Fault root cause positioning method, electronic equipment and storage medium
By receiving abnormal alarm information, using the call deployment map and fault location map to analyze the equipment cluster, the initial fault root cause node and root cause inspection items are determined, and the root cause of the equipment cluster failure is accurately located. This solves the problem of inaccurate root cause location in the existing technology and improves the effectiveness of troubleshooting.
Patent Information
- Application Number
- CN202510973075.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-15
- Publication Date
- 2025-09-16
AI Technical Summary
When tracing the source of faults in existing equipment clusters, it is impossible to accurately locate the underlying root cause of abnormal faults, resulting in incomplete troubleshooting and increasing the possibility of recurrence of faults.
By receiving abnormal alarm information, the initial fault root cause node is determined. By calling the deployment map and fault location map, the node type and root cause inspection items are analyzed, the target node and the root cause of the fault are determined, and the root cause detection is performed in combination with the operating parameters to achieve accurate root cause location.
The accuracy of fault root cause location is improved, and the deep root cause of abnormal alarms can be found more comprehensively, reducing the possibility of repeated faults.
Smart Images
Figure CN120658563A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of anomaly detection, and in particular to a fault root cause locating method, electronic equipment and storage medium. Background Art
[0002] The current method for determining the root cause of a device cluster is to trace the source of a node in the cluster to find the root cause of the abnormal failure when an abnormal failure occurs. However, in actual applications, the root cause positioning accuracy of this simple tracing method is low. Since only the node with the abnormal failure is traced, the relationship between multiple nodes is ignored, and the underlying root cause of the abnormal failure cannot be accurately located. This will lead to incomplete troubleshooting of the abnormal failure and increase the possibility of the corresponding failure problem occurring again. Summary of the Invention
[0003] In view of the above technical problems, the technical solution adopted by the present invention is:
[0004] According to one aspect of the present application, a method for locating a root cause of a fault is provided, comprising the following steps:
[0005] Step S100: In response to receiving abnormal alarm information, determining an initial fault root cause node from a plurality of cluster nodes according to an entity object corresponding to the abnormal alarm information;
[0006] Step S200: Determine the root cause check item corresponding to the initial fault root cause node according to the node type corresponding to the initial fault root cause node;
[0007] Step S300: traverse the node type corresponding to each cluster node. If the root cause check item corresponding to the initial fault root cause node meets the preset mapping relationship with the node type corresponding to any cluster node, determine the node type corresponding to the cluster node as the target node type.
[0008] Step S400: Determine the root cause of the fault of each target cluster node within the root cause detection period based on each target root cause check item of each target cluster node and several operating parameters within the root cause detection period corresponding to the initial fault root cause node; wherein, the target cluster node is the cluster node corresponding to the target node type; the target root cause check item is the root cause check item corresponding to the target node type; the start time of the root cause detection period is the time when the most recent fault anomaly of the initial fault root cause node occurs from the current time; the end time of the root cause detection period is the time when the abnormality alarm information is received.
[0009] In an exemplary embodiment of the present application, step S100 includes:
[0010] Step S110: In response to receiving the abnormality warning information, determining a target abnormal object according to the entity object corresponding to the abnormality warning information;
[0011] Step S120: Obtain historical abnormal objects whose operating status is abnormal at the time of receiving abnormal alarm information from entity objects corresponding to several cluster nodes;
[0012] Step S130: Determine the target abnormal object and the historical abnormal objects as abnormal entity objects;
[0013] Step S140: Obtain the object identifier of each abnormal entity object to obtain an abnormal entity object identifier list A=(A1, A2, ..., A i ,...,A j ); where i = 1, 2, ..., j; j is the number of abnormal entity objects; A i is the object identifier of the i-th abnormal entity object;
[0014] Step S150: Determine A from the preset call deployment map. i The corresponding abnormal entity object and A k The call relationship between the corresponding abnormal entity objects; where k = 1, 2, ..., j; and k ≠ i; the call deployment graph includes the call relationship between several entity objects;
[0015] Step S160: A i The corresponding abnormal entity object and A k Among the corresponding exception entity objects, the exception entity object belonging to the caller is determined as the calling exception object, and the exception entity object belonging to the callee is determined as the called exception object;
[0016] Step S170: Determine the shortest path in the call deployment graph, starting from the object identifier of the calling exception object and ending at the object identifier of the called exception object, as A. i and A k The calling relationship path between them;
[0017] Step S180: Integrate and remove duplicates from the multiple call relationship paths to obtain an exception propagation link; the link nodes in the exception propagation link are object identifiers corresponding to the target exception object or object identifiers corresponding to the historical exception object;
[0018] Step S190: Determine an initial fault root cause node from a number of cluster nodes according to the depth and in-degree of each link node in the abnormal propagation link.
