); where F m =a×D m +b×E m ; F m is the root cause score corresponding to the mth link node in the abnormal propagation link; a is the preset transitivity score coefficient; b is the preset service call score coefficient; a+b=1.

8. The method according to claim 7, characterized in that The step S600 includes: Step S610: sort each root cause score in the root cause score list F from large to small to obtain a sorted root cause score list G = (G1, G2, ..., G m ,...,G q ); where G m is the mth root cause score obtained after sorting in descending order of values; Step S620: traverse the sorted root cause score list G. If G m =G p , then execute steps S630 to S670; wherein p = 1, 2, ..., q; and p ≠ m; If each root cause score in the sorted root cause score list G is different, then sorting the plurality of link nodes accordingly according to the ranks of the root cause scores in the sorted root cause score list G to obtain a sorted node list; Step S630: Get G m The number d(m) of abnormal information generated by the corresponding link node within the target time period; wherein the end time of the target time period is the time when the abnormal alarm information is received, and the length of the target time period is a preset time length; Step S640: If d(m) is greater than or equal to the preset first information threshold, determine G m The abnormal information score J of the corresponding link node m =g1×G m ; If d(m) is less than the preset first information threshold and greater than the preset second information threshold, then determine G m The abnormal information score J of the corresponding link node m =g2×G m ; If d(m) is less than or equal to the preset second information threshold, then determine G m The abnormal information score J of the corresponding link node m =g3×G m ; Wherein, the first information volume threshold is greater than the second information volume threshold; g1 is a preset first abnormality alarm coefficient; g2 is a preset second abnormality alarm coefficient; g3 is a preset third abnormality alarm coefficient; g1>g2>g3; Step S650: Get G p The number of abnormal information generated by the corresponding link node in the target time period f(p); Step S660: If f(p) is greater than or equal to the first information threshold, determine G p The abnormal information score J of the corresponding link node p =g1×G p ; If f(p) is less than the first information threshold and greater than the second information threshold, then determine G p The abnormal information score J of the corresponding link node p =g2×G p ; If f(p) is less than or equal to the second information threshold, then determine G p The abnormal information score J of the corresponding link node p =g3×G p ; Step S670: According to J m and J p In descending order, for G m The corresponding link nodes and G p The corresponding link nodes are sorted accordingly to obtain a sorted node list.

9. A non-transitory computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1 to 8.

10. An electronic device, characterized in that: The device comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 9.

Images