[0019] In an exemplary embodiment of the present application, step S110 includes:
[0020] Step S111: If the abnormal alarm information indicates that the call of the entity object generates an abnormal alarm, then execute step S112;
[0021] If the abnormal alarm information indicates that the entity object itself has generated an abnormal alarm, the entity object is determined as the initial entity object, and step S113 is executed;
[0022] Step S112: If the ratio of the number of abnormal calls of the called entity object to the total number of calls of the called entity object is greater than a preset abnormal call ratio, the called entity object is determined as the initial entity object, and step S113 is executed;
[0023] Step S113: If the initial entity object is a service and / or component, the service and / or component is determined as a target abnormal object;
[0024] If the initial entity object is a deployment instance, the services and / or components deployed on the deployment instance are determined as target exception objects.
[0025] In an exemplary embodiment of the present application, step S190 includes:
[0026] Step S191: Obtain the depth of each link node in the abnormal propagation link to obtain a node depth list B = (B1, B2, ..., B m ,...,B q ); where m = 1, 2, ..., q; q is the number of link nodes in the abnormal propagation link; B m is the depth of the mth link node in the abnormal propagation link;
[0027] Step S192: Obtain the in-degree of each link node in the abnormal propagation link to obtain a node in-degree list C = (C1, C2, ..., C m ,...,C q ); among them, C m is the in-degree of the m-th link node in the abnormal propagation link;
[0028] Step S193: Determine the transitivity score corresponding to each link node in the abnormal propagation link according to the node depth list B to obtain a transitivity score list D = (D1, D2, ..., D m ,...,D q ); where D m =B m / B0;D mis the transitivity score corresponding to the mth link node in the abnormal propagation link; B0=MAX(B); MAX() is a preset maximum value determination function;
[0029] Step S194: Determine the service call score corresponding to each link node in the abnormal propagation link according to the node in-degree list C, so as to obtain a service call score list E = (E1, E2, ..., E m ,...,E q ); where E m =C m / C0;E m is the service call score corresponding to the mth link node in the abnormal propagation link; C0 = MAX(C);
[0030] Step S195: Determine the root cause score corresponding to each link node in the abnormal propagation link according to the transitivity score list D and the service call score list E, so as to obtain the root cause score list F = (F1, F2, ..., F m ,...,F q ); where F m =a×D m +b×E m ; F m is the root cause score corresponding to the mth link node in the abnormal propagation link; a is the preset transitivity score coefficient; b is the preset service call score coefficient; a+b=1;
[0031] Step S196: Sort each root cause score in the root cause score list F from large to small to obtain a sorted root cause score list G = (G1, G2, ..., G m ,...,G q ); where G m is the mth root cause score obtained after sorting in descending order of values;
[0032] Step S197: Sort the cluster nodes corresponding to the plurality of link nodes according to the ranks of the root cause scores in the sorted root cause score list G to obtain a sorted node list;
[0033] Step S198: Determine the first n cluster nodes in the sorted node list as the initial fault root cause nodes; wherein n is a preset node number threshold.
[0034] In an exemplary embodiment of the present application, step S200 includes:
[0035] Step S210: Obtain the node type corresponding to the initial fault root cause node;
[0036] Step S220: Obtain the check item list set I1, I2, ..., I corresponding to each node type identifier in the preset fault location map. c ,...,I e ; Where c = 1, 2, ..., e; e is the number of node type identifiers in the fault location map; I c Identify the corresponding check item list set for the cth node type in the fault location map; the fault location map includes the association relationship between several node types and root cause check items;
[0037] I c =(I c1 ,I c2 ,...,I ch ,...,I cr(c) ); where h = 1, 2, ..., r(c); r(c) is the number of root cause checkpoints corresponding to the c-th node type identifier in the fault location map; I ch Identify the hth root cause checkpoint corresponding to the cth node type in the fault location map; the root cause checkpoint is characterized by the check item type corresponding to the node type of the cluster node;
[0038] I ch =(I ch1 ,I ch2 ,...,I chs ,...,I cht(ch) ); where s = 1, 2, ..., t(ch); t(ch) is the number of root cause check items corresponding to the root cause check point of the c-th node type identifier in the fault location map; I chs Identify the sth root cause check item of the hth root cause check point corresponding to the cth node type in the fault location map; the root cause check item represents the check information of the root cause of the cluster node failure;
[0039] Step S230: traverse each node type identifier in the fault location map. c If the corresponding node type is the same as the node type corresponding to the initial fault root cause node, then I ch1 ,I ch2 ,...,I chs ,...,I cht(ch) Determine the root cause check item corresponding to the initial fault root cause node.
[0040] In an exemplary embodiment of the present application, step S300 further includes:
[0041] Step S310: If the root cause check item corresponding to the initial fault root cause node does not conform to the preset mapping relationship with the node type corresponding to any cluster node, then the root cause of the initial fault root cause node within the root cause detection period is determined based on each root cause check item corresponding to the initial fault root cause node and several operating parameters within the root cause detection period corresponding to the initial fault root cause node.
[0042] In an exemplary embodiment of the present application, step S400 includes:
[0043] Step S410: Determine target root cause inspection items corresponding to each target node type from the fault location map;
[0044] Step S420: Obtain a detection function corresponding to each target root cause check item of each target cluster node corresponding to each target node type;
[0045] Step S430: Obtain each target root cause check item of each target cluster node and several operating parameters within the root cause detection period corresponding to the initial fault root cause node;
[0046] Step S440: According to the detection function corresponding to each target root cause check item, several operating parameters corresponding to the target root cause check item are processed to obtain the root cause of the fault of each target cluster node within the root cause detection period.
[0047] In an exemplary embodiment of the present application, step S420 further includes:
[0048] Step S421: If the sum of the number of target root cause check items of all target cluster nodes is greater than a preset check item number threshold, then execute step S422; otherwise, execute step S430;
[0049] Step S422: K1 to K2-K 02 The period between is determined as the shortened root cause detection period; K1 is the time when the initial fault root cause node is closest to the current time; K2 is the time when the abnormal alarm information is received; K 02 Shorten the length of the preset time period;
[0050] Step S423: Obtaining several operating parameters of each target root cause inspection item of each target cluster node within a shortened root cause detection period;
[0051] Step S424: According to the detection function corresponding to each target root cause check item, several operating parameters of the target root cause check item within the shortened root cause detection period are processed to obtain the fault root cause of each target cluster node within the shortened root cause detection period.
[0052] According to one aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored. The at least one instruction or the at least one program is loaded and executed by a processor to implement the aforementioned fault root cause locating method.
[0053] According to one aspect of the present application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.
[0054] The present invention has at least the following beneficial effects:
[0055] The fault root cause location method of the present invention determines an initial fault root cause node from a plurality of cluster nodes based on an entity object corresponding to received abnormal alarm information, then determines a root cause check item corresponding to the initial fault root cause node based on a node type corresponding to the initial fault root cause node, traverses the node type corresponding to each cluster node, and if a preset mapping relationship is satisfied between the root cause check item corresponding to the initial fault root cause node and the node type corresponding to any cluster node, determines the node type corresponding to the cluster node as the target node type, and determines the fault root cause of each target cluster node within the root cause detection period based on a plurality of operating parameters within a root cause detection period corresponding to the initial fault root cause node according to each target root cause check item of each target cluster node. By performing root cause check item analysis on the initial fault root cause node, if a mapping relationship still exists between the root cause check item corresponding to the initial fault root cause node and another cluster node, performs root cause analysis on the cluster node, so as to find the cluster node that may be the deep root cause of the abnormal alarm starting from the initial fault root cause node where the abnormal alarm occurs, thereby making the root cause location of the abnormal fault more accurate. BRIEF DESCRIPTION OF THE DRAWINGS
[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0057] Figure 1 This is a flowchart of a fault root cause location method provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0058] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.
[0059] This application proposes a fault root cause location method, such as Figure 1 As shown, the following steps are included:
[0060] Step S100: In response to receiving abnormal alarm information, determining an initial fault root cause node from a plurality of cluster nodes according to an entity object corresponding to the abnormal alarm information;
[0061] Exception alarm information is the alarm information generated by an entity object when an exception occurs (including call exceptions and service exceptions, etc.). The entity object corresponding to the exception alarm information is the entity object that generates and sends the exception alarm information (including services, databases, hosts, and other components (such as Kafka / agents, etc.)).
[0062] Further, step S100 includes steps S110 to S190:
[0063] Step S110: In response to receiving the abnormality warning information, determining a target abnormal object according to the entity object corresponding to the abnormality warning information;
[0064] Wherein, step S110 includes steps S111 to S113:
[0065] Step S111: If the abnormal alarm information indicates that the call of the entity object generates an abnormal alarm, then execute step S112;
[0066] If the abnormal alarm information indicates that the entity object itself has generated an abnormal alarm, the entity object is determined as the initial entity object, and step S113 is executed;
[0067] Step S112: If the ratio of the number of abnormal calls of the called entity object to the total number of calls of the called entity object is greater than a preset abnormal call ratio, the called entity object is determined as the initial entity object, and step S113 is executed;
[0068] Step S113: If the initial entity object is a service and / or component, the service and / or component is determined as a target abnormal object;
[0069] If the entity object is a service or component, when the service or component itself generates an alarm, the service or component is the initial entity object.
[0070] If the initial entity object is a deployment instance, the services and / or components deployed on the deployment instance are determined as target exception objects.
[0071] Step S120: Obtain historical abnormal objects whose operating status is abnormal at the time of receiving abnormal alarm information from entity objects corresponding to several cluster nodes;
[0072] Each entity object corresponds to a cluster node. For example, if the entity object is a service, the service is the cluster node. If the entity object is a deployment instance, the deployment instance is the cluster node.
[0073] A historical abnormal object is an entity object that has experienced an abnormality in a historical period and is still in an abnormal state (has not yet recovered to a normal state) at the time of receiving the abnormal alarm information.
[0074] Step S130: Determine the target abnormal object and the historical abnormal objects as abnormal entity objects;
[0075] Step S140: Obtain the object identifier of each abnormal entity object to obtain an abnormal entity object identifier list A=(A1, A2, ..., A i ,...,A j ); where i = 1, 2, ..., j; j is the number of abnormal entity objects; A i is the object identifier of the i-th abnormal entity object;
[0076] Step S150: Determine A from the preset call deployment map. i The corresponding abnormal entity object and A k The calling relationship between the corresponding exception entity objects; where k = 1, 2, ..., j; and k ≠ i;
[0077] The call deployment graph includes the call relationships between several entity objects.
[0078] Step S160: A i The corresponding abnormal entity object and A k Among the corresponding exception entity objects, the exception entity object belonging to the caller is determined as the calling exception object, and the exception entity object belonging to the callee is determined as the called exception object;
[0079] Step S170: Determine the shortest path in the call deployment graph, starting from the object identifier of the calling exception object and ending at the object identifier of the called exception object, as A. i and A k The calling relationship path between them;
[0080] Step S180: Integrate and remove duplicates from multiple call relationship paths to obtain an exception propagation link;
[0081] The link nodes in the anomaly propagation link are the object identifiers corresponding to the target anomaly objects or the object identifiers corresponding to the historical anomaly objects.
[0082] Step S190: Determine an initial fault root cause node from a number of cluster nodes according to the depth and in-degree of each link node in the abnormal propagation link.
[0083] Wherein, step S190 includes steps S191 to S198:
[0084] Step S191: Obtain the depth of each link node in the abnormal propagation link to obtain a node depth list B = (B1, B2, ..., B m ,...,B q ); where m = 1, 2, ..., q; q is the number of link nodes in the abnormal propagation link; B m is the depth of the mth link node in the abnormal propagation link;
[0085] Step S192: Obtain the in-degree of each link node in the abnormal propagation link to obtain a node in-degree list C = (C1, C2, ..., C m ,...,C q ); among them, C m is the in-degree of the m-th link node in the abnormal propagation link;
[0086] Step S193: Determine the transitivity score corresponding to each link node in the abnormal propagation link according to the node depth list B to obtain a transitivity score list D = (D1, D2, ..., D m ,...,D q );
[0087] Among them, D m =B m / B0;D m is the transitivity score corresponding to the mth link node in the abnormal propagation link; B0=MAX(B); MAX() is a preset maximum value determination function.
[0088] Step S194: Determine the service call score corresponding to each link node in the abnormal propagation link according to the node in-degree list C, so as to obtain a service call score list E = (E1, E2, ..., E m ,...,E q );
[0089] Among them, E m =C m / C0;E m is the service call score corresponding to the mth link node in the abnormal propagation link; C0=MAX(C).
[0090] Step S195: Determine the root cause score corresponding to each link node in the abnormal propagation link according to the transitivity score list D and the service call score list E, so as to obtain the root cause score list F = (F1, F2, ..., F m ,...,F q );
[0091] Among them, F m =a×D m +b×E m ; F m is the root cause score corresponding to the mth link node in the abnormal propagation link; a is the preset transitivity score coefficient; b is the preset service call score coefficient; a+b=1.
[0092] Step S196: Sort each root cause score in the root cause score list F from large to small to obtain a sorted root cause score list G = (G1, G2, ..., G m ,...,G q ); where G m is the mth root cause score obtained after sorting in descending order of values;
[0093] Step S197: Sort the cluster nodes corresponding to the plurality of link nodes according to the ranks of the root cause scores in the sorted root cause score list G to obtain a sorted node list;
[0094] Step S198: Determine the first n cluster nodes in the sorted node list as the initial fault root cause nodes; wherein n is a preset node number threshold.
[0095] Step S200: Determine the root cause check item corresponding to the initial fault root cause node according to the node type corresponding to the initial fault root cause node;
[0096] Root cause check items can be indicators corresponding to CPU, memory, and disk, that is, specific root cause troubleshooting items.
[0097] Further, step S200 includes steps S210 to S230:
[0098] Step S210: Obtain the node type corresponding to the initial fault root cause node;
[0099] Node types include services, components, etc.
[0100] Step S220: Obtain the check item list set I1, I2, ..., I corresponding to each node type identifier in the preset fault location map. c ,...,I e ; Where c = 1, 2, ..., e; e is the number of node type identifiers in the fault location map; Ic Identify the check item list set corresponding to the c-th node type in the fault location map;
[0101] The fault location map includes the association between several node types and root cause inspection items;
[0102] I c =(I c1 ,I c2 ,...,I ch ,...,I cr(c) ); where h = 1, 2, ..., r(c); r(c) is the number of root cause checkpoints corresponding to the c-th node type identifier in the fault location map; I ch Identify the hth root cause checkpoint corresponding to the cth node type in the fault location map; the root cause checkpoint is characterized by the check item type corresponding to the node type of the cluster node;
[0103] I ch =(I ch1 ,I ch2 ,...,I chs ,...,I cht(ch) ); where s = 1, 2, ..., t(ch); t(ch) is the number of root cause check items corresponding to the root cause check point of the c-th node type identifier in the fault location map; I chs Identify the sth root cause check item of the hth root cause check point corresponding to the cth node type in the fault location map; the root cause check item represents the check information of the root cause of the cluster node failure;
[0104] Step S230: traverse each node type identifier in the fault location map. c If the corresponding node type is the same as the node type corresponding to the initial fault root cause node, then I ch1 ,I ch2 ,...,I chs ,...,I cht(ch) Determine the root cause check item corresponding to the initial fault root cause node.
[0105] Step S300: traverse the node type corresponding to each cluster node. If the root cause check item corresponding to the initial fault root cause node meets the preset mapping relationship with the node type corresponding to any cluster node, determine the node type corresponding to the cluster node as the target node type.
[0106] Furthermore, step S300 further includes step S310:
[0107] Step S310: If the root cause check item corresponding to the initial fault root cause node does not conform to the preset mapping relationship with the node type corresponding to any cluster node, then the root cause of the initial fault root cause node within the root cause detection period is determined based on each root cause check item corresponding to the initial fault root cause node and several operating parameters within the root cause detection period corresponding to the initial fault root cause node.
[0108] Step S400: Determine the root cause of the failure of each target cluster node within the root cause detection period based on each target root cause check item of each target cluster node and a number of operating parameters within the root cause detection period corresponding to the initial fault root cause node;
[0109] Among them, the target cluster node is the cluster node corresponding to the target node type; the target root cause check item is the root cause check item corresponding to the target node type; the starting time of the root cause detection period is the time when the fault anomaly closest to the current time occurs at the initial fault root cause node; the end time of the root cause detection period is the time when the abnormal alarm information is received.
[0110] Further, step S400 includes steps S410 to S440:
[0111] Step S410: Determine target root cause inspection items corresponding to each target node type from the fault location map;
[0112] Step S420: Obtain a detection function corresponding to each target root cause check item of each target cluster node corresponding to each target node type;
[0113] Wherein, step S420 further includes steps S421 to S424:
[0114] Step S421: If the sum of the number of target root cause check items of all target cluster nodes is greater than a preset check item number threshold, then execute step S422; otherwise, execute step S430;
[0115] Step S422: K1 to K2-K 02 The period between is determined as the shortened root cause detection period;
[0116] Among them, K1 is the time when the fault abnormality of the initial fault root node closest to the current time occurs; K2 is the time when the abnormal alarm information is received; K 02 Shorten the length of the preset time period.
[0117] If the sum of the number of target root cause check items of all target cluster nodes is greater than the check item number threshold, it means that the number of check items that need to be root-caused is too large, and it is considered that the determined target root cause check items include interference items. Therefore, in order to reduce the amount of data processing, it is necessary to appropriately reduce the number of check items and shorten the length of the detection period to the time when the last fault anomaly occurred. The subsequent abnormal data can be considered as an extension of the abnormal data generated when the fault anomaly occurred.
[0118] Step S423: Obtaining several operating parameters of each target root cause inspection item of each target cluster node within a shortened root cause detection period;
[0119] Step S424: According to the detection function corresponding to each target root cause check item, several operating parameters of the target root cause check item within the shortened root cause detection period are processed to obtain the fault root cause of each target cluster node within the shortened root cause detection period.
[0120] Step S430: Obtain each target root cause check item of each target cluster node and several operating parameters within the root cause detection period corresponding to the initial fault root cause node;
[0121] Step S440: According to the detection function corresponding to each target root cause check item, several operating parameters corresponding to the target root cause check item are processed to obtain the root cause of the fault of each target cluster node within the root cause detection period.
[0122] The fault root cause location method of the present invention determines an initial fault root cause node from a plurality of cluster nodes based on an entity object corresponding to received abnormal alarm information, then determines a root cause check item corresponding to the initial fault root cause node based on a node type corresponding to the initial fault root cause node, traverses the node type corresponding to each cluster node, and if a preset mapping relationship is satisfied between the root cause check item corresponding to the initial fault root cause node and the node type corresponding to any cluster node, determines the node type corresponding to the cluster node as the target node type, and determines the fault root cause of each target cluster node within the root cause detection period based on a plurality of operating parameters within a root cause detection period corresponding to the initial fault root cause node according to each target root cause check item of each target cluster node. By performing root cause check item analysis on the initial fault root cause node, if a mapping relationship still exists between the root cause check item corresponding to the initial fault root cause node and another cluster node, performs root cause analysis on the cluster node, so as to find the cluster node that may be the deep root cause of the abnormal alarm starting from the initial fault root cause node where the abnormal alarm occurs, thereby making the root cause location of the abnormal fault more accurate.
[0123] An embodiment of the present invention further provides a computer program product comprising program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present invention described above in this specification.
[0124] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.
[0125] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.
[0126] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.
[0127] Those skilled in the art will appreciate that various aspects of the present invention may be implemented as systems, methods, or program products. Therefore, various aspects of the present invention may be implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, which may be collectively referred to herein as "circuits," "modules," or "systems."
[0128] The electronic device according to this embodiment of the present invention is merely an example and should not limit the functions and scope of use of the embodiments of the present invention.
[0129] The electronic device is implemented as a general-purpose computing device. Components of the electronic device may include, but are not limited to, the at least one processor, the at least one memory, and a bus connecting different system components (including the memory and the processor).
[0130] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification.
[0131] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).
[0132] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.
[0133] The bus may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.
[0134] The electronic device may also communicate with one or more external devices (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication may be performed via an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter.
[0135] In exemplary embodiments of the present disclosure, a computer-readable storage medium is also provided, on which is stored a program product capable of implementing the aforementioned methods of this specification. In some possible implementations, various aspects of the present invention may also be implemented in the form of a program product comprising program code. When the program product is executed on a terminal device, the program code is configured to cause the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the "Exemplary Methods" section of this specification.
[0136] The program product may be implemented in any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.
[0137] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.
[0138] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
[0139] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, and the like, as well as conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).
[0140] Furthermore, the above-described figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention and are not intended to be limiting. It is readily understood that the processes illustrated in the above-described figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.
[0141] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.
[0142] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.
Claims
1. A method for locating the root cause of a fault, characterized in that: The steps include: Step S100: In response to receiving abnormal alarm information, determining an initial fault root cause node from a plurality of cluster nodes according to an entity object corresponding to the abnormal alarm information; Step S200: Determine a root cause check item corresponding to the initial fault root cause node according to the node type corresponding to the initial fault root cause node; Step S300: traverse the node type corresponding to each cluster node, and if the root cause check item corresponding to the initial fault root cause node meets a preset mapping relationship with the node type corresponding to any cluster node, determine the node type corresponding to the cluster node as the target node type; Step S400: Determine the root cause of the failure of each target cluster node within the root cause detection period based on each target root cause check item of each target cluster node and a number of operating parameters within the root cause detection period corresponding to the initial fault root cause node; wherein the target cluster node is a cluster node corresponding to the target node type; The target root cause check item is the root cause check item corresponding to the target node type; the starting time of the root cause detection period is the time when the fault abnormality of the initial fault root cause node closest to the current time occurs; the end time of the root cause detection period is the time when the abnormal alarm information is received.
2. The method according to claim 1, characterized in that The step S100 includes: Step S110: In response to receiving the abnormality warning information, determining a target abnormal object according to the entity object corresponding to the abnormality warning information; Step S120: acquiring historical abnormal objects whose running status is abnormal at the time of receiving the abnormal alarm information from the entity objects corresponding to the cluster nodes; Step S130: determining the target abnormal object and the historical abnormal objects as abnormal entity objects; Step S140: Obtain the object identifier of each abnormal entity object to obtain an abnormal entity object identifier list A=(A1, A2, ..., A i ,...,A j ); where i = 1, 2, ..., j; j is the number of abnormal entity objects; A i is the object identifier of the i-th abnormal entity object; Step S150: Determine A from the preset call deployment map. i The corresponding abnormal entity object and A k The call relationship between the corresponding abnormal entity objects; wherein k = 1, 2, ..., j; and k ≠ i; the call deployment graph includes the call relationship between several entity objects; Step S160: A i The corresponding abnormal entity object and A k Among the corresponding exception entity objects, the exception entity object belonging to the caller is determined as the calling exception object, and the exception entity object belonging to the callee is determined as the called exception object; Step S170: The shortest path in the call deployment graph, starting from the object identifier of the call exception object and ending at the object identifier of the called exception object, is determined as A. i and A k The calling relationship path between them; Step S180: Integrate and remove duplicates from the multiple call relationship paths to obtain an exception propagation link; the link nodes in the exception propagation link are the object identifiers corresponding to the target exception object or the object identifiers corresponding to the historical exception objects; Step S190: Determine an initial fault root cause node from a number of cluster nodes according to the depth and in-degree of each link node in the abnormal propagation link.
3. The method according to claim 2, characterized in that The step S110 includes: Step S111: If the abnormal alarm information indicates that the call of the entity object generates an abnormal alarm, execute step S112; If the abnormal alarm information indicates that the entity object itself has generated an abnormal alarm, the entity object is determined as the initial entity object, and step S113 is executed; Step S112: If the ratio of the number of abnormal calls of the called entity object to the total number of calls of the called entity object is greater than a preset abnormal call ratio, the called entity object is determined as the initial entity object, and step S113 is executed; Step S113: If the initial entity object is a service and / or component, the service and / or component is determined as a target abnormal object; If the initial entity object is a deployment instance, the service and / or component deployed on the deployment instance is determined as a target exception object.
4. The method according to claim 3, characterized in that The step S190 includes: Step S191: Obtain the depth of each link node in the abnormal propagation link to obtain a node depth list B = (B1, B2, ..., B m ,...,B q ); wherein, m=1,2,...,q; q is the number of link nodes in the abnormal propagation link; B m is the depth of the mth link node in the abnormal propagation link in the abnormal propagation link; Step S192: Obtain the in-degree of each link node in the abnormal propagation link to obtain a node in-degree list C = (C1, C2, ..., C m ,...,C q ); among them, C m is the in-degree of the mth link node in the abnormal propagation link; Step S193: Determine the transitivity score corresponding to each link node in the abnormal propagation link according to the node depth list B, so as to obtain a transitivity score list D=(D1, D2, ..., D m ,...,D q ); where D m =B m / B0;D m is the transitivity score corresponding to the mth link node in the abnormal propagation link; B0=MAX(B); MAX() is a preset maximum value determination function; Step S194: Determine the service call score corresponding to each link node in the abnormal propagation link according to the node in-degree list C, so as to obtain a service call score list E=(E1, E2, ..., E m ,...,E q ); where E m =C m / C0;E m is the service call score corresponding to the mth link node in the abnormal propagation link; C0=MAX(C); Step S195: Determine the root cause score corresponding to each link node in the abnormal propagation link according to the transitivity score list D and the service call score list E, so as to obtain a root cause score list F = (F1, F2, ..., F m ,...,F q ); where F m =a×D m +b×E m ; F m is the root cause score corresponding to the mth link node in the abnormal propagation link; a is the preset transitivity score coefficient; b is the preset service call score coefficient; a+b=1; Step S196: Sort each root cause score in the root cause score list F from large to small to obtain a sorted root cause score list G = (G1, G2, ..., G m ,...,G q ); where G m is the mth root cause score obtained after sorting in descending order of values; Step S197: Sort the cluster nodes corresponding to the plurality of link nodes according to the ranks of the root cause scores in the sorted root cause score list G to obtain a sorted node list; Step S198: Determine the first n cluster nodes in the sorted node list as the initial fault root cause nodes; wherein n is a preset node quantity threshold.
5. The method according to claim 4, characterized in that The step S200 includes: Step S210: Obtain the node type corresponding to the initial fault root cause node; Step S220: Obtain the check item list set I1, I2, ..., I corresponding to each node type identifier in the preset fault location map. c ,...,I e ; Wherein, c = 1, 2, ..., e; e is the number of node type identifiers in the fault location map; I c Identify a corresponding check item list set for the cth node type in the fault location map; the fault location map includes associations between several node types and root cause check items; I c =(I c1 ,I c2 ,...,I ch ,...,I cr(c) ); wherein h = 1, 2, ..., r(c); r(c) is the number of root cause checkpoints corresponding to the c-th node type identifier in the fault location map; I ch Identify the hth root cause checkpoint corresponding to the cth node type in the fault location map; the root cause checkpoint is characterized by a check item type corresponding to the node type of the cluster node; I ch =(I ch1 ,I ch2 ,...,I chs ,...,I cht(ch) ); wherein, s = 1, 2, ..., t(ch); t(ch) is the number of root cause check items of the root cause check point corresponding to the c-th node type identifier in the fault location map; I chs Identify the sth root cause check item of the hth root cause check point corresponding to the cth node type in the fault location map; the root cause check item represents the inspection information of the root cause of the failure of the cluster node; Step S230: traverse each node type identifier in the fault location map. c The corresponding node type is the same as the node type corresponding to the initial fault root cause node, then I ch1 ,I ch2 ,...,I chs ,...,I cht(ch) Determine a root cause check item corresponding to the initial fault root cause node.
6. The method according to claim 5, characterized in that The step S300 further includes: Step S310: If the root cause check item corresponding to the initial fault root cause node and the node type corresponding to any of the cluster nodes do not conform to the preset mapping relationship, then based on each root cause check item corresponding to the initial fault root cause node and several operating parameters within the root cause detection period corresponding to the initial fault root cause node, determine the root cause of the failure of the initial fault root cause node within the root cause detection period.
7. The method according to claim 6, characterized in that The step S400 includes: Step S410: Determine a target root cause inspection item corresponding to each target node type from the fault location map; Step S420: Obtain a detection function corresponding to each target root cause check item of each target cluster node corresponding to each target node type; Step S430: Obtain each target root cause check item of each target cluster node and several operating parameters within the root cause detection period corresponding to the initial fault root cause node; Step S440: Processing a number of operating parameters corresponding to each target root cause check item according to the detection function corresponding to the target root cause check item to obtain the root cause of the failure of each target cluster node within the root cause detection period.
8. The method according to claim 7, characterized in that The step S420 further includes: Step S421: If the sum of the number of target root cause check items of all target cluster nodes is greater than a preset check item number threshold, then execute step S422; otherwise, execute step S430; Step S422: K1 to K2-K 02 The period between is determined as the shortened root cause detection period; wherein K1 is the time when the initial fault root cause node is closest to the current time; K2 is the time when the abnormal alarm information is received; K 02 Shorten the length of the preset time period; Step S423: Obtain several operating parameters of each target root cause inspection item of each target cluster node within the shortened root cause detection period; Step S424: According to the detection function corresponding to each target root cause check item, several operating parameters of the target root cause check item within the shortened root cause detection period are processed to obtain the fault root cause of each target cluster node within the shortened root cause detection period.
9. A non-transitory computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1 to 8.
10. An electronic device, characterized in that: The device comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 9.